Context: Many widely used public-key cryptographic schemes have been designed based on the difficulty of factoring and similar problems. That includes RSA, the Diffie-Hellman Key Exchange, ECDH, ECDSA, Ed448, Ed25519.

This includes almost all cryptocurrencies.

Even though NIST may not be fully ready, some of us (especially in the blockchain space) need to make some choices, perhaps for a long way forward.

The 3 final candidates seem to be Dilithium, Falcon, and Rainbow.

Rainbow seems to have already been 'cracked':

"Last month, one of the three NIST finalists for post-quantum signature schemes has received its final nail in the coffin: Ward Beullens, a PostDoc at IBM Research, published a practical key recovery attack against the Rainbow signature scheme."


The alternate 3 candidates seem to be: GeMSS, Picnic, and SPHINCS+.

Which one would you use and why? (optimally with shortest public key)

  • $\begingroup$ If verification key size is the only criterion you care about, then SPHINCS+ is the best candidate; it has large signatures and is much slower than the other options, though. If you want to minimize combined verification key and signature size, then Falcon wins. Dilithium is simpler to implement and not far behind in terms of compactness. To sum up: the answer will be different depending on what exactly you care about. $\endgroup$ Jun 26, 2022 at 9:56