Choosing a Signature: A Decision Framework over Assumptions, Size, and Operational Risk

The existence of several standardized post-quantum signatures is not indecision; it reflects that no single scheme wins on every axis. The efficient lattice signature is small and fast but rests on a structured assumption; the stateless hash-based signature is maximally conservative but large; the stateful hash-based schemes are compact but operationally hazardous. Choosing well means starting from the deployment context — how long the key must live, how many signatures it will produce, what the environment can guarantee, how much assumption diversity is wanted — and letting those constraints select the scheme, rather than starting from a favorite algorithm. This article assembles that reasoning into a usable framework.

The four axes of the decision

Four axes capture nearly all of what separates the options. The first is assumption conservatism: hash-only schemes rest on the best-studied primitives and the weakest assumption, while lattice schemes rest on a structured, younger, but well-analyzed assumption. The second is size and speed together: signature and public-key bytes on the wire and in storage, and the cost of signing and verifying. The third is operational statefulness: whether the signer must maintain and protect monotonic state, which the stateful hash-based schemes require and the others do not. The fourth is key lifetime: how many years the key and its signatures must remain trustworthy, which weights conservatism more heavily the longer it runs.

These axes trade against one another rather than aligning. The most conservative option is the largest and among the slowest; the most compact hash-based option is the most operationally dangerous; the most efficient overall carries the structured assumption. There is no corner of the space that is simultaneously most conservative, smallest, fastest, and stateless — which is exactly why the standards keep several schemes and why a context-driven choice is necessary.

The framework, then, is to locate a deployment on these four axes and read off which scheme's corner it matches. A high-volume, short-to-medium-lifetime, stateless-required context points one way; a low-volume, decades-long, maximum-conservatism context points another; a constrained device with hardware-guaranteed state and a tight byte budget points to a third. The following sections turn this into concrete comparisons and a decision flow.

Size, speed, and role at a glance

The concrete numbers make the trade tangible. The module-lattice signature produces signatures of a few kilobytes with public keys of similar order, and both signing and verification are fast — the balanced, general-purpose profile. The stateless hash-based signature has tiny public keys but signatures from roughly eight to seventeen kilobytes depending on the small-signature or fast-signing variant, with slower signing. The stateful hash-based schemes achieve compact signatures and tiny public keys, comparable to or better than the lattice option on size, but only by carrying state.

The table gathers approximate figures and the role each scheme naturally fills. The point is not the exact byte counts, which vary by parameter set, but the pattern: the lattice scheme is the balanced default, the stateless hash scheme trades size for conservatism, and the stateful schemes trade operational risk for compactness. Reading down the state column is the fastest way to screen out the stateful options for any environment that cannot guarantee monotonic state.

These profiles also explain why the schemes are complementary rather than competing. A system can reasonably use the lattice signature for the bulk of its signing and reserve the hash-only scheme for a handful of durable keys, gaining assumption diversity without paying the size cost everywhere. The comparison is an input to a role assignment, not a contest with a single winner.

A decision flow from context inward

The decision starts with a single screening question and narrows from there. First, does the deployment demand maximum conservatism or a decades-long lifetime, such that resting on a hash-only assumption is worth a size penalty? If yes, the stateless hash-based signature is the anchor of choice, used sparingly for the durable keys that justify it. If no, the default is the module-lattice signature, whose balanced profile suits the overwhelming majority of general signing.

Two side conditions refine the result. If the environment can hardware-guarantee monotonic state and byte size is at a genuine premium — a constrained device signing firmware from a hardware module — a stateful hash-based scheme becomes viable and attractive for that narrow role, but only there. And if the key must remain verifiable for a very long time while still signing at volume, the answer may be to split roles: a lattice key for volume and a hash-only key for the durable anchor, rather than forcing one scheme to do both.

Framing the choice this way keeps the algorithm subordinate to the requirements. The most common outcome is the lattice signature, because most signing is medium-lifetime, high-volume, and stateless-required; the conservative and stateful options are deliberate exceptions selected when a specific axis — durability, or a hardware-guaranteed constrained environment — dominates. The flow is designed so the default is reached quickly and the exceptions are chosen consciously.

Hybrid signing during the transition

During the migration years a further option is to sign with two schemes at once — a composite or hybrid signature that combines a classical signature with a post-quantum one, or pairs two post-quantum schemes from different assumption families. A verifier accepts only if both component signatures verify, so the composite is secure as long as at least one component holds. This is defense in depth against two distinct risks: that the post-quantum scheme has an undiscovered flaw, and that the classical scheme falls to a quantum computer.

The cost is additive size and verification work, and added protocol complexity in encoding and parsing two signatures, so hybrids are a transition measure rather than a permanent end state. They are most justified where a wrong bet would be catastrophic and irreversible — long-lived certificates, roots of trust, or artifacts that must remain verifiable across the exact period when confidence in any single new scheme is still maturing. Pairing a lattice signature with a hash-only one is a particularly strong hedge, since the two rest on entirely different mathematics.

The judgment is proportionality. For everyday, short-lived signing the added weight of a hybrid rarely pays; for a small number of high-stakes, long-lived keys it can be exactly the right insurance during the years when the post-quantum schemes are new. As confidence accumulates, the classical component can be retired, leaving the post-quantum scheme standing alone.

Recommendations by role

The framework resolves into a few clear defaults. For general-purpose, high-volume signing — protocol messages, certificates, routine authentication — use the module-lattice signature; it is the balanced, standardized default and the right answer unless a specific axis pushes elsewhere. For a small number of durable, high-assurance keys — roots of trust, keys signing artifacts meant to remain verifiable for decades — use the stateless hash-based signature, accepting its size for its conservatism and assumption diversity. For constrained devices that can hardware-guarantee monotonic state and need minimal bytes, use a stateful hash-based scheme, confined strictly to that environment.

The pairing of a lattice default with a hash-only anchor is the recommended posture for most organizations, because it captures efficiency where volume lives and conservatism where durability lives, at modest overall cost. Reserve hybrids for the highest-stakes long-lived keys during the transition. And in every case, use conformant validated implementations and inherit standardized parameters rather than hand-tuning, following the discipline the earlier articles established.

For autonomous AI systems these roles map directly onto the workload. Sign the high-volume, short-lived material — agent-to-agent messages, capability tokens, session artifacts — with the fast lattice signature. Sign the durable evidence — released model artifacts, provenance records, audit anchors meant to be verifiable for years — with the conservative hash-only scheme, and consider a hybrid for the most consequential of these during the transition. Confine any stateful signing to a dedicated hardware-backed service that the agent fleet cannot clone or roll back. The single organizing principle is to match the scheme to the key's lifetime and volume, defaulting to the efficient lattice signature and spending conservatism only where the stakes and the years justify it.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

signature_selection:
  default: ML-DSA                 # high volume, medium lifetime
  durable_anchor: SLH-DSA        # decades, high assurance
  constrained_stateful: LMS_or_XMSS  # only with hardware state
  highest_stakes_transition: hybrid_lattice_plus_hash
axes_considered: [conservatism, size_speed, statefulness, lifetime]
implementation:
  conformant_validated: true
  parameters: standardized

Glossary

Assumption conservatism

How weak and well-studied a scheme's underlying assumption is; hash-only is the most conservative, lattice a structured but analyzed assumption.

Statefulness (as a decision axis)

Whether a scheme requires the signer to maintain protected monotonic state; only the stateful hash-based schemes do.

Key lifetime

How long a key and its signatures must remain trustworthy; longer lifetimes weight conservatism more heavily.

Composite / hybrid signature

A signature combining two schemes (classical-plus-PQ or two PQ families) that verifies only if both components do, secure if either holds.

Role split

Assigning different schemes to different key roles — a lattice key for volume, a hash-only key for durable anchors — rather than forcing one scheme everywhere.

Standardized parameters

The parameter sets fixed by the standards, inherited rather than hand-tuned, per the discipline established for lattice and hash schemes.

References

1. NIST FIPS 204, Module-Lattice-Based Digital Signature Standard (2024)
2. NIST FIPS 205, Stateless Hash-Based Digital Signature Standard (2024)
3. NIST SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes (2020)
4. Ducas et al., CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme (IACR TCHES, 2018)
5. Bernstein et al., The SPHINCS+ Signature Framework (ACM CCS, 2019)