FN-DSA (Falcon): standard, dates, parameters, and audit checklist
=================================================================

FN-DSA is NIST's name for Falcon, the fourth post-quantum signature scheme selected in 2022. It will be published as FIPS 206. As of 2026-09 the standard is still in draft; NIST submitted the initial public draft for approval in 2025-08 and a final standard is expected in late 2026 or 2027.

Standard: FIPS 206 (draft)
Standardized by: NIST
Date: TBD (draft under review; final expected late 2026 or 2027)
Status: Draft
Family: Lattice (NTRU, fast-Fourier sampling)
Parameter sets: FN-DSA-512 (Falcon-512) (cat 1, pk 897 B, signature 666 B); FN-DSA-1024 (Falcon-1024) (cat 5, pk 1793 B, signature 1280 B)
Audit focus: The floating-point Gaussian sampler is the hardest part of any post-quantum standard to implement in constant time; audit emulated-FP paths and every platform-specific FPU behavior | Key generation (NTRU solve) correctness and secret-dependent timing | Signature encoding and the variable-length compression format | Reference implementations still change between draft versions; verify against the exact draft the project targets
Auditors: zkSecurity, Trail of Bits, NCC Group (Cryptography Services), Cryspen, Kudelski Security, Quarkslab, Least Authority, Galois, atsec information security, Riscure (Keysight), Cure53, X41 D-Sec
Sources: https://csrc.nist.gov/projects/post-quantum-cryptography | https://csrc.nist.gov/presentations/2025/fips-206-fn-dsa-falcon | https://falcon-sign.info/

Source page: https://pqaudit.org/algorithms/fn-dsa/
Compiled by: PQC Audit Index editors (https://pqaudit.org/about/)
Last reviewed: 2026-09-12