Parameter sets
We retain the main parameter sets with (q,ℓ) = (127,3) from the Round 2 specification and newly add those with (q,ℓ) = (127,10). The parameter sets with ℓ = 3 are intended to provide balanced performance, whereas those with ℓ = 10 offer relatively small public keys. The Round 3 parameter sets and corresponding key and signature sizes are shown below.
| Security Level | (q,v,m,ℓ) | Public Key (bytes) | Private Key (bytes) | Signature (bytes) |
|---|---|---|---|---|
| I | (127,156,54,3) | 24,256 | 32 | 200 |
| (127,540,60,10) | 11,041 | 32 | 541 | |
| III | (127,228,78,3) | 71,884 | 32 | 292 |
| (127,820,90,10) | 35,454 | 32 | 821 | |
| V | (127,306,105,3) | 173,660 | 32 | 392 |
| (127,1040,110,10) | 63,541 | 32 | 1,039 |
Software performance
- Experimental environment
- Processor: AMD Ryzen Threadripper PRO 9995WX
- Base Clock: 2.5 GHz, Boost Clock: up to 5.4 GHz
- Memory: 64 GB (DDR5-5600 16 GB×4)
- Operating System:Linux 6.6.87.2-microsoft-standard-WSL2 (Windows 11)
- Linux Distribution:Ubuntu 26.04 LTS
- Compiler:GCC 15.2.0
- Library:OpenSSL 3.5.5 (27 January 2026)
- Benchmark framework: supercop-20260627
| Security Level | (q,v,m,ℓ) | KeyGen (Mcycles) | Sign (Mcycles) | Verify (Mcycles) |
|---|---|---|---|---|
| I | (127,156,54,3) | 1.767 | 0.520 | 0.353 |
| (127,540,60,10) | 5.036 | 2.524 | 1.016 | |
| III | (127,228,78,3) | 6.045 | 1.342 | 1.014 |
| (127,820,90,10) | 17.920 | 7.860 | 3.099 | |
| V | (127,306,105,3) | 16.695 | 3.120 | 2.374 |
| (127,1040,110,10) | 32.067 | 13.351 | 5.929 |
| Security Level | (q,v,m,ℓ) | KeyGen (Mcycles) | Sign (Mcycles) | Verify (Mcycles) |
|---|---|---|---|---|
| I | (127,156,54,3) | 3.968 | 2.718 | 2.538 |
| (127,540,60,10) | 10.802 | 8.356 | 6.918 | |
| III | (127,228,78,3) | 12.639 | 7.780 | 7.322 |
| (127,820,90,10) | 37.936 | 27.755 | 23.215 | |
| V | (127,306,105,3) | 32.399 | 18.371 | 17.476 |
| (127,1040,110,10) | 70.550 | 51.870 | 44.487 |
Hardware performance
- Under construction.