Falcon
Lattices · NTRU-SIS · falcon-sign.info(opens in a new tab)
- Programmes
- Std pending
- Latest version
- fixed-point ·
- Security flags
- None on current sets
Parameter sets
fixed-point · 9 Oct 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| 1024 Note | 5 | 1,793 | 1,280 | 3,073 | 1.03 ms | 23.4 µs |
| 512 Note | 1 | 897 | 666 | 1,563 | 490.8 µs | 13.5 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Note (all parameter sets): Experimental fixed-point implementation by Thomas Pornin (c-fn-dsa-fx32.64), "type 1 fixed-point 32.64" in the terminology of De Almeida Braga, Fouque, Lachguel and Prest. It replaces floating-point arithmetic in signing, as NIST intends for FN-DSA. Keys and signatures are interoperable with the floating-point implementation; seeded signatures differ by design. Public-key and signature sizes are unchanged.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| 1024 | 5 | 1,793 to 1,793 | same | 1,280 to 1,280 | same | — |
| 512 | 1 | 897 to 897 | same | 666 to 666 | same | — |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site New version
fixed-point
Falcon/FN-DSA: added a fixed-point version. Thomas Pornin's experimental c-fn-dsa-fx32.64 replaces floating-point arithmetic with the “type 1 fixed-point 32.64” representation of De Almeida Braga, Fouque, Lachguel and Prest, on the low-RAM structure of c-fn-dsa-alt. Keys and signatures are interoperable with c-fn-dsa; public-key and signature sizes are unchanged. We benchmark standard-mode signing without key expansion, built with the same flags as every other scheme; the floating-point version stays benchmarked from c-fn-dsa. The implementation's key-recovery and message-recovery modes are not part of any standard and are not listed.
- New version
initial