FALCON-SIGNATURE

NTRU FALCON compact lattice signature.

Definition

FALCON parameter sets: Falcon-512 (Level 1, ~AES-128 security), Falcon-1024 (Level 5, ~AES-256). Sizes: Falcon-512 public key 897 bytes, signature 666 bytes (vs Dilithium2 2420+). Performance: Sign ~10000-50000 ops/sec (slower than Dilithium due to Fast-Fourier sampling), Verify ~50000+ ops/sec. Complications: floating-point GPV samplers (requires constant-time implementation challenging side-channel attacks). NIST FN-DSA standardisation expected 2025 FIPS 206. Advanced adoption: Cloudflare CIRCL Go, smartcard target usage with compactness.

Origin

FALCON submitted to NIST PQC Round 1 November 2017 ; selected NIST PQC standard July 2022 ; FIPS 206 FN-DSA under standardisation expected publication 2025.

Example in context

A smartcard EMV application uses FALCON-512 for transaction signature ; 666-byte signature fits in 4K APDU response constraints better than Dilithium or SPHINCS+.

Related terms

• CRYSTALS Dilithium — other lattice signature.