TIDECOIN
Get TDC

FALCON-512: Tidecoin's Post-Quantum Signature Scheme

FALCON-512 is a lattice-based digital signature scheme selected by NIST for post-quantum standardization as FN-DSA (Draft FIPS 206). Tidecoin has used FALCON-512 as its only signature scheme since genesis block (December 27, 2020), making it, to our knowledge, one of the earliest production deployments of this NIST-selected algorithm. Every transaction on the Tidecoin blockchain since genesis uses FALCON-512.

// how it works

How does FALCON-512 work?

FALCON combines two constructions: NTRU lattices and the GPV hash-then-sign framework [Gentry, Peikert, Vaikuntanathan, STOC 2008].

01

Key Generation

  1. 01Sample short polynomials f, g over the ringR_q = Z_q[x] / (x^512 + 1), q = 12,289
  2. 02Compute the public key ash = g · f^(-1) mod q
  3. 03Solve the NTRU equation for secret basisB = [[g, −f], [G, −F]]
02

Signing

  1. 01Generate a random 40-byte noncenonce ← rand(40 bytes)
  2. 02Hash the message to a target point in the latticec = H(nonce ‖ message)
  3. 03Use Fast Fourier Sampling (ffSampling) with the secret basis to find a short vector near csig = ffSampling(B, c)
  4. 04The signature is the compressed short vector — average ~652 bytes, padded to 666 bytessig_compressed ≈ 666 bytes
03

Verification

  1. 01Recompute the hash-to-point target cc = H(nonce ‖ message)
  2. 02Recover s1 = c - s2 * h mod q (one polynomial multiplication)s1 = c − s2 · h mod q
  3. 03Accept if ||(s1, s2)||^2 <= bound (a norm check)‖(s1, s2)‖² ≤ bound
  4. 04Verification uses only integer arithmetic — no floating-point, no Gaussian sampling, no secret key. ~28,000 verifications/second.~28,000 verifications/sec
// comparison

Why is FALCON-512 the best post-quantum signature for blockchain?

FALCON-512 has the smallest combined public key + signature size among the NIST-track lattice signature options discussed in the whitepaper — critical for blockchain where every byte is stored forever and replicated across all nodes.

PropertyFALCON-512ML-DSA-44
Signature size666 B2,420 B
Public key897 B1,312 B
PK + Sig1,563 B3,732 B
Stateless
NIST standardDraft FIPS 206FIPS 204
Verification speed~28,000/sFast
// side-channel protection

How does Tidecoin prevent FALCON side-channel attacks?

FALCON's signing requires high-precision floating-point arithmetic for discrete Gaussian sampling. Native hardware FPU operations are vulnerable to electromagnetic emanation, power analysis, and timing side-channels — demonstrated by:

// known attacks addressed

FALCON DOWN

2021

Full key recovery through electromagnetic measurements.

ePrint 2021/772

SHIFT SNARE

2025

100% key recovery from a single power trace on ARM Cortex-M4 devices.

arXiv 2504.00320
// pqclean mitigations

Tidecoin uses the PQClean "clean" constant-time implementation by Thomas Pornin with integer emulation (FALCON_FPEMU):

All floating-point arithmetic

emulated using uint64_t integer operations — the C double type is never used

Custom barrel-shifter emulation

for constant-time shifts with secret shift counts

No secret-dependent branching

table lookups read all elements

Fully portable

across 32-bit, 64-bit, little-endian, and big-endian platforms

The formal correctness of Falcon's emulated floating-point has been verified [Becker & Howe, ePrint 2024/321].

// fn-dsa · fips 206

What changes when NIST finalizes FIPS 206?

FIPS 206 standardizes FALCON as FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm). Key changes:

  1. 01

    BUFF security via public key hashing — zero size cost, stronger unforgeability [ePrint 2024/710]

  2. 02

    Context string support — domain separation between applications

  3. 03

    Nonce regeneration on restart — eliminates subtle information leakage from nonce reuse

  4. 04

    Fixed-point NTRUSolve — removes floating-point from keygen (signing still uses emulated FP)

Public key encoding remains unchanged between FALCON and FN-DSA. Tidecoin's transition plan: existing keys work in both modes; post-activation signatures align with FN-DSA's direction.

// verification modes

What are Tidecoin's legacy and strict Falcon modes?

Keys are identical in both modes. Only signature creation and verification bounds differ. Existing wallets require no key migration — the same keys produce tighter signatures after AuxPoW activation.

PropertyLegacyStrict
WhenPre-AuxPoW (current mainnet)Post-AuxPoW (upcoming)
Norm boundRelaxed: 43,533,782Standard PQClean: 34,034,726
Max signature size690 bytes752 bytes (padded 666)
VerificationBackward-compatible with early signaturesTighter security margins

The legacy norm bound is a relaxed threshold adopted for backward compatibility during Tidecoin's early operation — it is not the pre-2019-fix value (the 2019 sampler bug was a fundamentally different issue affecting the lookup table and rejection formula, not the norm bound). The strict bound aligns with the standard PQClean reference implementation.

// 2019 sampler bug

Was Tidecoin affected by the 2019 Falcon sampler bug?

No. In August 2019, Markku-Juhani O. Saarinen discovered two severe bugs in the Falcon Gaussian sampler (incorrect lookup table values and wrong rejection sampling probability). A 2025 retrospective [ACM CCS 2025] demonstrated that ~50 million buggy signatures could enable full key recovery.

Thomas Pornin published the fix on September 18, 2019. Tidecoin's genesis block was mined on December 27, 2020 — over 15 months after the fix. Tidecoin has always used the post-fix PQClean implementation. No Tidecoin signature was ever produced by the vulnerable code.

// falcon faq

FALCON-512 FAQ

All FAQ

Is FALCON-512 the same as FN-DSA?

Yes. FALCON is the algorithm; FN-DSA is the NIST standardization name under Draft FIPS 206. They refer to the same cryptographic scheme.

How many signatures can a FALCON-512 key produce?

Unlimited. FALCON is stateless — there is no key tree, no one-time signature index, no state to track. A single key can safely produce more than 2^64 signatures. This is a fundamental advantage over stateful schemes like XMSS.

What is the security level of FALCON-512?

NIST Security Level 1, equivalent to AES-128 against quantum attacks. The classical best attack requires 2^113+ operations (lattice reduction). For higher security, Tidecoin also supports Falcon-1024 at NIST Level 5 (~AES-256 equivalent).

Which other blockchains use FALCON?

This page should stay anchored to Tidecoin's own implementation as described in the whitepaper. Tidecoin has used Falcon-512 for all transaction signing since December 2020 and presents one of the clearest production examples of Falcon-family signatures securing a live blockchain from genesis.