FALCON is a cryptographic algorithm for digital signature, but is it slower than actuals algorithms (ECDSA)?


1 Answer 1


SUPERCOP is a good source of cryptographic benchmarks. For illustration, I've picked a specific CPU (Intel Skylake) and looked at the NIST level 1 (128-bit classical security) cycle counts for Curve25519, Falcon512 and Dilithium2 for good reason, at the median (50%) level. I used the AES version of Dilithium2 since it's representative of using hardware accelerated instructions for randomness.

Algorithm Key generation Sign 59 bytes Verify 59 bytes
ed25519 45,352 48,172 165,992
falcon512tree 20,349,783 406,207 78,329
dilithium2aes 48,760 140,947 61,640

It's worth noting that Curve25519 is the product of years of research into efficient implementations of elliptic-curve cryptography, whereas these figures for PQC schemes, if I'm not mistaken, come from the NIST submission from the designers themselves. Therefore, it is expected that this will improve over time. For instance, there's a recent paper by Thomas Pornin that significantly speeds up Falcon key generation.

  • 2
    $\begingroup$ Nit: NIST level 1 is 128 bit classical security... $\endgroup$
    – poncho
    Mar 2, 2023 at 22:26
  • $\begingroup$ Sorry, you're right. Fixed. $\endgroup$
    – swineone
    Mar 2, 2023 at 22:28
  • $\begingroup$ Some numbers from the authors, oct 2020. $\endgroup$
    – fgrieu
    Mar 3, 2023 at 7:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.