Falcon (Signature Scheme)
What is Falcon (Signature Scheme)?
Falcon (Signature Scheme)A lattice-based post-quantum signature scheme over NTRU lattices, selected by NIST in 2022 for compact signatures and now being finalized as FIPS 206 (FN-DSA).
Falcon (Fast-Fourier Lattice-based Compact Signatures over NTRU) is a hash-and-sign signature scheme built on the GPV framework, with security based on the Short Integer Solution problem over NTRU lattices. It produces unusually compact outputs — about 666 bytes for Falcon-512 and 1280 bytes for Falcon-1024 — at the cost of complex floating-point Gaussian sampling that complicates side-channel-resistant implementation. NIST selected Falcon during the third PQC round in 2022 alongside Dilithium and SPHINCS+, and is finalizing it as FIPS 206 (FN-DSA), expected to appear after FIPS 203, 204, and 205. Its small signatures make it attractive for bandwidth-constrained protocols such as DNSSEC and TLS certificates.
● Examples
- 01
Considered for DNSSEC zone signing where signature size is a critical constraint.
- 02
Used in research X.509 certificate chains to minimize TLS handshake bytes.
● Frequently asked questions
What is Falcon (Signature Scheme)?
A lattice-based post-quantum signature scheme over NTRU lattices, selected by NIST in 2022 for compact signatures and now being finalized as FIPS 206 (FN-DSA). It belongs to the Cryptography category of cybersecurity.
What does Falcon (Signature Scheme) mean?
A lattice-based post-quantum signature scheme over NTRU lattices, selected by NIST in 2022 for compact signatures and now being finalized as FIPS 206 (FN-DSA).
How does Falcon (Signature Scheme) work?
Falcon (Fast-Fourier Lattice-based Compact Signatures over NTRU) is a hash-and-sign signature scheme built on the GPV framework, with security based on the Short Integer Solution problem over NTRU lattices. It produces unusually compact outputs — about 666 bytes for Falcon-512 and 1280 bytes for Falcon-1024 — at the cost of complex floating-point Gaussian sampling that complicates side-channel-resistant implementation. NIST selected Falcon during the third PQC round in 2022 alongside Dilithium and SPHINCS+, and is finalizing it as FIPS 206 (FN-DSA), expected to appear after FIPS 203, 204, and 205. Its small signatures make it attractive for bandwidth-constrained protocols such as DNSSEC and TLS certificates.
How do you defend against Falcon (Signature Scheme)?
Defences for Falcon (Signature Scheme) typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for Falcon (Signature Scheme)?
Common alternative names include: FN-DSA, FIPS 206.
● Related terms
- cryptography№ 846
Post-Quantum Cryptography
Classical cryptographic algorithms designed to remain secure against attacks by both classical and large-scale quantum computers.
- cryptography№ 607
Lattice-Based Cryptography
A family of post-quantum cryptographic schemes whose security reduces to the hardness of finding short vectors or solving linear equations with small errors over high-dimensional lattices.
- cryptography№ 321
Digital Signature
A public-key cryptographic mechanism that proves the authenticity, integrity and non-repudiation of a message or document.
- cryptography№ 252
CRYSTALS-Dilithium
A lattice-based digital-signature scheme standardized by NIST as FIPS 204 (ML-DSA) in August 2024 and intended as the post-quantum replacement for RSA, DSA, and ECDSA signatures.
- cryptography№ 732
NIST PQC Standardization
The multi-year NIST process that selects and standardizes post-quantum cryptographic algorithms; its first three standards, FIPS 203, 204, and 205, were published in August 2024.
- cryptography№ 1077
SPHINCS+
A stateless hash-based digital-signature scheme standardized by NIST as FIPS 205 (SLH-DSA) in August 2024, offering conservative post-quantum security with no structured-math assumptions.