A Comparative Analysis of Security Margins and Practical Deployment Readiness of NIST Round 3 Finalist Post-Quantum Cryptographic Algorithms

1. Introduction

The advent of quantum computing presents a significant and evolving threat to the landscape of digital security. Theoretically, quantum computers possess the computational power to efficiently break many of the current public-key cryptography algorithms, such as RSA and Elliptic Curve Cryptography (ECC), which underpin much of our modern digital infrastructure.¹ This vulnerability arises from Shor's algorithm, a quantum algorithm capable of factoring large numbers and solving discrete logarithm problems in polynomial time, tasks that are computationally intractable for classical computers.³ The potential compromise of these widely used cryptographic methods necessitates a proactive transition to post-quantum cryptography (PQC), which aims to develop cryptographic algorithms secure against both classical and quantum computers.¹ The urgency of this transition is amplified by the "harvest now, decrypt later" threat, where malicious actors may be collecting encrypted data today with the intention of decrypting it in the future when sufficiently powerful quantum computers become available.⁵ This long-term risk underscores the immediate need for organizations to begin planning and implementing quantum-resistant solutions for data with extended confidentiality requirements.⁷

Recognizing this impending cryptographic disruption, the National Institute of Standards and Technology (NIST) initiated a Post-Quantum Cryptography Standardization Process in 2016.¹ This multi-year, multi-round competition aimed to identify and standardize quantum-safe algorithms through a rigorous evaluation process involving global experts.⁹ The evaluation criteria encompassed security, performance, and various other algorithm characteristics.¹¹ In 2022, NIST announced the first set of algorithms selected for standardization, marking a significant milestone in the global effort to secure digital communications against the quantum threat.¹³ This proactive approach by NIST reflects a widespread acknowledgment of the quantum risk and offers a structured pathway for the adoption of quantum-resistant cryptography.¹⁰

This paper aims to provide a comprehensive and comparative analysis of the security margins and practical deployment readiness of the NIST Round 3 finalist algorithms selected for standardization at the conclusion of the third round of this rigorous process.¹¹ These algorithms are CRYSTALS-Kyber, CRYSTALS-Dilithium, FALCON, and SPHINCS+.⁹ Understanding the trade-offs between the security assurances offered by these algorithms and their practicality for real-world deployment is crucial for guiding their adoption across various applications and industries.

2. Overview of NIST Round 3 Finalist Algorithms

2.1. CRYSTALS-Kyber (ML-KEM)

CRYSTALS-Kyber, also known as ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), is a key encapsulation mechanism based on the mathematical problem of Module Learning With Errors (MLWE) over module lattices.¹³ This problem is believed to remain computationally hard even for quantum computers.¹⁵ NIST selected CRYSTALS-Kyber as the primary algorithm for general encryption and key exchange due to its strong security properties and efficient performance.¹⁰ The algorithm offers different parameter sets, namely Kyber-512, Kyber-768, and Kyber-1024, which are designed to meet varying security levels roughly equivalent to AES-128, AES-192, and AES-256, respectively.¹³

2.2. CRYSTALS-Dilithium (ML-DSA)

CRYSTALS-Dilithium, or ML-DSA (Module-Lattice-Based Digital Signature Algorithm), is a digital signature algorithm that derives its security from the difficulty of lattice problems over module lattices.¹⁶ It employs the Fiat-Shamir with Aborts technique to achieve compact and secure signatures.¹⁸ NIST recommends CRYSTALS-Dilithium as the primary digital signature algorithm for most use cases, highlighting its efficiency and relatively straightforward implementation compared to other lattice-based candidates.¹⁰

2.3. FALCON (FN-DSA)

FALCON, or FN-DSA (FFT NTRU-based Digital Signature Algorithm), is another lattice-based digital signature algorithm that utilizes the "hash-and-sign" paradigm over NTRU lattices.¹⁰ It employs Fast Fourier Sampling for efficient signature generation and verification.²⁰ NIST selected FALCON for standardization as a complement to CRYSTALS-Dilithium, particularly for applications where smaller signature sizes are advantageous.⁹ While FALCON offers compactness and fast verification, its implementation is more complex due to its reliance on floating-point arithmetic.³

2.4. SPHINCS+ (SLH-DSA)

SPHINCS+, also known as SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), stands apart as a stateless hash-based signature scheme.⁴ Its security is based solely on the well-understood security of cryptographic hash functions, such as SHA-256, SHAKE-256, and Haraka.²² NIST chose SPHINCS+ primarily as a cryptographic backup option in the event that lattice-based schemes are found to be vulnerable to future attacks.⁹ While offering a very conservative security posture, SPHINCS+ generally exhibits larger signature sizes and slower performance compared to the lattice-based finalists.²³

3. Comparative Analysis of Security Margins

3.1. CRYSTALS-Kyber

The security of CRYSTALS-Kyber is rooted in the Module Learning With Errors (MLWE) problem, a lattice-based problem considered hard even for quantum computers.¹³ NIST has specified three security levels for Kyber, aiming for security roughly equivalent to AES-128, AES-192, and AES-256 with its Kyber-512, Kyber-768, and Kyber-1024 parameter sets, respectively.¹⁵ For applications demanding high security, the Kyber team recommends using the Kyber-768 parameter set, which is conservatively estimated to provide more than 128 bits of security against known classical and quantum attacks.¹⁵ Despite its strong theoretical foundations, CRYSTALS-Kyber has been subject to security analysis, revealing potential vulnerabilities. Side-channel attacks, such as the recently disclosed KyberSlash attacks, have demonstrated the possibility of recovering secret keys by exploiting timing-based flaws in specific implementations.²⁴ These attacks highlight the critical importance of secure implementation practices.¹³ Furthermore, ongoing research has questioned the concrete security level provided by Kyber's parameter choices, with some analyses suggesting that the actual security margin might be lower than initially claimed, particularly for Kyber-512.²⁶ The "Core-SVP" metric, often used to estimate the security of lattice-based schemes, has been a subject of debate regarding its accuracy in reflecting real-world attack costs against Kyber.²⁷

3.2. CRYSTALS-Dilithium

CRYSTALS-Dilithium offers strong security guarantees against chosen message attacks, relying on the hardness of lattice problems over module lattices.¹⁸ The Dilithium team recommends using the Dilithium3 parameter set, which, according to a conservative analysis, achieves more than 128 bits of security against known classical and quantum attacks.¹⁸ The security of Dilithium is based on the Module Learning With Errors (MLWE), Module Short Integer Solution (MSIS), and SelfTargetMSIS problems.¹⁷ While MLWE and MSIS are well-established and believed to be secure, the quantum hardness of SelfTargetMSIS, a novel problem specific to Dilithium, has been an area of active research. Recent work has provided the first proof of the hardness of SelfTargetMSIS in the Quantum Random Oracle Model (QROM), bolstering confidence in Dilithium's resistance to quantum adversaries.²⁸ Similar to other post-quantum algorithms, CRYSTALS-Dilithium is susceptible to side-channel attacks. Power analysis attacks have been demonstrated to recover secret key coefficients by targeting polynomial multiplication operations and exploiting randomness leakage during the signing process.³⁰ These findings underscore the need for robust side-channel countermeasures in practical implementations of Dilithium.³²

3.3. FALCON

FALCON is designed to provide strong security under chosen message attacks, with its security based on the Short Integer Solution (SIS) problem over NTRU lattices.¹⁹ The algorithm employs a true Gaussian sampler internally, which is intended to guarantee negligible leakage of information about the secret key, even after a very large number of signatures.¹⁹ In terms of classical security, FALCON-512 is considered roughly equivalent to RSA-2048.¹⁹ The security of FALCON has been analyzed within the Quantum Random Oracle Model (QROM), providing a theoretical basis for its quantum resistance.²⁰ Despite these security features, FALCON has faced scrutiny regarding its formal security proof and susceptibility to side-channel attacks. Initial analyses revealed that the original parameter choices for FALCON did not align with the standard security proofs for the underlying GPV framework.³⁴ However, recent work has addressed this by proposing minor modifications to FALCON that allow for the first formal security proof of the scheme in the random oracle model, although achieving strong unforgeability remains a challenge for certain parameter sets.³⁴ Furthermore, FALCON's reliance on floating-point arithmetic in its key generation and signing processes makes it potentially vulnerable to side-channel attacks, particularly those targeting the Gaussian sampler and FFT operations.³ Electromagnetic analysis attacks have successfully extracted secret signing keys from FALCON implementations, highlighting the need for effective countermeasures.³

3.4. SPHINCS+

SPHINCS+ distinguishes itself by relying solely on the security of well-established cryptographic hash functions, such as SHA-256, SHAKE-256, and Haraka, making it a very conservative choice for post-quantum digital signatures.²¹ NIST views SPHINCS+ as an extremely conservative option and a valuable backup in case lattice-based schemes encounter unforeseen vulnerabilities.¹⁴ The algorithm offers both simple and robust variants, providing trade-offs between signature size and signing speed.³⁵ While its reliance on hash functions provides a strong theoretical security foundation against quantum attacks, SPHINCS+ has been found to be vulnerable to fault injection attacks during the signature generation process.³⁶ These attacks can potentially lead to universal forgeries, emphasizing the importance of implementing appropriate countermeasures, especially in environments where physical access to devices might be possible.³⁷ Although SPHINCS+ is designed to limit the number of signatures per key pair to 2^64 to maintain security, the security degrades gracefully if this limit is exceeded.²³ The original tight security proof for SPHINCS+ was found to have flaws, but these have since been addressed with a new tight security proof.³⁸

4. Comparative Analysis of Practical Deployment Readiness

To facilitate a direct comparison of the practical deployment readiness of the NIST Round 3 finalist algorithms, the following tables summarize their performance and resource requirements based on the available research.

Table 1. Performance Comparison of NIST PQC Round 3 Finalists.

Algorithm	Security Level	Operation	Metric	Value (Approx.)	Platform	Source
Kyber-512	AES-128	Key Generation	Cycles (Haswell)	122,684	Intel i7-4770K	15
Kyber-512	AES-128	Encryption	Cycles (Haswell)	154,524	Intel i7-4770K	15
Kyber-512	AES-128	Decryption	Cycles (Haswell)	187,960	Intel i7-4770K	15
Kyber-768	AES-192	Key Generation	Cycles (Haswell)	199,408	Intel i7-4770K	15
Kyber-768	AES-192	Encryption	Cycles (Haswell)	235,260	Intel i7-4770K	15
Kyber-768	AES-192	Decryption	Cycles (Haswell)	274,900	Intel i7-4770K	15
Dilithium2	NIST 2	Key Generation	Cycles (Skylake)	300,751	Intel i7-6600U	18
Dilithium2	NIST 2	Signing	Cycles (Skylake)	1,355,434	Intel i7-6600U	18
Dilithium2	NIST 2	Verification	Cycles (Skylake)	327,362	Intel i7-6600U	18
Dilithium3	NIST 3	Key Generation	Cycles (Skylake)	544,232	Intel i7-6600U	18
Dilithium3	NIST 3	Signing	Cycles (Skylake)	2,348,703	Intel i7-6600U	18
Dilithium3	NIST 3	Verification	Cycles (Skylake)	522,267	Intel i7-6600U	18
Falcon-512	NIST 1	Key Generation	ms	8.64	Intel i5-8259U	19
Falcon-512	NIST 1	Signing	Sign/sec	5948.1	Intel i5-8259U	19
Falcon-512	NIST 1	Verification	Verify/sec	27933.0	Intel i5-8259U	19
Falcon-1024	NIST 5	Key Generation	ms	27.45	Intel i5-8259U	19
Falcon-1024	NIST 5	Signing	Sign/sec	2913.0	Intel i5-8259U	19
Falcon-1024	NIST 5	Verification	Verify/sec	13650.0	Intel i5-8259U	19
SPHINCS+-128f-simple	NIST 1	Signing	Cycles (AVX2)	~10^8	Intel	39
SPHINCS+-128f-simple	NIST 1	Verification	Cycles (AVX2)	~10^7	Intel	39

Table 1. Performance Comparison of NIST PQC Round 3 Finalists.

Algorithm	Security Level	Operation	Metric	Value (Approx.)	Platform	Source
Kyber-512	AES-128	Key Generation	Cycles (Haswell)	122,684	Intel i7-4770K	15
Kyber-512	AES-128	Encryption	Cycles (Haswell)	154,524	Intel i7-4770K	15
Kyber-512	AES-128	Decryption	Cycles (Haswell)	187,960	Intel i7-4770K	15
Kyber-768	AES-192	Key Generation	Cycles (Haswell)	199,408	Intel i7-4770K	15
Kyber-768	AES-192	Encryption	Cycles (Haswell)	235,260	Intel i7-4770K	15
Kyber-768	AES-192	Decryption	Cycles (Haswell)	274,900	Intel i7-4770K	15
Dilithium2	NIST 2	Key Generation	Cycles (Skylake)	300,751	Intel i7-6600U	18
Dilithium2	NIST 2	Signing	Cycles (Skylake)	1,355,434	Intel i7-6600U	18
Dilithium2	NIST 2	Verification	Cycles (Skylake)	327,362	Intel i7-6600U	18
Dilithium3	NIST 3	Key Generation	Cycles (Skylake)	544,232	Intel i7-6600U	18
Dilithium3	NIST 3	Signing	Cycles (Skylake)	2,348,703	Intel i7-6600U	18
Dilithium3	NIST 3	Verification	Cycles (Skylake)	522,267	Intel i7-6600U	18
Falcon-512	NIST 1	Key Generation	ms	8.64	Intel i5-8259U	19
Falcon-512	NIST 1	Signing	Sign/sec	5948.1	Intel i5-8259U	19
Falcon-512	NIST 1	Verification	Verify/sec	27933.0	Intel i5-8259U	19
Falcon-1024	NIST 5	Key Generation	ms	27.45	Intel i5-8259U	19
Falcon-1024	NIST 5	Signing	Sign/sec	2913.0	Intel i5-8259U	19
Falcon-1024	NIST 5	Verification	Verify/sec	13650.0	Intel i5-8259U	19
SPHINCS+-128f-simple	NIST 1	Signing	Cycles (AVX2)	~10^8	Intel	39
SPHINCS+-128f-simple	NIST 1	Verification	Cycles (AVX2)	~10^7	Intel	39

Table 2. Resource Requirements of NIST PQC Round 3 Finalists.

Algorithm	Security Level	Public Key Size (Bytes)	Private Key Size (Bytes)	Signature/Ciphertext Size (Bytes)	RAM Usage (KB)	Source
Kyber-512	AES-128	800	1632	768 (Ciphertext)	-	15
Kyber-768	AES-192	1184	2400	1088 (Ciphertext)	-	15
Kyber-1024	AES-256	1568	3168	1568 (Ciphertext)	-	15
Dilithium2	NIST 2	1312	2528	2420 (Signature)	~10	18
Dilithium3	NIST 3	1952	4000	3293 (Signature)	~61	18
Dilithium5	NIST 5	2592	4864	4595 (Signature)	~98	18
Falcon-512	NIST 1	897	~1998	666 (Signature)	~14	19
Falcon-1024	NIST 5	1793	~3840	1280 (Signature)	~29	19
SPHINCS+-128s-simple	NIST 1	32	64	7856 (Signature)	-	42
SPHINCS+-128f-simple	NIST 1	32	64	17088 (Signature)	-	42

Table 2. Resource Requirements of NIST PQC Round 3 Finalists.

Algorithm	Security Level	Public Key Size (Bytes)	Private Key Size (Bytes)	Signature/Ciphertext Size (Bytes)	RAM Usage (KB)	Source
Kyber-512	AES-128	800	1632	768 (Ciphertext)	-	15
Kyber-768	AES-192	1184	2400	1088 (Ciphertext)	-	15
Kyber-1024	AES-256	1568	3168	1568 (Ciphertext)	-	15
Dilithium2	NIST 2	1312	2528	2420 (Signature)	~10	18
Dilithium3	NIST 3	1952	4000	3293 (Signature)	~61	18
Dilithium5	NIST 5	2592	4864	4595 (Signature)	~98	18
Falcon-512	NIST 1	897	~1998	666 (Signature)	~14	19
Falcon-1024	NIST 5	1793	~3840	1280 (Signature)	~29	19
SPHINCS+-128s-simple	NIST 1	32	64	7856 (Signature)	-	42
SPHINCS+-128f-simple	NIST 1	32	64	17088 (Signature)	-	42

The practical deployment of these algorithms presents several challenges and considerations. The increased computational demands and larger key/signature sizes of PQC algorithms compared to classical cryptography can impact the performance of existing infrastructure, particularly in resource-constrained environments.⁷ Interoperability with legacy systems will be a critical aspect of the transition, likely requiring hybrid cryptographic approaches that combine classical and post-quantum algorithms.⁴⁴ While NIST has finalized the first PQC standards, broader adoption hinges on the development of international standards and clear regulatory guidance.⁴⁶ Implementing these novel algorithms securely, especially to mitigate side-channel attacks, demands specialized expertise.⁷ The transition will also involve costs associated with software and hardware updates, testing, and personnel training.⁷

Each algorithm has its own set of implementation libraries and ongoing pilot projects. CRYSTALS-Kyber has reference and optimized implementations in C, with third-party libraries available in various languages and integration with frameworks like liboqs.⁴⁷ It is being explored in pilot projects for secure key exchange.⁴⁸ CRYSTALS-Dilithium also has C implementations and third-party libraries in multiple languages, with ongoing efforts in hardware implementation.⁵⁰ FALCON has C and Python reference implementations, with integration into liboqs and hardware implementations under development.¹⁹ SPHINCS+ has C implementations for different hash functions and parameter sets, along with third-party libraries and ongoing research into hardware implementations and memory optimization for constrained devices.⁵²

5. Conclusion and Recommendations

The NIST Round 3 finalist post-quantum cryptographic algorithms represent a significant step towards securing digital systems against the future threat of quantum computers. Each algorithm offers a unique profile in terms of security margins and practical deployment readiness. CRYSTALS-Kyber stands out as an efficient and promising KEM for general encryption, though ongoing security analysis and implementation vulnerabilities warrant careful consideration. CRYSTALS-Dilithium provides a strong and efficient digital signature algorithm suitable for a wide range of applications, with a growing body of security analysis. FALCON offers the advantages of compact signatures and fast verification, making it attractive for bandwidth-constrained scenarios, but its implementation complexity and side-channel vulnerability require attention. SPHINCS+ provides the most conservative security guarantees through its reliance on hash functions, but its larger signature sizes and slower signing speeds might limit its applicability in performance-critical contexts.

For organizations embarking on the transition to post-quantum cryptography, a thorough evaluation of their specific security requirements, performance needs, and resource constraints is essential. A hybrid approach, combining traditional and post-quantum algorithms, may be a prudent strategy during the initial phases of migration to ensure interoperability and maintain a degree of security even if one of the new algorithms faces unforeseen vulnerabilities. Further research is crucial in areas such as enhancing the resistance of these algorithms against advanced side-channel and fault attacks, optimizing their performance across diverse hardware and software platforms, and developing standardized and secure hybrid cryptographic systems. Continued engagement with the cryptographic community and monitoring the ongoing analysis of these algorithms will be vital for ensuring a secure and effective transition to a post-quantum future.