Blockstream researchers have identified Falcon-1024 as the most promising lattice-based signature scheme for protecting Bitcoin against future quantum computers.

The conclusion comes from a new research report comparing Falcon, Dilithium, and Hawk. The study assessed how each option would affect transaction size, network verification, hardware wallets, and key management.

Bitcoin currently uses Schnorr and ECDSA signatures to authorize transactions. A sufficiently powerful quantum computer could theoretically break both systems, although no machine capable of doing so is known to exist. 

Developing an alternative would also require extensive testing and agreement among Bitcoin participants.

Falcon-1024 emerged as the researchers’ preferred lattice-based option because it combines relatively compact signatures with fast verification. 

Its public key and signature occupy 3,073 bytes combined, far larger than Bitcoin’s existing 96-byte Schnorr combination but smaller than the 5,261 bytes required by the comparable Category 3 version of Dilithium.

“If we had to select a lattice-based signature scheme for Bitcoin today, we would choose Falcon-1024,” the researchers wrote. 

However, the scheme still presents practical challenges. Falcon-1024 requires about 90 kilobytes of memory during signing, although hardware wallets could lower that requirement to approximately 16 kilobytes by rebuilding data in stages, at the cost of slower signing. 

Wallet key derivation also remains unresolved, as Falcon cannot yet efficiently replicate the process Bitcoin wallets use to generate multiple addresses from a single master key.

Dilithium is easier to implement and has a potential path toward Bitcoin-style key derivation. However, its larger keys and signatures would place a greater storage and bandwidth burden on the network.

The third candidate, Hawk, has been removed from consideration after researchers discovered a structural weakness that reduced its estimated security. 

Hawk’s designers subsequently withdrew it from a NIST standardization process. 

The larger Hawk configurations were not shown to be practically breakable, but increasing their parameters to restore the intended security would eliminate much of the scheme’s size advantage.

For now, Blockstream’s researchers continue to view hash-based signatures as a more conservative near-term option. 

Falcon could become more practical after its NIST standard is finalized and audited implementations, test vectors, and hardware support become available.

The findings leave Falcon-1024 as a leading lattice-based candidate, rather than a settled choice for Bitcoin. 

Any transition would require further research, engineering work, and broad consensus across the network.