FIPS 206 — FN-DSA (Compact Lattice Signatures)

What It Is in One Sentence

FN-DSA creates digital signatures that are much smaller than ML-DSA (~666–1,280 bytes vs ~2,400–4,600 bytes) with equally fast verification — but requires careful implementation due to floating-point arithmetic.

The Problem ML-DSA Doesn't Solve

ML-DSA signatures are large (~3.3 KB for the recommended ML-DSA-65). In bandwidth-constrained environments:

FN-DSA solves this with signatures 4–6× smaller than ML-DSA.

How It Works (High Level)

FN-DSA is based on the NTRU lattice problem (different from ML-DSA's Module-LWE):

NTRU Problem: Given h = g/f mod q where f and g are small secret polynomials, recover f and g.

The signature is a short vector in an NTRU lattice, computed using fast Fourier transforms over the ring of polynomials.

Core Idea: Gaussian Sampling

FN-DSA uses discrete Gaussian sampling to create signatures:

• Sample from a narrow Gaussian distribution (bell curve)
• The "width" of the bell curve is determined by a public parameter
• The signature is a lattice point close to a target, where "close" means sampled from this Gaussian

This is mathematically elegant but computationally complex — it requires floating-point arithmetic and fast Fourier transforms.

Quick Reference

Articles in This Section

• 01 — Why Small Signatures — The bandwidth problem and where size matters
• 02 — NTRU Lattices — A different type of lattice problem
• 03 — Trapdoor Sampling — How signatures are created using lattice trapdoors
• 04 — Fast Fourier Transform — The speed secret behind FN-DSA
• 05 — Side-Channel Risks — Floating-point dangers and how to mitigate them
• 06 — Security Levels — Parameter sets and how to choose
• 07 — When to Use — Deployment scenarios where FN-DSA shines

Resources

• NIST FIPS 206
• FALCON specification