Given the obvious that we have a problem with size on-chain (and I'm aware you've focused here specifically on the most plausible scheme that has the least ridiculously large size, and yet it's still 20x larger), has there been comparison of the possibility of batched signing (not batched *verification*, but signing) in different PQ schemes, with a view to a CISA like approach to transactions in a future with much larger keys and sigs? A nice side effect might be a pure economic motivation for much better fungibility (coinjoin becoming much more desirable for the base layer, albeit I think it's in higher layers where we are/will be get(ting) most privacy).

On Thursday, January 22, 2026 at 4:09:34 AM UTC-3 Giulio Golinelli wrote:

Hi everyone,

I am to share a technical demonstration and benchmarking project that integrates the Falcon post-quantum signature scheme (Falcon-512) into Bitcoin Core, implemented as a soft-fork within the classic P2WPKH mode. This work aims to provide a practical reference for possible future Falcon adoption, especially as it approaches FIPS standardization.
You can find details at this fork.

Why Falcon?
Falcon is a lattice-based, post-quantum digital signature scheme designed to be secure against quantum attacks. Unlike other PQC candidates such as SPHINCS+ and ML-DSA, Falcon offers significantly smaller signature and public key sizes, as well as efficient signing and verification times. It is implemented in pure C and does not require external dependencies.

Benchmarking & Results
Aspect Falcon ECDSA
Public Key Size (B) 897 33
Signature Size (B) 655 71
Verification Time (μs) 57 120

Verification time is more critical than signature creation time in Bitcoin, since signature creation is performed by clients (wallets), while nodes focus on verification.

Integration
Falcon was included into the codebase from the original GitHub repository.
The build system (CMakeLists.txt) was updated to support Falcon.
Falcon verification has been soft-fork enabled via a new script verification flag.
Next Steps & Reference
This project serves as a practical demonstration of Falcon’s promising performance, highlighting its advantages over currently selected post-quantum signature algorithms such as SPHINCS+ and ML-DSA, which face significant time and space limitations. As Falcon approaches FIPS standardization, this work aims to provide a reference for future adoption and integration in Bitcoin.

Let me know what you think and if this could be of interest for which case I can complement the project by integrating Falcon into all the other spending paths. I also look forward to development/integration corrections.

Best regards,
Giulio