FALCON-512: Tidecoin's Post-Quantum Signature Scheme

Q: Is FALCON-512 the same as FN-DSA?

Yes. FALCON is the algorithm; FN-DSA is the NIST standardization name under Draft FIPS 206. They refer to the same cryptographic scheme.

Q: How many signatures can a FALCON-512 key produce?

Unlimited. FALCON is stateless — there is no key tree, no one-time signature index, no state to track. A single key can safely produce more than 2^64 signatures. This is a fundamental advantage over stateful schemes like XMSS.

Q: What is the security level of FALCON-512?

NIST Security Level 1, equivalent to AES-128 against quantum attacks. The classical best attack requires 2^113+ operations (lattice reduction). For higher security, Tidecoin also supports Falcon-1024 at NIST Level 5 (~AES-256 equivalent).

Q: Which other blockchains use FALCON?

This page should stay anchored to Tidecoin's own implementation as described in the whitepaper. Tidecoin has used Falcon-512 for all transaction signing since December 2020 and presents one of the clearest production examples of Falcon-family signatures securing a live blockchain from genesis.

FALCON-512 is a lattice-based digital signature scheme selected by NIST for post-quantum standardization as FN-DSA (Draft FIPS 206). Tidecoin has used FALCON-512 as its only signature scheme since genesis block (December 27, 2020), making it, to our knowledge, one of the earliest production deployments of this NIST-selected algorithm. Every transaction on the Tidecoin blockchain since genesis uses FALCON-512.

// how it works

How does FALCON-512 work?

FALCON combines two constructions: NTRU lattices and the GPV hash-then-sign framework [Gentry, Peikert, Vaikuntanathan, STOC 2008].

Key generation:

01Sample short polynomials f, g over the ring R_q = Z_q[x]/(x^512 + 1), where q = 12,289
02Compute public key h = g * f^(-1) mod q
03Solve the NTRU equation for the secret basis B = [[g, -f], [G, -F]]

Signing:

01Generate a random 40-byte nonce
02Hash message to a target point c in the lattice
03Use Fast Fourier Sampling (ffSampling) with the secret basis to find a short vector near c
04The signature is the compressed short vector — average ~652 bytes, padded to 666 bytes

Verification:

01Recompute the hash-to-point target c
02Recover s1 = c - s2 * h mod q (one polynomial multiplication)
03Accept if ||(s1, s2)||^2 <= bound (a norm check)

Verification uses only integer arithmetic — no floating-point, no Gaussian sampling, no secret key. ~28,000 verifications/second.

// comparison

Why is FALCON-512 the best post-quantum signature for blockchain?

Property	FALCON-512	ML-DSA-44
Signature size	666 B	2,420 B
Public key size	897 B	1,312 B
PK + Sig total	1,563 B	3,732 B
Stateless	Yes	Yes
NIST standard	Draft FIPS 206	FIPS 204
Verification speed	~28,000/s	Fast

Swipe to compare all columns

FALCON-512 has the smallest combined public key + signature size among the NIST-track lattice signature options discussed in the whitepaper — critical for blockchain where every byte is stored forever and replicated across all nodes.

// side-channel protection

How does Tidecoin prevent FALCON side-channel attacks?

FALCON's signing requires high-precision floating-point arithmetic for discrete Gaussian sampling. Native hardware FPU operations are vulnerable to electromagnetic emanation, power analysis, and timing side-channels — demonstrated by:

// known attacks addressed

FALCON DOWN

[2021, ePrint 2021/772]:

Full key recovery through electromagnetic measurements

SHIFT SNARE

[2025]:

100% key recovery from a single power trace on ARM Cortex-M4

// pqclean mitigations

Tidecoin uses the PQClean "clean" constant-time implementation by Thomas Pornin with integer emulation (FALCON_FPEMU):

All floating-point arithmetic

emulated using uint64_t integer operations — the C double type is never used

Custom barrel-shifter emulation

for constant-time shifts with secret shift counts

No branching on secrets;

table lookups read all elements

Fully portable

across 32-bit, 64-bit, little-endian, and big-endian platforms

The formal correctness of Falcon's emulated floating-point has been verified [Becker & Howe, ePrint 2024/321].

// 2019 sampler bug

Was Tidecoin affected by the 2019 Falcon sampler bug?

No. In August 2019, Markku-Juhani O. Saarinen discovered two severe bugs in the Falcon Gaussian sampler (incorrect lookup table values and wrong rejection sampling probability). A 2025 retrospective [ACM CCS 2025] demonstrated that ~50 million buggy signatures could enable full key recovery.

Thomas Pornin published the fix on September 18, 2019. Tidecoin's genesis block was mined on December 27, 2020 — over 15 months after the fix. Tidecoin has always used the post-fix PQClean implementation. No Tidecoin signature was ever produced by the vulnerable code.

// verification modes

What are Tidecoin's legacy and strict Falcon modes?

Property	Legacy	Strict
When	Pre-AuxPoW (current mainnet)	Post-AuxPoW (upcoming)
Norm Bound	Relaxed: 43,533,782	Standard PQClean: 34,034,726
Max Sig Size	690 bytes	752 bytes (padded 666)
Verification	Backward-compatible with early signatures	Tighter security margins

Swipe to compare all columns

The legacy norm bound is a relaxed threshold adopted for backward compatibility during Tidecoin's early operation — it is not the pre-2019-fix value (the 2019 sampler bug was a fundamentally different issue affecting the lookup table and rejection formula, not the norm bound). The strict bound aligns with the standard PQClean reference implementation.

Keys are identical in both modes. Only signature creation and verification bounds differ. Existing wallets require no key migration — the same keys produce tighter signatures after AuxPoW activation.

// fn-dsa · fips 206

What changes when NIST finalizes FIPS 206?

FIPS 206 standardizes FALCON as FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm). Key changes:

01
BUFF security via public key hashing — zero size cost, stronger unforgeability [ePrint 2024/710]
02
Context string support — domain separation between applications
03
Nonce regeneration on restart — eliminates subtle information leakage from nonce reuse
04
Fixed-point NTRUSolve — removes floating-point from keygen (signing still uses emulated FP)

Public key encoding remains unchanged between FALCON and FN-DSA. Tidecoin's transition plan: existing keys work in both modes; post-activation signatures align with FN-DSA's direction.

// falcon faq

FALCON-512 FAQ

All FAQ

Is FALCON-512 the same as FN-DSA?