# Post-Quantum Signatures: Cloudflare's Verdict Is 'Just Use ML-DSA'!

Hello, it's Shii-chan! Today's story is a deep, technical one from the Cloudflare Blog, so let's get into it.

## What was announced?

NIST is advancing nine new post-quantum signature algorithm candidates toward standardization. Cloudflare argues that rather than waiting for these to become practical, we should use ML-DSA — the best all-around option available today.

## Why it matters

Once quantum computers become practical, many of today's signature algorithms are expected to become unsafe, so the industry is racing to migrate to post-quantum cryptography. The new candidates are tempting — some have smaller signatures, some are faster — but many haven't caught up yet on implementation maturity or security review. That tension between waiting and acting now is exactly the dilemma.

## What changes

Cloudflare is targeting 2029 to finish its post-quantum migration, and on that timeline, there's no room to wait for newer candidates to mature. ML-DSA itself took from 2017 (initial submission) to 2024 (final standard) to reach this point, and at a similar pace, Cloudflare doesn't expect FN-DSA (Falcon) to be widely available before 2033. The multivariate candidates aren't even expected to be standardized until 2031 or later, pushing real-world deployment even further out.

## Dive Deep

The nine candidates fall into a few mathematical families:

- Lattice-based: HAWK, FN-DSA (Falcon)
- Multivariate polynomial: MAYO, SNOVA, QR-UOV, UOV, MQOM
- Isogeny-based: SQIsign
- Zero-knowledge proof-based: FAEST, SDitH
- Hash-based: SLH-DSA variants

Each has tradeoffs. FN-DSA-512 produces tiny 666-byte signatures, but it needs floating-point arithmetic that's hard to implement consistently — results can differ slightly across processors. SQIsign gets signatures down to just 148 bytes, but signing takes three times longer than ML-DSA and secure, side-channel-resistant implementations are still difficult. MAYO and SNOVA shrink public keys, but they're built on newer mathematical structures still under active cryptanalytic scrutiny.

ML-DSA, by comparison, has a 2,420-byte signature and a 1,312-byte public key — much bigger than Ed25519's 64-byte signature — but Cloudflare rates it as the best current balance of speed, vetted security, and ease of implementation. One line from the post stuck with me:

> You go to war with the algorithms you have, not the ones you wish you had.

## Wrap-up

- NIST is advancing nine post-quantum signature candidates toward standardization
- Cloudflare argues we should use ML-DSA now rather than wait for newer candidates to mature
- ML-DSA's signature (2,420 bytes) and public key (1,312 bytes) are bigger than Ed25519's, but it has the best overall balance of speed, security review, and implementation ease
- Candidates like FN-DSA (Falcon) and SQIsign offer appealing performance but still face implementation or maturity challenges
- Cloudflare is targeting full post-quantum migration by 2029, leaving no time to wait for newer algorithms

Worth a read if you're planning a post-quantum migration, or just curious about the reasoning behind it.