How does FIPS 206 Falcon (FN-DSA) achieve such compact signatures compared to other post-quantum algorithms?

Falcon (Fast-Fourier Lattice-based Signatures over NTRU, standardized in FIPS 206 as FN-DSA) achieves the smallest combined public key and signature size among all primary NIST PQC signature standards. For NIST Security Level 1 (Falcon-512), the public key is only 897 bytes and the signature is just 666 bytes (compared to ~2,420 bytes for ML-DSA / Dilithium and ~7,856 bytes for SPHINCS+). Falcon accomplishes this by operating over NTRU lattices in the polynomial ring Z[x]/(x^n + 1) where n is a power of two (512 or 1024). It uses a "hash-and-sign" paradigm with a Gentry-Peikert-Vaikuntanathan (GPV) trapdoor: signing involves solving the Shortest Vector Problem (SVP) by executing Fast Fourier Sampling (FFT) over the tree of Gram-Schmidt norms, generating short vectors that closely match a continuous Gaussian distribution.

Why does FIPS 205 SPHINCS+ (SLH-DSA) provide the highest conservative security confidence among all PQC standards?

While structured lattice schemes (ML-DSA and Falcon) are significantly faster and smaller, their security depends on the mathematical hardness of lattice problems (Module-LWE and NTRU) which have only been studied intensively for a few decades. If an unexpected breakthrough occurs in quantum lattice reduction algorithms, all lattice-based cryptography could be compromised. In contrast, SPHINCS+ (Stateless Hash-Based Digital Signature Algorithm, standardized as SLH-DSA in FIPS 205) relies solely on the security of standard cryptographic hash functions (SHA-256 or SHAKE-256). It makes zero algebraic or lattice hardness assumptions. Because SHA-256 collision and pre-image resistance are foundational to all modern computing, SPHINCS+ serves as the ultimate conservative fallback signature standard.

How does SPHINCS+ achieve "statelessness" without suffering from the key exhaustion flaws of LMS and XMSS?

Classic hash-based signatures (LMS / XMSS) require non-volatile monotonic state counters because reusing a single WOTS+ leaf destroys security. SPHINCS+ achieves complete statelessness by creating a massive virtual Merkle Hypertree (e.g. depth h=64, divided into d=8 layers of subtrees). At the bottom layer, message digests are signed using FORS (Forest of Random Subsets), a few-time signature scheme that can safely sign multiple messages without leaking the private key. The public key of the FORS instance is signed by a leaf in the bottom XMSS tree, which is authenticated up through the hypertree to the master root. Because the hypertree contains 2^{64} leaves, randomly selecting a leaf index for each signature guarantees that the collision probability of selecting the same leaf index twice is astronomically negligible (less than 2^{-60}), allowing signers to emit trillions of signatures without ANY state tracking.

What is the implementation risk of Falcon timing side-channel attacks during Fast Fourier Gaussian sampling?

During Falcon signature generation, the private key trapdoor is used to compute Gaussian perturbations over intermediate polynomial coefficients. If this sampling is implemented using standard hardware floating-point units (FPUs) or variable-time rejection loops, subtle timing variations and CPU instruction execution cycles reveal secret key bits to an attacker observing cache lines or power traces. Consequently, implementing Falcon securely requires constant-time emulation of floating-point arithmetic or specialized constant-time Gaussian samplers (such as the Karney sampler), which increases software implementation complexity.

Post-Quantum Signatures: Falcon (NTRU) & SPHINCS+ (SLH-DSA) Studio

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Falcon (NTRU) & SPHINCS+ (SLH-DSA) Post-Quantum Studio

Compare NIST FIPS 206 Falcon (FN-DSA) compact lattice signatures against FIPS 205 SPHINCS+ (SLH-DSA) stateless hash-based signatures across bandwidth, memory, and CPU cycles.

Ciphersuite:

666 bytes

Signature Size (Wire Payload)

897 bytes

Public Key Size

NIST Level 1

Quantum Security Category

Lattice (NTRU FFT)

Underlying Hardness Primitive

NIST PQC Signature Benchmark Matrix

Algorithm	Standard	Hardness Basis	Pubkey (B)	Sig Size (B)	Verify Speed	Statefulness
Falcon-512	FIPS 206	NTRU Lattice (FFT)	897	666	Very Fast (~40 μs)	Stateless
Falcon-1024	FIPS 206	NTRU Lattice (FFT)	1,793	1,280	Fast (~80 μs)	Stateless
SLH-DSA-SHA2-128s	FIPS 205	Pure Hash (FORS + Hypertree)	32	7,856	Moderate (~1.2 ms)	Stateless
SLH-DSA-SHA2-128f	FIPS 205	Pure Hash (FORS + Hypertree)	32	17,088	Fast (~350 μs)	Stateless
ML-DSA-44 (Dilithium)	FIPS 204	Module-LWE Lattice	1,312	2,420	Very Fast (~30 μs)	Stateless

Post-Quantum Signature Inspector

Active Ciphersuite: Falcon-512

Public Key Hash (Thumbprint): 0x82f4...d194

Message Digest: SHA-256("firmware_kernel_x86_64.elf")

Generated Signature Header:
[0x39, 0x02, 0x71, 0xbb... 666 bytes total]

Falcon (NTRU) & SPHINCS+ (SLH-DSA) Post-Quantum Studio

NIST PQC Signature Benchmark Matrix

Post-Quantum Signature Inspector

Production Implementation Code

🔍 Companion Workbenches & Verification Tools

Zero-Knowledge Rollups: PLONK & KZG Polynomial Commitments Studio

Schnorr Adaptor Signatures Studio | Scriptless Scripts & Atomic Swaps

FIDO2 CTAP2, WebAuthn & Hardware Security Key Protocol Studio

OAuth 2.1, Token Exchange (RFC 8693) & DPoP Security Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions