A RAM-Efficient Implementation of Falcon

Thomas Pornin

Paper 2026/1915

A RAM-Efficient Implementation of Falcon

Thomas Pornin

, NCC Group

Abstract

We present a RAM-efficient implementation of Falcon: RAM usage has shrunk to about 11 kB, down from about 31 kB in the previous implementation of Falcon-512. This code is furthermore faster on Arm Cortex M4, with average signature generation cost down to 13.45 million cycles. Optimization techniques include a novel variant of the FFT, replacement of some floating-point operations with modular integer computations, delayed addition of input within the Fast Fourier sampling process, and an alternate signature reassembly process. More than half of the floating-point operations have been removed. The resulting implementation is now small enough to allow use in small embedded systems such as smart cards.

Note: Fixed typo in section 3.4 (5519 -> 5119)

Metadata

Available format(s): PDF
Category: Implementation
Publication info: Preprint.
Keywords: Falcon FN-DSA FFT NTT
Contact author(s): thomas pornin @ nccgroup com
History: 2026-09-10: revised; 2026-09-07: received; See all versions
Short URL: https://ia.cr/2026/1915
License: CC BY

BibTeX

@misc{cryptoeprint:2026/1915,
      author = {Thomas Pornin},
      title = {A {RAM}-Efficient Implementation of Falcon},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/1915},
      year = {2026},
      url = {https://eprint.iacr.org/2026/1915}
}