Paper 2026/2431 Original: eprint.iacr.org/2026/2431 ↗

Flying, Not Floating: Precise Fixed-Point Falcon on Embedded Processors

Abstract

The Falcon digital signature scheme, under standardization as FN-DSA, requires real-number arithmetic during signing, with its security dependent on numerical precision. Recently, De Almeida Braga et al. (CRYPTO 2026) showed that Falcon-512 can sign in 64.64 fixed-point arithmetic on 64-bit hosts. In this work, we present the first fixed-point FN-DSA signer for microcontrollers, using 32.64 arithmetic in constant-time Cortex-M4 assembly for Falcon-512 and Falcon-1024. Although a straightforward fixed-point implementation is less precise than double precision, our new techniques successfully restore precision. They keep reciprocals, inverse square roots and small constants wide and round once at the consumer. We evaluate them with known techniques on both arithmetics and both degrees. Our signer needs around $45\%$ fewer cycles than double-precision emulation for Falcon-512 Falcon-1024, and its measured precision supports $2^{99.7}$ $2^{96.7}$ queries per key, against $2^{61.5}$ $2^{58.7}$ for double precision and the target of $2^{64}$. Our $12$-byte words raise signing RAM from $59n$ to $83n$ bytes. We also show which implementation choices lift double-precision c-fn-dsa above $2^{64}$ while making it faster. We derive key generation bounds for Falcon-1024, accepting $72.3\%$ of keys where the Falcon-512 values accept $8.5\%$, and provide recommendations for the fixed-point FN-DSA that NIST plans.