Skip to main content
Cryptography

Return to Answer

added 2 characters in body
Source Link
Mark Schultz-Wu ♦
Mark Schultz-Wu ♦
  • 14.6k
  • 21
  • 50

As poncho mentions, this is of course application dependent. For one of the "most obvious" applications (TLS 1.3), Bas Westerbaan at Cloudflare has a nice blog post. Of course you should read the whole thing for more details, but the takeaway from the blog post is

A timely adoption of PQ signatures on the web would be great. Our evidence so far suggests that this will be easiest, if six signatures and two public keys would fit in 9kB.

This is to say that for TLS1.3, the "natural metric" is 6 sizeof(sig) + 2 sizeof(pk), butwhich suggests that (for TLS) signature size is more important than public key size.

As poncho mentions, this is of course application dependent. For one of the "most obvious" applications (TLS 1.3), Bas Westerbaan at Cloudflare has a nice blog post. Of course you should read the whole thing for more details, but the takeaway from the blog post is

A timely adoption of PQ signatures on the web would be great. Our evidence so far suggests that this will be easiest, if six signatures and two public keys would fit in 9kB.

This is to say that for TLS1.3, the "natural metric" is 6 sizeof(sig) + 2 sizeof(pk), but suggests that (for TLS) signature size is more important than public key size.

As poncho mentions, this is of course application dependent. For one of the "most obvious" applications (TLS 1.3), Bas Westerbaan at Cloudflare has a nice blog post. Of course you should read the whole thing for more details, but the takeaway from the blog post is

A timely adoption of PQ signatures on the web would be great. Our evidence so far suggests that this will be easiest, if six signatures and two public keys would fit in 9kB.

This is to say that for TLS1.3, the "natural metric" is 6 sizeof(sig) + 2 sizeof(pk), which suggests that (for TLS) signature size is more important than public key size.

Source Link
Mark Schultz-Wu ♦
Mark Schultz-Wu ♦
  • 14.6k
  • 21
  • 50

As poncho mentions, this is of course application dependent. For one of the "most obvious" applications (TLS 1.3), Bas Westerbaan at Cloudflare has a nice blog post. Of course you should read the whole thing for more details, but the takeaway from the blog post is

A timely adoption of PQ signatures on the web would be great. Our evidence so far suggests that this will be easiest, if six signatures and two public keys would fit in 9kB.

This is to say that for TLS1.3, the "natural metric" is 6 sizeof(sig) + 2 sizeof(pk), but suggests that (for TLS) signature size is more important than public key size.