crypto-sizes.tools

Post-quantum vs classical: key & signature size comparator

How much bigger are post-quantum keys, ciphertexts and signatures than the RSA and elliptic-curve ones they replace? Every figure below is in bytes, from the finalized NIST standards (FIPS 203/204/205) and the FN-DSA (Falcon) draft. Pick a classical baseline to see the multiplier you are actually signing up for.

Key encapsulation (KEM / key exchange)

A TLS handshake sends one public key and one ciphertext, so the "wire cost" column (pk + ciphertext) is what actually hits every connection.

AlgorithmNIST level Public keyCiphertext Private keyWire cost (pk+ct) × baseline

Digital signatures

For signatures the pain is usually the signature size (it rides on every message/certificate), and for SLH-DSA it is dramatic in exchange for the most conservative security assumptions.

AlgorithmNIST level Public keySignature Private key× baseline (sig)

Frequently asked questions

How big is an ML-KEM-768 public key?

An ML-KEM-768 public key is 1,184 bytes, with a 1,088-byte ciphertext, per FIPS 203. That is the NIST Level 3 parameter set, the one most TLS deployments adopt.

How much bigger is an ML-DSA signature than an RSA-2048 signature?

An RSA-2048 signature is 256 bytes; ML-DSA-44 (comparable classical strength) is 2,420 bytes, roughly 9-10 times larger. ML-DSA-65 is 3,309 bytes.

Why is the SLH-DSA signature so much larger?

SLH-DSA (formerly SPHINCS+) is hash-based and trades size for the most conservative security assumptions. Signatures run from 7,856 bytes (128s) to 29,792 bytes (256s), several times larger than ML-DSA, in exchange for relying only on hash-function security.

What is the size difference between ML-KEM-512, 768 and 1024?

Public keys are 800, 1,184 and 1,568 bytes and ciphertexts 768, 1,088 and 1,568 bytes respectively (FIPS 203), at NIST security levels 1, 3 and 5.

Does Falcon have a smaller signature than ML-DSA?

Yes. Falcon-512 signs in about 666 bytes versus 2,420 bytes for the comparable ML-DSA-44, which is Falcon's main advantage, at the cost of harder floating-point implementation.

Which NIST post-quantum algorithm has the smallest public key?

Among signature schemes, SLH-DSA has the smallest public keys (32-64 bytes) but the largest signatures. Among KEMs, ML-KEM-512 is smallest at 800 bytes; Falcon-512's public key is 897 bytes.

What are the official FIPS 203/204/205 byte sizes?

The comparator lists every parameter set's public key, private key, ciphertext and signature in bytes, taken directly from FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), so the numbers are traceable to the standard rather than paraphrased.

Data sources. ML-KEM: FIPS 203. ML-DSA: FIPS 204. SLH-DSA: FIPS 205 (SHA2, "s"/"f" small/fast parameter sets). FN-DSA/Falcon: NIST draft & the Falcon spec. Classical sizes are standard uncompressed encodings (RSA modulus size; X25519/Ed25519 32-byte keys; P-256 64-byte uncompressed point). Sizes are exact for PQC; RSA/ECC vary slightly by encoding (DER wrappers, point compression). NIST security levels: 1≈AES-128, 3≈AES-192, 5≈AES-256 brute-force equivalent (level 2 ≈ SHA-256 collision). This page is a reference; verify against the standard before use in a design. Every number is sourced from those tables, so where other sites disagree, this one is traceable. Download the full dataset (JSON).