Post-quantum vs classical: key & signature size comparator
How much bigger are post-quantum keys, ciphertexts and signatures than the RSA and elliptic-curve ones they replace? Every figure below is in bytes, from the finalized NIST standards (FIPS 203/204/205) and the FN-DSA (Falcon) draft. Pick a classical baseline to see the multiplier you are actually signing up for.
Key encapsulation (KEM / key exchange)
A TLS handshake sends one public key and one ciphertext, so the "wire cost" column (pk + ciphertext) is what actually hits every connection.
| Algorithm | NIST level | Public key | Ciphertext | Private key | Wire cost (pk+ct) | × baseline |
|---|
Digital signatures
For signatures the pain is usually the signature size (it rides on every message/certificate), and for SLH-DSA it is dramatic in exchange for the most conservative security assumptions.
| Algorithm | NIST level | Public key | Signature | Private key | × baseline (sig) |
|---|
Frequently asked questions
How big is an ML-KEM-768 public key?
An ML-KEM-768 public key is 1,184 bytes, with a 1,088-byte ciphertext, per FIPS 203. That is the NIST Level 3 parameter set, the one most TLS deployments adopt.
How much bigger is an ML-DSA signature than an RSA-2048 signature?
An RSA-2048 signature is 256 bytes; ML-DSA-44 (comparable classical strength) is 2,420 bytes, roughly 9-10 times larger. ML-DSA-65 is 3,309 bytes.
Why is the SLH-DSA signature so much larger?
SLH-DSA (formerly SPHINCS+) is hash-based and trades size for the most conservative security assumptions. Signatures run from 7,856 bytes (128s) to 29,792 bytes (256s), several times larger than ML-DSA, in exchange for relying only on hash-function security.
What is the size difference between ML-KEM-512, 768 and 1024?
Public keys are 800, 1,184 and 1,568 bytes and ciphertexts 768, 1,088 and 1,568 bytes respectively (FIPS 203), at NIST security levels 1, 3 and 5.
Does Falcon have a smaller signature than ML-DSA?
Yes. Falcon-512 signs in about 666 bytes versus 2,420 bytes for the comparable ML-DSA-44, which is Falcon's main advantage, at the cost of harder floating-point implementation.
Which NIST post-quantum algorithm has the smallest public key?
Among signature schemes, SLH-DSA has the smallest public keys (32-64 bytes) but the largest signatures. Among KEMs, ML-KEM-512 is smallest at 800 bytes; Falcon-512's public key is 897 bytes.
What are the official FIPS 203/204/205 byte sizes?
The comparator lists every parameter set's public key, private key, ciphertext and signature in bytes, taken directly from FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), so the numbers are traceable to the standard rather than paraphrased.