NIST locks FN-DSA to fixed-point math for FIPS 206

NIST is rewriting its plan for FN-DSA, the Falcon-based digital signature scheme destined for FIPS 206, to mandate fixed-point arithmetic and a single, precisely specified signing procedure that implementations can validate against Known Answer Tests.

Ray Perlner, speaking for the FIPS 206 team on the NIST PQC forum, said recent Falcon implementation work, including a fixed-point design presented at Crypto and Thomas Pornin’s RAM-optimized variant, made the change advisable. The draft standard will require fixed-point formats for both key generation and signing (initially 32.32 for keygen and 64.64 for signing). Floating-point arithmetic will not be allowed in the FIPS itself, though Perlner noted key generation validation could later be relaxed more easily than signing.

Only one signing procedure will be fully spelled out so that conforming implementations produce identical KAT outputs; other methods are acceptable only if they are guaranteed to match those tests. Key generation need not match KATs exactly. NIST will reserve the right to approve additional signing variants later through Special Publications, provided they remain compatible with the FIPS 206 key generation and verification algorithms, carry their own KATs, and are domain-separated from the base version. More invasive techniques from the recent papers are candidates for those later documents rather than the initial standard, keeping the FIPS timeline shorter.

Community reaction was strongly positive. John Preuß Mattsson of Ericsson welcomed exclusive fixed-point use and the FIPS/SP split, then asked whether one public key could later serve multiple approved signing procedures, a concern for long-lived authentication keys. Perlner replied that NIST intends to allow all approved signing variants with the same keypair if multiple versions ever exist, but expects only a single approved signing procedure when FIPS 206 first ships. Filippo Valsorda said the plan eased concerns about implementing the standard, praising key-generation constraints that simplify signing and verification.