Algorithms

What is FN-DSA? NIST's Falcon signature standard, and why FIPS 206 isn't published yet

By PhotonDispatch Staff · Published 2 November 2026 · Last updated 2 November 2026

Short answer: FN-DSA is the name NIST plans to give FIPS 206, a digital-signature standard based on the Falcon scheme. Checked on csrc.nist.gov on 2 November 2026, FIPS 206 has not been published, not even as an initial public draft. NIST's post-quantum cryptography project page says the Falcon algorithm "was selected for ongoing standardization" and "that process is underway," and the agency's selected-algorithms list still marks Falcon "FIPS coming soon."

NIST picked Falcon in July 2022, alongside CRYSTALS-Dilithium and SPHINCS+, as one of the algorithms it would standardize after its multi-year public competition. Dilithium and SPHINCS+ became FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in August 2024; Falcon was held back for its own standard, which NIST calls FN-DSA. The other post-quantum standard still pending is HQC, a backup encryption algorithm NIST selected in March 2025; see PhotonDispatch's explainer on what HQC does. Our explainer on what ML-KEM, ML-DSA and SLH-DSA each do covers the three standards that did ship in 2024.

NIST has described the FIPS 206 draft as close to finished without publishing it. Writing on NIST's public pqc-forum mailing list on 28 August 2025, Dustin Moody, who leads the agency's post-quantum cryptography project, said the draft was "essentially completed on our end" and had gone up for internal approval to publish. He said the draft keeps Falcon's randomized signing rather than switching to a deterministic variant, and that NIST adjusted the Gaussian sampler used in key generation after consulting the Falcon submission team.

The delay traces to how Falcon signs. Falcon's reference design samples from a Gaussian distribution using floating-point arithmetic, which is hard to make both fast and resistant to timing side channels that could leak secret-key information. In correspondence posted to pqc-forum in September 2025, NIST said it would let implementers use fixed-point arithmetic for one step of key generation, but ruled out fixed-point signing because it would need roughly 256 bits per value. For signing itself, FIPS 206 will allow either native or software-emulated floating point, and NIST said it secured permission from IEEE to reprint the needed parts of the IEEE 754-2019 floating-point standard so FIPS 206 would not require a separate paid reference.

FN-DSA will sit alongside, not replace, the two 2024 signature standards, and all three rest on different math. ML-DSA is built on structured, or module, lattices and signs using the Fiat-Shamir-with-aborts technique from its CRYSTALS-Dilithium submission. SLH-DSA is a stateless hash-based scheme descended from SPHINCS+, which only relies on the security of its underlying hash function. FN-DSA is also lattice-based, but over NTRU lattices rather than module lattices, using the hash-and-sign framework of Gentry, Peikert and Vaikuntanathan with a technique Falcon's designers call fast Fourier sampling, according to the Falcon specification. NIST's 2030 and 2035 migration deadlines, covered in PhotonDispatch's report on IR 8547, apply to the older algorithms FN-DSA and its two finished siblings are meant to eventually replace; see our policy coverage for the wider transition.

Falcon's appeal is size. In the algorithm's pre-standardization specification, Falcon-512, roughly matched to NIST's security category 1, produces a 666-byte signature with an 897-byte public key; Falcon-1024, at category 5, produces a 1,280-byte signature with a 1,793-byte public key. For comparison, NIST's FIPS 204 specifies a 2,420-byte signature and a 1,312-byte public key for the smallest ML-DSA parameter set, ML-DSA-44, and FIPS 205 specifies a 7,856-byte signature but only a 32-byte public key for the smallest SLH-DSA parameter set. These Falcon figures are from the designers' own specification, published before NIST finished adapting the algorithm into FIPS 206, so the final numbers in the standard could still move slightly.

Smaller signatures matter most where many of them accumulate: a TLS handshake that chains several certificates, a DNSSEC response, a firmware update that gets re-verified at every boot, or a device with a narrow radio link. NIST has not given a publication date for FIPS 206. Outside trackers that monitor the agency's own pages put a final standard in late 2026 or early 2027, but that is their estimate, not a NIST commitment, so check csrc.nist.gov directly before planning around it.

← All news