The Signatures Protecting Your Keys Won't Survive Quantum Computers.

Everything You Sign Today Is Borrowed Time

Every TLS certificate, every crypto wallet, every software update signature on the planet relies on the same two mathematical assumptions: factoring large integers is hard (RSA) and solving discrete logarithms on elliptic curves is hard (ECDSA).

In 1994, Peter Shor proved that a sufficiently large quantum computer can solve both problems in polynomial time. Not faster — categorically different. A 4096-bit RSA key that would take a classical computer billions of years to crack would fall in hours.

This isn't science fiction. NIST began its post-quantum standardization process in 2016 and finalized FIPS 206 — the FN-DSA standard (formerly Falcon) — as one of the approved replacements. The migration deadline is real: government systems must transition by 2035.

Lattice Math That Quantum Can't Crack

Falcon — now standardized as FN-DSA (FFT over NTRU-Lattice‑Based Digital Signature Algorithm) — replaces the vulnerable math with a problem no quantum algorithm can efficiently solve: the Shortest Vector Problem (SVP) on lattices.

Think of a lattice as an infinite, regularly-spaced grid of points in high-dimensional space. Given an arbitrary target point, finding the closest lattice point is easy if you know the secret short basis vectors — but astronomically hard if you only know long public basis vectors. Even Grover's algorithm only provides a quadratic speedup, leaving the problem firmly intractable.

falcon-rs — Pure Rust, Zero Compromise

falcon-rs is a faithful port of Thomas Pornin's C reference implementation, rewritten entirely in Rust with zero C dependencies. It passes every NIST Known Answer Test for both FN‑DSA‑512 and FN‑DSA‑1024, achieving bit-for-bit parity with the original.

use falcon::prelude::*;

// Generate an FN-DSA-512 key pair
let kp = FnDsaKeyPair::generate(9).unwrap();

// Sign a message with domain separation
let ctx = DomainSeparation::Context(b"my-protocol-v1");
let sig = kp.sign(b"Hello, post-quantum world!", &ctx).unwrap();

// Verify with just the public key
FnDsaSignature::verify(sig.to_bytes(), kp.public_key(),
    b"Hello, post-quantum world!", &ctx).unwrap();

Faster Than C — Where It Matters

Key generation — the most complex operation, involving NTRU equation solving and LDL* tree construction — is consistently 18–24% faster than the C reference on Apple Silicon. Signing and verification trade marginal speed for constant-time execution, a deliberate security choice.

The Quantum Clock Is Ticking

Consider "harvest now, decrypt later" attacks: adversaries record encrypted traffic today and store it. When quantum computers arrive, they retroactively break the signatures and decrypt everything. Your data signed with ECDSA in 2026 could be forged in 2035.

FN-DSA is uniquely positioned among NIST's post-quantum standards because of its compact signatures — at 666 bytes (FN-DSA-512), it produces the smallest signatures of any lattice scheme, making it ideal for bandwidth-constrained environments: blockchain transactions, IoT devices, embedded systems, and certificate chains.

falcon-rs brings this to the Rust ecosystem with no_std support, WASM compilation, and a security-audited codebase — making post-quantum signatures accessible everywhere from cloud servers to smart cards to web browsers.

Sources & Links