The Efficiency of Post-Quantum Signature Schemes

April 2, 2026 · Brett · crypto

NIST has given us three Post-Quantum Signature algorithms

And now it’s up to us to prepare for Q-Day. For a deeper dive into the history of NIST’s standardization process check out our blog post on NIST’s Post-Quantum Standardization Process.

Cryptographic signature schemes consist of three algorithms:

• Key Generation This is run once, and generates a public-key / private-key pair. In the context of signature schemes, the private key is often called the “signing key”, while the public key is called the “verification key”
• Signature Generation This takes the signing key and the message and produces a signature
• Verification This takes the signature, the message, and the verification key, and verifies that the signature is valid (i.e., that the signer used the private signing key to produce this signature on this message)

After undergoing serious public scrutiny during the NIST selection process, we believe that these post-quantum signature schemes will be secure, but if we’re going to switch from our current signature schemes (e.g. ECDSA, RSA) to a post-quantum scheme, the performance of these schemes is also important. And, in this case, it’s a big issue. All three of NIST’s post-quantum signatures schemes produce signatures that are much larger than the classical (pre-quantum) signature schemes that are widely used today. This means that applications that process a lot of digital signatures may see their bandwidth and storage costs increase dramatically.

Sizes

Classical Signature Sizes

Post-Quantum Signature sizes

Note that each of these schemes can be instantiated at different security levels (e.g. RSA-2048, RSA-4096, ML-DSA-44, ML-DSA-65). These benchmarks are for the lowest level of security of all these schemes. This roughly corresponds to the security level of ECDSA-P256 or Ed25519.

Note that SLH-DSA has two variants “small” (s) and “fast” (f). The “small” variant creates smaller signatures, and the “fast” variant improves signature-generation time.

The key takeaway here is that the smallest Post-Quantum signatures (Falcon’s) are 10x larger than those generated by ECDSA / Ed25519 (which are those commonly used in the blockchain space), and the “small” variant of SLH-DSA has signatures that are 100x the size of the classical schemes that they’re replacing.

Speeds

These numbers were taken on my Macbook Pro (with Apple’s M3 Max chip). Benchmarks on different machines will always be a bit different, but these should give a sense of how these schemes compare.

Classical Signature speeds

Post-Quantum Signature speeds

Note that the Apple M3 Max chip has the FEAT_SHA256 instruction that provides hardware acceleration for SHA256. This is likely why the SHA2 version of SLH-DSA runs faster than the SHAKE variant on this machine.

There are a handful of key takeways from the timings.

1. Generating a single signature is quite fast — the usually under 1 millisecond, so the efficiency is only an issue for systems that are generating or verifying thousands of signatures
2. Many of the Post-Quantum Schemes are actually faster than the classical schemes
3. This means that the efficiency bottleneck with moving to Post-Quantum signatures is only in the size of the keys / signatures

The benchmarking scripts can be found in the git repo