Performance Analysis of Quantum-Secure Digital Signature Algorithms in Blockchain

Abstract: The long-term security of public blockchains strictly depends on the hardness assumptions of the underlying digital signature schemes. In the current scenario, most deployed cryptocurrencies and blockchain platforms rely on elliptic-curve cryptography, which is vulnerable to quantum attacks due to Shor's algorithm. Therefore, it is important to understand how post-quantum (PQ) digital signatures behave when integrated into real blockchain systems. This report presents a blockchain prototype that supports multiple quantum-secure signature algorithms, focusing on CRYSTALS-Dilithium, Falcon and Hawk as lattice-based schemes. This report also describes the design of the prototype and discusses the performance metrics, which include key generation, signing, verification times, key sizes and signature sizes. This report covers the problem, background, and experimental methodology, also providing a detailed comparison of quantum-secure signatures in a blockchain context and extending the analysis to schemes such as HAETAE.

• The paper conducts a system-level comparison of quantum-secure digital signature algorithms in a blockchain-like environment, integrating three schemes: CRYSTALS-Dilithium, Falcon, and Hawk.
• Key findings highlight significant differences in performance, with Falcon and Hawk achieving substantially faster verification and smaller signature sizes (between 555 and 220 bytes smaller than ML-DSA) compared to CRYSTALS-Dilithium, while Hawk-512 demonstrates the fastest signing times (approximately 31 µs per transaction).
• The study reveals that signatures and key sizes affect block size almost directly affecting overall blockchain efficiency; Hawk-512 results in a block size of about 2.65 MB for 1,000 transactions, whereas ML-DSA-87 generates a block size of approximately 9.86 MB

Motivation and scope

Deployed public blockchains authenticate transactions almost exclusively with elliptic-curve signatures (ECDSA or Schnorr over secp256k1), whose security rests on the discrete logarithm problem. Shor's algorithm breaks these assumptions on a sufficiently large quantum computer, and because blockchain data is publicly stored, "store now, forge later" attacks are a concrete long-term risk (2601.17785). The paper addresses the gap between micro-benchmark studies of post-quantum (PQ) signature schemes and their behavior inside an actual blockchain implementation: schemes with similar standalone costs may diverge once transaction serialization, block size, and validation latency are accounted for.

The contribution is a single-node, account-based blockchain prototype in which the digital signature algorithm can be swapped transparently behind a Crypto interface, enabling a controlled comparison of CRYSTALS-Dilithium (ML-DSA), Falcon, and Hawk at the blockchain level, supplemented by standalone microbenchmarks of HAETAE.

Prototype design and methodology

The prototype follows an Ethereum-like account model but deliberately omits consensus and networking to isolate cryptographic overhead. Core structures include transactions (sender/recipient public keys, amount, nonce, signature), blocks chained via SHA3-256 hashes, and wallets bound to a concrete scheme. A factory function instantiates one of three backends—OqsMldsaCrypto and OqsFalconCrypto wrapping liboqs, and HawkCrypto wrapping the Hawk reference implementation—so application logic never depends on the chosen algorithm.

Experiments ran on x86-64 Windows under MSVC in Release mode. For each scheme, the benchmark performs 100 key generations, signs 1000 transactions into a single block, and validates that block 100 times, reporting average keygen/sign/verify times plus serialized key, transaction, and block sizes. Block validation time is measured directly on a fully populated block rather than extrapolated from microbenchmarks, and tamper detection is confirmed by flipping a bit in a signature.

A notable methodological concession: HAETAE could not be integrated into the prototype because its reference code relies on GCC-specific features (variable-length arrays) and OpenSSL-based randomness incompatible with the MSVC toolchain. HAETAE is therefore evaluated only through standalone microbenchmarks, and its numbers exclude blockchain-level overhead such as serialization.

The compared schemes

All four candidates are lattice-based and rely on NTT-accelerated polynomial arithmetic over rings $\mathbb{Z}_q[X]/(X^n+1)$, reducing multiplication from $O(n^2)$ to $O(n \log n)$. They differ substantially in structure:

• ML-DSA (CRYSTALS-Dilithium): Fiat–Shamir-with-aborts over Module-LWE/Module-SIS; three parameter sets (44/65/87) with $(k,\ell)$ from (4,3) to (8,5). Signatures range from 2420 to 4627 bytes.
• Falcon: GPV hash-and-sign over NTRU lattices with fast Fourier orthogonalization; compact signatures (658 bytes for Falcon-512) but complex Gaussian sampling.
• Hawk: hash-and-sign based on the lattice isomorphism problem; the shortest signatures tested (555 bytes for HAWK-512), constant-time reference implementation, but not yet standardized.
• HAETAE: Fiat–Shamir-with-aborts targeting shorter signatures than Dilithium for space-constrained settings; parameter sets 120/180/260 with signatures of 1474–2948 bytes.

Size results

Scheme	PK (B)	Sig (B)	Avg tx size (B)	Block size, 1000 tx
ML-DSA-44	1312	2420	5092	~5.09 MB
ML-DSA-87	2592	4627	9859	~9.86 MB
Falcon-512	897	658	2497	~2.50 MB
Falcon-1024	1793	1275	4905	~4.90 MB
Hawk-512	1024	555	2651	~2.65 MB
Hawk-1024	2440	1221	6149	~6.15 MB

The dominant finding is that signature and key sizes translate nearly linearly into block size. ML-DSA-87 produces blocks close to 10 MB for 1000 transactions, while Falcon-512 and Hawk-512 stay around 2.5–2.7 MB—a roughly fourfold difference that bears directly on bandwidth-constrained networks and tight block-size limits. Hawk offers the shortest signatures overall, though the paper notes it remains non-standard and under active cryptanalytic evaluation.

Timing results

Scheme	Keygen (µs)	Sign/tx (µs)	Verify/tx (µs)
ML-DSA-44	78.9	281.3	97.5
ML-DSA-87	200.3	570.9	234.1
Falcon-512	5721.4	206.1	51.6
Falcon-1024	16825.6	401.9	103.5
Hawk-512	1477.8	31.4	47.1
Hawk-1024	9549.2	70.0	98.5

Three contrasts stand out. First, Falcon's key generation is expensive—16.8 ms for Falcon-1024, roughly two orders of magnitude above ML-DSA-44's 79 µs—reflecting its lattice sampling complexity; this matters for systems where users frequently create fresh keys. Second, Hawk dominates signing: Hawk-512 signs in about 31 µs per transaction, an order of magnitude faster than any ML-DSA variant. Third, verification, the operation that dominates full-node cost, favors Falcon-512 (51.6 µs) and Hawk-512 (47.1 µs) over ML-DSA-87 (234.1 µs). At the block level, validating 1000 transactions takes roughly 47 ms with Hawk-512 versus approximately 234 ms with ML-DSA-87, implying materially higher sustainable verification throughput per node for the former two.

Standalone HAETAE microbenchmarks place it between the extremes: sub-millisecond keygen (390–626 µs), slow signing (1.65–2.93 ms, slower than all integrated schemes), and competitive verification (71.5 µs for HAETAE-120). Its sizes are smaller than ML-DSA at comparable security but larger than Falcon/Hawk. Because these figures exclude blockchain overhead, they indicate cryptographic cost only.

Limitations and open questions

The paper is explicit that results are preliminary and platform-specific. All experiments run on a single node without networking or consensus, so block propagation delays, peer-to-peer bandwidth effects, and interactions with block production protocols are unmeasured. Only a fixed transfer template and a single block size of 1000 transactions are tested; smart-contract-style workloads and varying block sizes remain unexplored. Memory usage and energy consumption—relevant for embedded validators—are not reported. The HAETAE integration gap means its apparent advantages cannot yet be confirmed at block level. Finally, Hawk's non-standard status leaves its long-term security assurance weaker than NIST-standardized ML-DSA, a trade-off the paper does not resolve.

Conclusion

This paper provides a system-level comparison of quantum-secure signatures within a working blockchain prototype, showing that no scheme dominates across all metrics. ML-DSA offers standardization and simple design but large keys, signatures, and blocks (up to ~10 MB per 1000-transaction block); Falcon and Hawk deliver substantially smaller footprints and faster verification (tens of milliseconds per block) at the cost of more complex constructions and, for Hawk, absent standardization. The central open question the paper leaves is whether these single-node trade-offs persist under realistic multi-network conditions and whether HAETAE's favorable microbenchmark profile translates into blockchain-level performance once integrated.