3 ms·
DJB's signature proposal is SPHINCS+, which is standardized in FIPS 205 as SLH-DSA. NTRUPrime is a KEM, so it doesn't really compete with FALCON. Personally I
by less_less 2y ago
DJB's signature proposal is SPHINCS+, which is standardized in FIPS 205 as SLH-DSA. NTRUPrime is a KEM, so it doesn't really compete with FALCON.
Personally I think that FALCON is brilliant, but it is very difficult to securely implement or even precisely define, due to heavy use of floating-point arithmetic in the signing routine. I don't want to put words in DJB's mouth, but if you share his concern for ease of secure implementation, ease of auditing and side-channel protection, then you may prefer SPHINCS+ or, if the performance of SPHINCS+ is not acceptable in your workload, possibly Dilithium.
Of course, if signature size is make-or-break, then of the choices currently slated for standardization, FALCON has the smallest signatures. But it is possible that the new signature onramp will change that in a few years -- if you can be confident in the security of whatever is chosen within so short a time.