SQIsign
Isogenies · sqisign.org(opens in a new tab)
- Programmes
- On-ramp R3
- Latest version
- v3.0 ·
- Security flags
- None on current sets
Parameter sets
v3.0 · 1 Sep 2026
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| V Recommended | 5 | 169 | 406 | 575 | 208.06 ms | 20.05 ms |
| III Recommended | 3 | 129 | 306 | 435 | 87.30 ms | 8.20 ms |
| I Recommended | 1 | 83 | 200 | 283 | 24.65 ms | 3.15 ms |
| alt p306.3 | 1 | 79 | 192 | 271 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p305.55 | 1 | 79 | 192 | 271 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p313.69 | 1 | 81 | 198 | 279 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p343.9 | 1 | 89 | 214 | 303 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p376.65 | 1 | 97 | 230 | 327 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p448.3 | 3 | 117 | 286 | 403 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p470.3 | 3 | 119 | 288 | 407 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p521.1 | 3 | 133 | 314 | 447 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p574.27 | 3 | 147 | 344 | 491 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p607.1 | 5 | 153 | 373 | 526 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p612.17 | 5 | 157 | 378 | 535 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p665.19 | 5 | 169 | 406 | 575 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
| alt p767.43 | 5 | 195 | 456 | 651 | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) | no code(No implementation of this alternative prime in the official code (the implementation covers only the three main primes)) |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| V | 5 | 129 to 169 | 31%larger | 292 to 406 | 39%larger | Flag cleared. Was Warning: Improved algorithm for the supersingular isogeny problem (ePrint 2026/1486) achieves time/memory p^{1/3+o(1)}, vs. previous best p^{1/2}; relies on an unproven heuristic smoothness assumption and carries a superpolynomial o(1) overhead plus high memory cost — concrete impact on SQIsign's parameters not yet clarified |
| III | 3 | 97 to 129 | 33%larger | 224 to 306 | 37%larger | Flag cleared. Was Warning: Improved algorithm for the supersingular isogeny problem (ePrint 2026/1486) achieves time/memory p^{1/3+o(1)}, vs. previous best p^{1/2}; relies on an unproven heuristic smoothness assumption and carries a superpolynomial o(1) overhead plus high memory cost — concrete impact on SQIsign's parameters not yet clarified |
| I | 1 | 65 to 83 | 28%larger | 148 to 200 | 35%larger | Flag cleared. Was Warning: Improved algorithm for the supersingular isogeny problem (ePrint 2026/1486) achieves time/memory p^{1/3+o(1)}, vs. previous best p^{1/2}; relies on an unproven heuristic smoothness assumption and carries a superpolynomial o(1) overhead plus high memory cost — concrete impact on SQIsign's parameters not yet clarified |
| alt p306.3 new in v3.0 | 1 | — to 79 | — | — to 192 | — | — |
| alt p305.55 new in v3.0 | 1 | — to 79 | — | — to 192 | — | — |
| alt p313.69 new in v3.0 | 1 | — to 81 | — | — to 198 | — | — |
| alt p343.9 new in v3.0 | 1 | — to 89 | — | — to 214 | — | — |
| alt p376.65 new in v3.0 | 1 | — to 97 | — | — to 230 | — | — |
| alt p448.3 new in v3.0 | 3 | — to 117 | — | — to 286 | — | — |
| alt p470.3 new in v3.0 | 3 | — to 119 | — | — to 288 | — | — |
| alt p521.1 new in v3.0 | 3 | — to 133 | — | — to 314 | — | — |
| alt p574.27 new in v3.0 | 3 | — to 147 | — | — to 344 | — | — |
| alt p607.1 new in v3.0 | 5 | — to 153 | — | — to 373 | — | — |
| alt p612.17 new in v3.0 | 5 | — to 157 | — | — to 378 | — | — |
| alt p665.19 new in v3.0 | 5 | — to 169 | — | — to 406 | — | — |
| alt p767.43 new in v3.0 | 5 | — to 195 | — | — to 456 | — | — |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- added to site Update
Where a specification lists alternative or additional parameter sets next to its main ones, the main sets are now marked, so the Recommended filter hides the alternatives: SNOVA, MAYO, QR-UOV, SQIsign and FAEST (FAEST-EM is the specification's alternative variant), and the NGCC KEMs DTRU (DTRU-Light and DTRU-Prime are the alternatives to the primary tricyclotomic sets) and MAMBA-Frost (the compact-ciphertext CC variants are additional to the default sets). The round-3 specifications of SNOVA (Table 6), MAYO (Table 2.2), QR-UOV (Appendix B) and SQIsign (Appendix P) also list alternative or additional parameter sets; these are now shown under All parameter sets, with sizes from the specifications. The six odd-characteristic SNOVA alternatives are marked broken by Beullens & Hess's vinegar-bias attack.
- added to site New version
v3.0
SQIsign 3.0 released as the third-round submission spec: parameters revised in response to the improved supersingular isogeny-problem algorithm (ePrint 2026/1486), and the reference implementation drops its GMP dependency for a from-scratch fixed-precision integer library. Public key and signature sizes grow (level I: 65/148 → 83/200 bytes; level III: 97/224 → 129/306; level V: 129/292 → 169/406 bytes). On our benchmark (v3.0 with its x86-64 assembly field arithmetic vs. the v2.0.1 reference build) signing is faster at levels I and III (−35% / −9%) but slower at level V (+12%), and verification is 12–38% slower at every level.
- Attack
Improved algorithm for the supersingular isogeny problem (ePrint 2026/1486) achieves time/memory p^{1/3+o(1)}, down from the previous best p^{1/2}. Relies on an unproven heuristic smoothness assumption and has a superpolynomial overhead plus high memory cost; concrete impact on SQIsign's parameters not yet clarified. Flagged as warning.
- Milestone
NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.
- added to site Update
Updated 7 schemes to their latest published specifications. PERK redesigned parameter sets (v2.2.0). MQOM adds gf16 variants (v2.1). RYDE and Mirath corrected signature sizes and added faster variants. CROSS, SQIsign, and MAYO updated with revised benchmarks.
- New version
v2.0.1
- New version
v2.0
- New version
v1.0