3 ms·
I wonder what he thinks about FALCON considering it's a rival to his submission based on NTRU but is on path to standardization but NTRUPrime isn't.
by ilove196884 2y ago
I wonder what he thinks about FALCON considering it's a rival to his submission based on NTRU but is on path to standardization but NTRUPrime isn't.
- less_less 2y agoDJB's signature proposal is SPHINCS+, which is standardized in FIPS 205 as SLH-DSA. NTRUPrime is a KEM, so it doesn't really compete with FALCON. Personally I think that FALCON is brilliant, but it is very difficult to securely implement or even precisely define, due to heavy use of floating-point arithmetic in the signing routine. I don't want to put words in DJB's mouth, but if you share his concern for ease of secure implementation, ease of auditing and side-channel protection, then you may prefer SPHINCS+ or, if the performance of SPHINCS+ is not acceptable in your workload, possibly Dilithium. Of course, if signature size is make-or-break, then of the choices currently slated for standardization, FALCON has the smallest signatures. But it is possible that the new signature onramp will change that in a few years -- if you can be confident in the security of whatever is chosen within so short a time.