--- title: Why we cannot wait for better post-quantum signature... description: RSA and ECC are vulnerable to quantum computers, and the migration to post-quantum cryptography is urgent. While NIST is advancing nine new post-quantum... canonical: https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why we cannot wait for better post-quantum signature algorithms | daily.dev og:description: RSA and ECC are vulnerable to quantum computers, and the migration to post-quantum cryptography is urgent. While NIST is advancing nine new post-quantum... og:url: https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh og:image: https://api.daily.dev/og/posts/3ZaSaxenH.png og:image:alt: Why we cannot wait for better post-quantum signature algorithms og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why we cannot wait for better post-quantum signature algorithms **[Cloudflare](https://daily.dev/sources/cloudflare)** · 34 min read · 1 upvotes · 0 comments ## Summary RSA and ECC are vulnerable to quantum computers, and the migration to post-quantum cryptography is urgent. While NIST is advancing nine new post-quantum signature algorithms (HAWK, MQOM, SDitH, FAEST, SQIsign, MAYO, SNOVA, QR-UOV, UOV) to a third round, none will be ready in time for the first migration wave. ML-DSA, despite its larger sizes and limitations compared to classical elliptic curve schemes, is the best available option today. The post analyzes each candidate in detail — covering size, performance, security track record, and implementation complexity — and explains why timelines for alternatives range from 2030 to 2035+. Cloudflare argues that waiting is not an option given quantum hardware progress, regulatory deadlines, and the need for transition periods. The ongoing NIST competition still matters for enabling advanced primitives like anonymous credentials and for systems where ML-DSA's size is prohibitive. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can't we use FN-DSA (Falcon) instead of ML-DSA for post-quantum signatures right now? FN-DSA signing is difficult to implement securely because it relies on hardware floating-point arithmetic, which is hard to make side-channel safe and varies by processor; safe fixed-point alternatives exist but are new and awareness is low. FN-DSA is expected to become FIPS 206, but given how long its draft took, wide software availability isn't expected before 2033. _Anyone timing a signature migration around FN-DSA can track these standardization delays on daily.dev before committing._ ### How long did it take for ML-DSA to go from NIST selection to actual deployment in TLS certificates? NIST selected Dilithium as ML-DSA in July 2022, published the final standard in August 2024, got a certificate standard (RFC 9881) in October 2025, and expects the first ML-DSA certificates in the WebPKI only in early 2027 - roughly five years from selection to real-world certificate availability. _Teams planning a post-quantum rollout can use this ML-DSA timeline as a benchmark on daily.dev._ ### Is SNOVA or MAYO the better structured multivariate post-quantum signature candidate? MAYO is the more conservative choice: its whipping structure has no known specific attacks and its design has stayed stable, while SNOVA has been repeatedly hit by structural attacks and had to change its core design multiple times to keep improving performance. Any MAYO-specific attack would also apply to SNOVA, but not vice versa. _Developers evaluating next-generation signature schemes can weigh this MAYO versus SNOVA trade-off on daily.dev._ ## Similar posts on daily.dev - [Post‑Quantum Authentication: How Consumer Apps Can Stay Secure in a Quantum‑Ready World?](https://daily.dev/posts/post-quantum-authentication-how-consumer-apps-can-stay-secure-in-a-quantum-ready-world--xvcpygmkq) · Security Boulevard · 0 upvotes · 0 comments - [The State of Post-Quantum Cryptography](https://daily.dev/posts/the-state-of-post-quantum-cryptography-hjfyungt7) · Feisty Duck · 0 upvotes · 0 comments - [Microsoft, Google and Cloudflare just made 2029 the new quantum deadline](https://daily.dev/posts/microsoft-google-and-cloudflare-just-made-2029-the-new-quantum-deadline-r6dmkegc7) · The New Stack · 0 upvotes · 0 comments - [Getting ahead of ‘harvest-now-decrypt-later’: Post-quantum cryptography planning](https://daily.dev/posts/getting-ahead-of-harvest-now-decrypt-later-post-quantum-cryptography-planning-rvmbo59g2) · CSO Online · 0 upvotes · 0 comments - [A Cryptography Engineer’s Perspective on Quantum Computing Timelines](https://daily.dev/posts/a-cryptography-engineer-s-perspective-on-quantum-computing-timelines-cr4dvz28b) · Filippo Valsorda · 1 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why we cannot wait for better post-quantum signature algorithms","url":"https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh"},"datePublished":"2026-07-09T13:05:07.160Z","dateModified":"2026-09-13T19:02:23.084Z","description":"RSA and ECC are vulnerable to quantum computers, and the migration to post-quantum cryptography is urgent. While NIST is advancing nine new post-quantum...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f02868a460cddbd2be2d53e3594efc6c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f02868a460cddbd2be2d53e3594efc6c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,cryptography","timeRequired":"PT34M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"Why we cannot wait for better post-quantum signature algorithms"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh#faq","mainEntity":[{"@type":"Question","name":"Why can't we use FN-DSA (Falcon) instead of ML-DSA for post-quantum signatures right now?","acceptedAnswer":{"@type":"Answer","text":"FN-DSA signing is difficult to implement securely because it relies on hardware floating-point arithmetic, which is hard to make side-channel safe and varies by processor; safe fixed-point alternatives exist but are new and awareness is low. FN-DSA is expected to become FIPS 206, but given how long its draft took, wide software availability isn't expected before 2033. Anyone timing a signature migration around FN-DSA can track these standardization delays on daily.dev before committing."}},{"@type":"Question","name":"How long did it take for ML-DSA to go from NIST selection to actual deployment in TLS certificates?","acceptedAnswer":{"@type":"Answer","text":"NIST selected Dilithium as ML-DSA in July 2022, published the final standard in August 2024, got a certificate standard (RFC 9881) in October 2025, and expects the first ML-DSA certificates in the WebPKI only in early 2027 - roughly five years from selection to real-world certificate availability. Teams planning a post-quantum rollout can use this ML-DSA timeline as a benchmark on daily.dev."}},{"@type":"Question","name":"Is SNOVA or MAYO the better structured multivariate post-quantum signature candidate?","acceptedAnswer":{"@type":"Answer","text":"MAYO is the more conservative choice: its whipping structure has no known specific attacks and its design has stayed stable, while SNOVA has been repeatedly hit by structural attacks and had to change its core design multiple times to keep improving performance. Any MAYO-specific attack would also apply to SNOVA, but not vice versa. Developers evaluating next-generation signature schemes can weigh this MAYO versus SNOVA trade-off on daily.dev."}}]} ```