FN-DSA / Falcon

FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm) is the planned NIST standard, FIPS 206, for the Falcon digital signature scheme scheme. Falcon was selected in the NIST PQC standardization process in July 2022, but as of early 2026 the draft standard has not been published. Its distinction is compactness: the smallest combined public key and signature size of any NIST post-quantum signature.

#Design

Falcon is a hash-and-sign scheme over NTRU lattices, a family within lattice-based cryptography whose underlying problem has been studied since 1996. It instantiates the GPV framework (Gentry, Peikert, and Vaikuntanathan, 2008): the public key describes a lattice, the private key is a hidden short basis (trapdoor) for it, and signing means hashing the message to a point and using the trapdoor to sample a lattice vector close to that point. The signature is the short difference vector; verification just checks the hash relation and the vector's shortness.

The sampling step is where the "FFT" in the name enters. Falcon uses fast Fourier sampling over a tree of Gaussian distributions to produce signatures efficiently, and the security proof requires the sampled vectors to follow a precise discrete Gaussian distribution. Its predecessor NTRUSign skipped that rigor and leaked its private key over a few thousand observed signatures; Falcon exists largely to do the same job with a proof that signatures reveal nothing about the trapdoor. The Falcon specification implements this with double-precision floating-point arithmetic.

#Sizes

Signatures are variable length because of the Gaussian sampling; the specification defines a padded format with the fixed sizes below, which are also the commonly quoted averages. Sizes in bytes.

A Falcon-512 public key plus signature totals about 1.5 kilobytes, versus about 3.7 kilobytes for ML-DSA-44 and about 7.9 kilobytes for a SLH-DSA-128s signature alone. Verification is also very fast and uses only integer arithmetic. See post-quantum algorithm comparison for full tables.

#Why standardization lags

Falcon is the hardest of the selected algorithms to implement safely, and that is the stated reason FIPS 206 trails the 2024 standards:

• Signing requires high-precision floating-point Gaussian sampling. Making it constant time is delicate, and floating-point behavior varies across CPUs; devices without a floating-point unit must emulate it in software, which is slow and error-prone.
• Published research has demonstrated side-channel and fault attacks against unprotected Falcon implementations, showing that small leakage in the sampler can compromise the private key.
• NIST has indicated the standard will be named FN-DSA and has discussed adjustments to make implementations more robust, which takes additional specification work.

None of this reflects doubt about the underlying mathematics; the NTRU problem remains well regarded. The risk is concentrated in implementation quality rather than in the design (NIST PQC project).

#Status and use cases

Falcon was announced as a selection on July 5, 2022, alongside Kyber, Dilithium, and SPHINCS+. As of early 2026 the FIPS 206 draft is pending, so Falcon deployments run on the round-3 specification and will need to migrate once the standard fixes the final details.

Its compactness makes it attractive wherever bytes are scarce and verification is frequent: certificate chains, DNSSEC, constrained radio links, and blockchain systems, several of which adopted Falcon ahead of standardization because signature size directly drives transaction cost. The practical guidance until FIPS 206 lands: verification-only use is low risk, while signing implementations demand unusual care or hardware with vetted floating-point behavior. Implementations are available in liboqs and PQClean.