Post-Quantum Falcon Gets Identity Binding and Traceability in New Signature Framework

Cryptographers have built a new signature framework that grafts identity binding and signer traceability onto Falcon, one of the compact post-quantum signature schemes selected for standardization. The framework, called IBFS, is described in an open-access paper published on 2 November 2026 in the journal Cybersecurity by Zhixiang Chen, Lulu Wang, Haoheng Yuan, and Yingna Li. Rather than replacing public verification keys the way a pure identity-based signature would, IBFS keeps Falcon-compatible keys but has a trusted Private Key Generator, or PKG, derive those keys for registered users and maintain an authenticated binding between each user identity and its public key in a managed repository.

The motivation comes from a structural gap. Falcon, which produces short signatures on the NTRU lattice using Fast Fourier Transform arithmetic, follows the conventional public-key infrastructure model and does not directly support identity-to-key binding or signer traceability. Traditional PKI relies on digital certificates to authenticate the binding between users and their public keys, but in large-scale or resource-constrained deployments, certificate distribution, validation, renewal, and revocation introduce non-negligible communication, storage, and management overhead. Identity-based cryptography, introduced by Shamir in 1985, sidesteps certificates by deriving keys from identities, yet early constructions rested on integer factorization and discrete logarithms, problems that Shor’s 1994 quantum algorithm efficiently solves. That makes those schemes unusable as post-quantum security, and it pushed researchers toward lattice-based designs.

Lattice-based identity-based signatures have evolved through several generations. Gentry and colleagues pioneered general-lattice trapdoors with a Hash-and-Sign paradigm in 2009, and Rückert proposed the first lattice-based identity-based signature in 2010, though with complex computations and large keys and signatures. Later schemes using NTRU and other structured lattices improved efficiency, but the paper’s authors note a common limitation: signatures still comprise multiple lattice vectors, so their size and attendant communication cost remain substantial, and none of them provides identity-to-key binding together with auditable tracing. Existing constructions also do not directly address the specific combination targeted here: compact signatures, PKG-managed identity-to-key binding, and accountable traceability.

IBFS works through five algorithms executed by three types of entities. The trusted PKG runs setup, key generation, and tracing; the signer executes signing; and the verifier checks validity. During key generation, the PKG extracts random entropy from the master secret, combines it with the user identity and fresh registration randomness through a key derivation function, and generates Falcon-compatible NTRU polynomials, repeating until the polynomials meet quality thresholds. It then solves the NTRU equation, constructs the lattice basis, and computes the public key as the quotient of two polynomials modulo the standard Falcon prime q = 12289. Signing maps the message, a 40-byte random salt, and the identity into a ring element through a domain-separated hash, then samples a short vector satisfying the Falcon-style relation s0 + s1h = c mod q.

The compactness trick is where the design departs from earlier identity-based schemes. Instead of transmitting multiple lattice vectors, the signature carries a single compressed short polynomial s1, while the verifier reconstructs the other component s0 by computing c minus s1 times the public key. The serialized signature also embeds a hash of the signer’s identity, and verification checks that embedded tag against the claimed identity before checking the norm bound. Because the identity is folded into the challenge computation, changing either the signed message or the claimed identity changes the verification challenge, and replacing the embedded identity hash causes the identity-consistency check to fail. The authors describe this as a unified workflow in which identity-conditioned key generation, signing, verification, and trace resolution form connected stages of a single security process rather than independent post-processing modules.

Traceability in IBFS means resolving a verified message-signature pair to a registered identity, not identifying who physically executed the signing algorithm. A deterministic identity tag embedded in each signature is looked up in the PKG-managed repository, the candidate binding is authenticated against a trusted configuration, and the signature is verified under the authenticated public key before the identity is returned. The paper proves identity-resolution correctness and consistency under authentic repository bindings, relying on collision resistance of the identity hash. The authors are explicit that this does not establish that the corresponding user personally generated or authorized the signature, and that non-frameability against a malicious PKG is not provided.

The security analysis is deliberately scoped. The authors formalize an EU-CMA unforgeability notion for the managed identity-bound setting and give a security argument in the classical Random Oracle Model that reduces unforgeability of an idealized signing layer, with a concrete advantage bound, to the decisional NTRU assumption, the inhomogeneous NTRU short-preimage assumption known as NTRU-ISIS, and the pseudorandomness of the key-derivation function. The trust boundaries are stated plainly: key escrow is inherent because the PKG possesses or can reconstruct every user’s complete signing key; a full PKG compromise lets an adversary sign without the user’s participation; a malicious PKG can generate signatures resolved to a user; and repository manipulation is addressed through individually authenticated registration records signed with a dedicated Falcon key generated independently of all user keys. The analysis covers classical adversaries only and is not a Quantum Random Oracle Model proof.

Performance results show the framework stays close to its Falcon baseline. In a Python prototype on an AMD EPYC 9554 server, signing rose from 19.18 to 26.29 milliseconds at security level I and from 39.43 to 42.72 milliseconds at level V, while verification was essentially unchanged. Key generation grew more noticeably, from 3.14 to 6.01 seconds and from 13.94 to 19.42 seconds, a one-time per-identity cost incurred by the PKG. Signature sizes are 672 bytes at level I and 1290 bytes at level V, only 6 and 10 bytes larger than Falcon’s, because the identity tag is the sole addition, and both remain far smaller than Dilithium’s 2420 and 4595 bytes. Public keys match Falcon’s at 897 and 1793 bytes, while secret keys are larger at 1792 and 3584 bytes because the FFT-domain basis is stored alongside the sampling tree.

On the device side, the team evaluated verification on an HONOR X30 smartphone with a Snapdragon 695 processor, 8 GB of RAM, and Android 13, communicating with the backend over an SSH-tunneled HTTP interface. The phone performed only core signature verification; key generation, signing, and repository management stayed on the server, and no master secret or private signing material reached the device. In functional testing with 100 honestly generated signatures and 400 modified test vectors, all valid signatures were accepted and all modified vectors were rejected, a 100 percent correct-decision rate over the evaluated set. Repeated verification averaged 7.86 milliseconds for IBFS-512 and 17.62 milliseconds for IBFS-1024, with throughputs of 127.1 and 56.74 verifications per second and process memory around 19.3 MB. Request-response latencies averaged 118.23 and 137.89 milliseconds respectively.

The authors are careful about what these numbers do and do not show. The device evaluation covers one Android smartphone in the verifier role within a server-assisted setting and does not establish operation of the complete framework on tightly constrained IoT devices; no microcontroller endpoints were tested, and local signing, private-key storage, and repository operation on such devices were not measured. A separate server-side study of the trace index using SQLite extended the evaluated scale to 100,000 entries with file-backed storage, concurrent access, and controlled writer-process termination, but it excludes complete authenticated records and does not establish a production-scale distributed repository. The security argument concerns an idealized signing layer rather than the encoded retrying implementation, and future work includes a Quantum Random Oracle Model analysis, a closer implementation correspondence, broader side-channel evaluation, and controlled comparisons with representative identity-oriented lattice schemes.

Subject of Research: A PKG-managed identity-binding signature framework over the post-quantum Falcon scheme with traceability

Article Title: A PKG-managed authenticated identity-binding signature framework over Falcon with traceability

Article References: Chen, Z., Wang, L., Yuan, H., & Li, Y. (2026). A PKG-managed authenticated identity-binding signature framework over Falcon with traceability. Cybersecurity, 9(1), Article 249. https://doi.org/10.1186/s42400-026-00680-6

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00680-6

Keywords: post-quantum cryptography, Falcon, digital signatures, identity-based cryptography, NTRU lattice, traceability, key escrow, lattice-based cryptography, IoT security, random oracle model, PKG-managed, authenticated