Post-Quantum Signatures: Cloudflare's Verdict Is 'Just Use ML-DSA'!

Hello, it's Shii-chan! Today's story is a deep, technical one from the Cloudflare Blog, so let's get into it.

Cloudflare Blog blog.cloudflare.com

What was announced?

NIST is advancing nine new post-quantum signature algorithm candidates toward standardization. Cloudflare argues that rather than waiting for these to become practical, we should use ML-DSA — the best all-around option available today.

Why it matters

Once quantum computers become practical, many of today's signature algorithms are expected to become unsafe, so the industry is racing to migrate to post-quantum cryptography. The new candidates are tempting — some have smaller signatures, some are faster — but many haven't caught up yet on implementation maturity or security review. That tension between waiting and acting now is exactly the dilemma.

What changes

Cloudflare is targeting 2029 to finish its post-quantum migration, and on that timeline, there's no room to wait for newer candidates to mature. ML-DSA itself took from 2017 (initial submission) to 2024 (final standard) to reach this point, and at a similar pace, Cloudflare doesn't expect FN-DSA (Falcon) to be widely available before 2033. The multivariate candidates aren't even expected to be standardized until 2031 or later, pushing real-world deployment even further out.

Dive Deep

The nine candidates fall into a few mathematical families:

• Lattice-based: HAWK, FN-DSA (Falcon)
• Multivariate polynomial: MAYO, SNOVA, QR-UOV, UOV, MQOM
• Isogeny-based: SQIsign
• Zero-knowledge proof-based: FAEST, SDitH
• Hash-based: SLH-DSA variants

Each has tradeoffs. FN-DSA-512 produces tiny 666-byte signatures, but it needs floating-point arithmetic that's hard to implement consistently — results can differ slightly across processors. SQIsign gets signatures down to just 148 bytes, but signing takes three times longer than ML-DSA and secure, side-channel-resistant implementations are still difficult. MAYO and SNOVA shrink public keys, but they're built on newer mathematical structures still under active cryptanalytic scrutiny.

ML-DSA, by comparison, has a 2,420-byte signature and a 1,312-byte public key — much bigger than Ed25519's 64-byte signature — but Cloudflare rates it as the best current balance of speed, vetted security, and ease of implementation. One line from the post stuck with me:

You go to war with the algorithms you have, not the ones you wish you had.

Wrap-up

• NIST is advancing nine post-quantum signature candidates toward standardization
• Cloudflare argues we should use ML-DSA now rather than wait for newer candidates to mature
• ML-DSA's signature (2,420 bytes) and public key (1,312 bytes) are bigger than Ed25519's, but it has the best overall balance of speed, security review, and implementation ease
• Candidates like FN-DSA (Falcon) and SQIsign offer appealing performance but still face implementation or maturity challenges
• Cloudflare is targeting full post-quantum migration by 2029, leaving no time to wait for newer algorithms

Worth a read if you're planning a post-quantum migration, or just curious about the reasoning behind it.