概要
公開日: 2026-07-09
翻訳生成に失敗したため、原文をそのまま保存しています。
原文
Why we cannot wait for better post-quantum signature algorithms 2026-07-09 Bas Westerbaan Christopher Patton 25 min read RSA and ECC, cryptographic algorithms that we’ve all relied on for decades, are vulnerable to the attack of sufficiently advanced quantum computers. Such quantum computers do not exist yet, but they seem to be coming sooner than expected. Luckily, the solution is already available: migrate to ML-KEM encryption and ML-DSA signatures, which are designed to be resistant to quantum attack. They were standardized in 2024 by the U.S. National Institute of Standards and Technology (NIST) after an eight-year open international competition. The migration to post-quantum cryptography is in full swing now. At the time of writing, the majority of traffic handled by Cloudflare is already using ML-KEM encryption, and is thus secured against the threat to data posed by harvest-now-decrypt-later attacks. But encryption is only one part of the equation: to be fully secure against quantum computers capable of breaking classical cryptography, we aim to deploy post-quantum signatures to protect authentication systems from unauthorized access. We are targeting 2029 for Cloudflare to be fully post-quantum secure. ML-DSA, the best all-around post-quantum signature scheme standardized today, has its downsides: it’s much larger on the wire, and many tricks we were able to perform with RSA and ECC simply cannot be done with ML-DSA. There are better post-quantum signature schemes on the horizon: last month, NIST announced that it is advancing nine post-quantum signature schemes to the third round of the “ signatures on-ramp ”. And a draft standard for FN-DSA (née Falcon), which was picked from the previous competition, is expected imminently. We have been very interested in advances in post-quantum signature algorithms, and wrote about the progress in 2021 , 2022 , 2024 , and 2025 . In this blog post we’ll treat you to the latest developments in great detail. But first we have to deal with the elephant in the room: These new signature algorithms will not be ready in time for the PQ transition — not even close, as we will see later on . The problem is arriving too soon for us to wait. ML-DSA is available today, and it will have to do for the first migration. As Eric Rescorla wrote in 2024: You go to war with the algorithms you have, not the ones you wish you had. Nonetheless, the search for better post-quantum signature algorithms is crucial for several reasons, and we firmly believe it is still the best use of NIST’s limited resources. Let’s have a look at the signature algorithms in detail. After that we’ll look at the timeline for their availability, and the reasons why we still need them. The signature algorithms In the table below, we compare the candidate signature algorithms that progressed to the third round (marked by 🤔), with classical algorithms vulnerable to quantum attack (marked by ❌), and the post-quantum algorithms that are already standardized ( ✅) or soon will be (📝). Each candidate proposes several variants. We list the most relevant variants to TLS, the protocol used to secure connections on the Internet. To explore all variants, check out Thom Wigger s' signatures zoo . Sizes (bytes) CPU time (lower is better) Family Name variant A Public key Signature Signing Verification Elliptic curves Ed25519 ❌ 32 64 0.15 1.3 Factoring RSA 2048 ❌ 272 256 80 0.4 Lattices ML-DSA 44 ✅ 1,312 2,420 1 (baseline) 1 (baseline) Symmetric SLH-DSA 128s ✅ 32 7,856 14,000 40 SLH-DSA 128f ✅ 32 17,088 720 110 SLH-DSA 128-24 📝 32 3,856 7,000,000 ⚠️ 4 LMS M24_H20_W8 ✅ 48 1,112 2.9 ⚠️ 8.4 Lattices FN-DSA 512 📝 897 666 3 ⚠️ 0.7 Lattices HAWK 512 🤔 1,024 555 0.25 1.2 Proof of knowledge MQOM L1-gf16-fast-5r 🤔 60 3,280 8 20 SDitH SDitH2-L1-gf2-fast 🤔 70 4,484 15 40 FAEST EM-128f 🤔 32 5,060 4.2 9 Isogeny SQIsign I 🤔 65 148 300 ⚠️ 50 Multivariate MAYO one 🤔 1,420 454 2.1 0.4 MAYO two 🤔 4,912 186 1.1 0.8 QR-UOV