后量子算法图鉴：100 多种算法的大小与速度
liboqs 提供的全部 103 种算法，从 NIST 标准到附加签名征集中的候选算法：可以筛选、按大小排序，并选择一种进行测量。基准测试把 liboqs 编译为 WebAssembly，在你自己设备上的后台线程中运行，并将结果与用同样方式测得的 ECDSA P-256、Ed25519 或 X25519 进行比较。
100% 本地处理——只有在你开始测量时，才会从本站下载算法代码，并在你的浏览器中运行；关于你的设备或测量结果的任何信息都不会被发送到任何地方
liboqs 0.15.1 中的 103 种算法：38 种密钥封装机制和 65 种签名方案，分属 15 个家族。
ML-KEM-768
与经典算法的大小对比
| 算法 | 公钥 |
|---|---|
| ML-KEM-768 | 1,184 B |
| X25519 | 32 B |
| 算法 | 签名 / 密文 |
|---|---|
| ML-KEM-768 | 1,088 B |
| X25519 | 32 B |
公钥加密文：合计为 X25519 的 35.5 倍。 经典算法的大小按原始编码计算：未压缩的 EC 点、ECDSA 的 r‖s、RSA-2048 的 PKCS #1 密钥。
- 已在 FIPS 203（2024年8月）中标准化。部署时应选用的 KEM：TLS、SSH 和 HPKE 都已定义了它的使用方式。
在此设备上测量
在后台线程中运行密钥生成以及封装和解封装，每项操作最多约 3 秒，并运行 X25519 的相同操作作为对比。每个结果都会经过检查，因此有问题的构建无法给出很快却错误的数字。
显示 103 种算法（共 103 种）
| 算法 | 家族 | 状态 | 级别 | 公钥 | 私钥 | 签名 / 密文 | 密钥 + 输出（对数刻度） |
|---|---|---|---|---|---|---|---|
| SLH-DSA | NIST 标准 | 1 | 32 B | 64 B | 17,088 B | ||
| SLH-DSA | NIST 标准 | 1 | 32 B | 64 B | 7,856 B | ||
| SLH-DSA | NIST 标准 | 1 | 32 B | 64 B | 17,088 B | ||
| SLH-DSA | NIST 标准 | 1 | 32 B | 64 B | 7,856 B | ||
| SLH-DSA | NIST 标准 | 3 | 48 B | 96 B | 35,664 B | ||
| SLH-DSA | NIST 标准 | 3 | 48 B | 96 B | 16,224 B | ||
| SLH-DSA | NIST 标准 | 3 | 48 B | 96 B | 35,664 B | ||
| SLH-DSA | NIST 标准 | 3 | 48 B | 96 B | 16,224 B | ||
| CROSS | NIST 候选算法 | 1 | 54 B | 32 B | 9,120 B | ||
| CROSS | NIST 候选算法 | 1 | 54 B | 32 B | 11,980 B | ||
| CROSS | NIST 候选算法 | 1 | 54 B | 32 B | 8,960 B | ||
| SLH-DSA | NIST 标准 | 5 | 64 B | 128 B | 49,856 B | ||
| SLH-DSA | NIST 标准 | 5 | 64 B | 128 B | 29,792 B | ||
| SLH-DSA | NIST 标准 | 5 | 64 B | 128 B | 49,856 B | ||
| SLH-DSA | NIST 标准 | 5 | 64 B | 128 B | 29,792 B | ||
| CROSS | NIST 候选算法 | 1 | 77 B | 32 B | 13,152 B | ||
| CROSS | NIST 候选算法 | 1 | 77 B | 32 B | 18,432 B | ||
| CROSS | NIST 候选算法 | 1 | 77 B | 32 B | 12,432 B | ||
| CROSS | NIST 候选算法 | 3 | 83 B | 48 B | 22,464 B | ||
| CROSS | NIST 候选算法 | 3 | 83 B | 48 B | 26,772 B | ||
| CROSS | NIST 候选算法 | 3 | 83 B | 48 B | 20,452 B | ||
| CROSS | NIST 候选算法 | 5 | 106 B | 64 B | 40,100 B | ||
| CROSS | NIST 候选算法 | 5 | 106 B | 64 B | 48,102 B | ||
| CROSS | NIST 候选算法 | 5 | 106 B | 64 B | 36,454 B | ||
| CROSS | NIST 候选算法 | 3 | 115 B | 48 B | 29,853 B | ||
| CROSS | NIST 候选算法 | 3 | 115 B | 48 B | 41,406 B | ||
| CROSS | NIST 候选算法 | 3 | 115 B | 48 B | 28,391 B | ||
| CROSS | NIST 候选算法 | 5 | 153 B | 64 B | 53,527 B | ||
| CROSS | NIST 候选算法 | 5 | 153 B | 64 B | 74,590 B | ||
| CROSS | NIST 候选算法 | 5 | 153 B | 64 B | 50,818 B | ||
| NTRU | 未被 NIST 选中 | 1 | 699 B | 935 B | 699 B | ||
| CRYSTALS-Kyber | 已被取代 | 1 | 800 B | 1,632 B | 768 B | ||
| ML-KEM | NIST 标准 | 1 | 800 B | 1,632 B | 768 B | ||
| Falcon | 已被 NIST 选中，标准制定中 | 1 | 897 B | 1,281 B | ≤ 752 B | ||
| Falcon | 已被 NIST 选中，标准制定中 | 1 | 897 B | 1,281 B | 666 B | ||
| NTRU | 未被 NIST 选中 | 3 | 930 B | 1,234 B | 930 B | ||
| SNOVA | NIST 候选算法 | 1 | 1,016 B | 48 B | 248 B | ||
| SNOVA | NIST 候选算法 | 1 | 1,016 B | 48 B | 248 B | ||
| SNOVA | NIST 候选算法 | 1 | 1,016 B | 36,848 B | 248 B | ||
| SNOVA | NIST 候选算法 | 1 | 1,016 B | 36,848 B | 248 B | ||
| NTRU | 未被 NIST 选中 | 3 | 1,138 B | 1,450 B | 1,138 B | ||
| Streamlined NTRU Prime | 未被 NIST 选中 | 3 | 1,158 B | 1,763 B | 1,039 B | ||
| CRYSTALS-Kyber | 已被取代 | 3 | 1,184 B | 2,400 B | 1,088 B | ||
| ML-KEM | NIST 标准 | 3 | 1,184 B | 2,400 B | 1,088 B | ||
| NTRU | 未被 NIST 选中 | 5 | 1,230 B | 1,590 B | 1,230 B | ||
| ML-DSA | NIST 标准 | 2 | 1,312 B | 2,560 B | 2,420 B | ||
| MAYO | NIST 候选算法 | 1 | 1,420 B | 24 B | 454 B | ||
| CRYSTALS-Kyber | 已被取代 | 5 | 1,568 B | 3,168 B | 1,568 B | ||
| ML-KEM | NIST 标准 | 5 | 1,568 B | 3,168 B | 1,568 B | ||
| SNOVA | NIST 候选算法 | 1 | 1,579 B | 48 B | 379 B | ||
| Falcon | 已被 NIST 选中，标准制定中 | 5 | 1,793 B | 2,305 B | ≤ 1,462 B | ||
| Falcon | 已被 NIST 选中，标准制定中 | 5 | 1,793 B | 2,305 B | 1,280 B | ||
| NTRU | 未被 NIST 选中 | 5 | 1,842 B | 2,366 B | 1,842 B | ||
| ML-DSA | NIST 标准 | 3 | 1,952 B | 4,032 B | 3,309 B | ||
| HQC | 已被 NIST 选中，标准制定中 | 1 | 2,249 B | 2,305 B | 4,433 B | ||
| SNOVA | NIST 候选算法 | 1 | 2,320 B | 48 B | 165 B | ||
| NTRU | 未被 NIST 选中 | 5 | 2,401 B | 2,983 B | 2,401 B | ||
| ML-DSA | NIST 标准 | 5 | 2,592 B | 4,896 B | 4,627 B | ||
| SNOVA | NIST 候选算法 | 3 | 2,716 B | 48 B | 454 B | ||
| MAYO | NIST 候选算法 | 3 | 2,986 B | 32 B | 681 B | ||
| SNOVA | NIST 候选算法 | 3 | 4,112 B | 48 B | 376 B | ||
| HQC | 已被 NIST 选中，标准制定中 | 3 | 4,522 B | 4,586 B | 8,978 B | ||
| MAYO | NIST 候选算法 | 1 | 4,912 B | 24 B | 186 B | ||
| MAYO | NIST 候选算法 | 5 | 5,554 B | 40 B | 964 B | ||
| SNOVA | NIST 候选算法 | 5 | 6,006 B | 48 B | 286 B | ||
| HQC | 已被 NIST 选中，标准制定中 | 5 | 7,245 B | 7,317 B | 14,421 B | ||
| SNOVA | NIST 候选算法 | 5 | 8,016 B | 48 B | 576 B | ||
| FrodoKEM | 未被 NIST 选中 | 1 | 9,616 B | 19,888 B | 9,752 B | ||
| FrodoKEM | 未被 NIST 选中 | 1 | 9,616 B | 19,888 B | 9,752 B | ||
| eFrodoKEM | 未被 NIST 选中 | 1 | 9,616 B | 19,888 B | 9,720 B | ||
| eFrodoKEM | 未被 NIST 选中 | 1 | 9,616 B | 19,888 B | 9,720 B | ||
| SNOVA | NIST 候选算法 | 3 | 9,842 B | 48 B | 124 B | ||
| FrodoKEM | 未被 NIST 选中 | 3 | 15,632 B | 31,296 B | 15,792 B | ||
| FrodoKEM | 未被 NIST 选中 | 3 | 15,632 B | 31,296 B | 15,792 B | ||
| eFrodoKEM | 未被 NIST 选中 | 3 | 15,632 B | 31,296 B | 15,744 B | ||
| eFrodoKEM | 未被 NIST 选中 | 3 | 15,632 B | 31,296 B | 15,744 B | ||
| FrodoKEM | 未被 NIST 选中 | 5 | 21,520 B | 43,088 B | 21,696 B | ||
| FrodoKEM | 未被 NIST 选中 | 5 | 21,520 B | 43,088 B | 21,696 B | ||
| eFrodoKEM | 未被 NIST 选中 | 5 | 21,520 B | 43,088 B | 21,632 B | ||
| eFrodoKEM | 未被 NIST 选中 | 5 | 21,520 B | 43,088 B | 21,632 B | ||
| SNOVA | NIST 候选算法 | 5 | 31,266 B | 48 B | 178 B | ||
| UOV | NIST 候选算法 | 1 | 43,576 B | 237,896 B | 128 B | ||
| UOV | NIST 候选算法 | 1 | 43,576 B | 32 B | 128 B | ||
| UOV | NIST 候选算法 | 1 | 66,576 B | 348,704 B | 96 B | ||
| UOV | NIST 候选算法 | 1 | 66,576 B | 32 B | 96 B | ||
| UOV | NIST 候选算法 | 3 | 189,232 B | 1,044,320 B | 200 B | ||
| UOV | NIST 候选算法 | 3 | 189,232 B | 32 B | 200 B | ||
| Classic McEliece | 未被 NIST 选中 | 1 | 261,120 B | 6,492 B | 96 B | ||
| Classic McEliece | 未被 NIST 选中 | 1 | 261,120 B | 6,492 B | 96 B | ||
| UOV | NIST 候选算法 | 1 | 278,432 B | 237,896 B | 128 B | ||
| UOV | NIST 候选算法 | 1 | 412,160 B | 348,704 B | 96 B | ||
| UOV | NIST 候选算法 | 5 | 446,992 B | 2,436,704 B | 260 B | ||
| UOV | NIST 候选算法 | 5 | 446,992 B | 32 B | 260 B | ||
| Classic McEliece | 未被 NIST 选中 | 3 | 524,160 B | 13,608 B | 156 B | ||
| Classic McEliece | 未被 NIST 选中 | 3 | 524,160 B | 13,608 B | 156 B | ||
| Classic McEliece | 未被 NIST 选中 | 5 | 1,044,992 B | 13,932 B | 208 B | ||
| Classic McEliece | 未被 NIST 选中 | 5 | 1,044,992 B | 13,932 B | 208 B | ||
| Classic McEliece | 未被 NIST 选中 | 5 | 1,047,319 B | 13,948 B | 194 B | ||
| Classic McEliece | 未被 NIST 选中 | 5 | 1,047,319 B | 13,948 B | 194 B | ||
| UOV | NIST 候选算法 | 3 | 1,225,440 B | 1,044,320 B | 200 B | ||
| Classic McEliece | 未被 NIST 选中 | 5 | 1,357,824 B | 14,120 B | 208 B | ||
| Classic McEliece | 未被 NIST 选中 | 5 | 1,357,824 B | 14,120 B | 208 B | ||
| UOV | NIST 候选算法 | 5 | 2,869,440 B | 2,436,704 B | 260 B |
What is in the zoo
The zoo lists every key encapsulation mechanism and signature scheme of
liboqs 0.15.1, the C library of the Open Quantum Safe project, as packaged for the web by
@oqs/liboqs-js: 103 parameter sets in 15 families. For each one you see the sizes that decide whether it fits
a protocol — public key, private key, signature or ciphertext — its NIST security level, the hard problem it
rests on, and how far it has come in standardization. Pick any of them and the lab measures it on your own device
against the classical algorithm it would replace.
Where each family stands
The status column follows NIST's post-quantum project as of 20 October 2026:
- Standards. ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), final since August 2024. These are the algorithms to deploy, and the ones TLS, X.509, JOSE and HPKE now define.
- Selected, standard in preparation. Falcon, which NIST is turning into FN-DSA (FIPS 206, not final yet; liboqs still ships round-3 Falcon, which FN-DSA will not match byte for byte), and HQC, the code-based KEM NIST picked in March 2025 (NIST IR 8545) as a backup resting on a different problem than ML-KEM.
- Candidates. MAYO, UOV, SNOVA and CROSS are in NIST's process for additional signatures, which looks for schemes with short signatures or assumptions other than lattices. None is a standard; their parameters may still change.
- Not selected. Classic McEliece, FrodoKEM, NTRU and Streamlined NTRU Prime were evaluated and not
chosen by NIST. That is not a verdict of insecurity: Germany's BSI recommends FrodoKEM and Classic McEliece for
conservative deployments, both are part of an ISO/IEC 18033-2 amendment, and OpenSSH used
sntrup761x25519-sha512before it moved to ML-KEM. - Superseded. CRYSTALS-Kyber as submitted to round 3. FIPS 203 changed it, so Kyber and ML-KEM do not interoperate; liboqs keeps it for existing deployments.
Sizes first
For most systems the bytes matter more than the microseconds. A TLS handshake with X25519MLKEM768 carries 2,336 bytes for the key exchange instead of 64; an ML-DSA-65 signature is 3,309 bytes against 64 for Ed25519. The families spread over four orders of magnitude: UOV signatures start at 96 bytes, with public keys of up to 2.8 MB, Classic McEliece ciphertexts are under 210 bytes with public keys of up to 1.3 MB, and SLH-DSA keys are 32 to 64 bytes with signatures of up to 49,856. The table's last column puts public key plus signature or ciphertext on a logarithmic scale, the only one on which all of them fit. Sort by it to find the smallest exchange of each kind.
How the benchmark measures
Measuring downloads one liboqs module from this site — JavaScript with the WebAssembly embedded, about 18 to 55 KB
when compressed — and runs it in a Web Worker, so the page stays responsive even while Classic McEliece generates a
megabyte-sized key. For each operation the runner first calibrates a batch: how many operations it takes to
last at least 5 milliseconds, because browsers coarsen performance.now() to 0.1 ms on pages that are not
cross-origin isolated. It then times eleven batches and reports the median per operation, within a budget of
three seconds per operation, so the slowest sets report fewer samples and say so.
Every result is checked while it is measured: each signature must verify, a tampered signature must not, and each decapsulation must recover the encapsulated secret. A miscompiled module cannot report a fast but wrong number. The sizes the module produces are compared with the registry too.
The classical baselines run the same way, through WebCrypto (the browser's native implementation) or through
the @noble/curves JavaScript library: ECDSA P-256 and Ed25519 for signatures, X25519 for key
encapsulation, used as a KEM by sending a fresh ephemeral public key. Where the browser's WebCrypto lacks Ed25519
or X25519, the JavaScript version stands in and the page says so.
What stays local
The zoo takes no input of yours: keys are generated inside the worker for the measurement and discarded. The modules come from this site, and neither your device's details nor the results are sent anywhere. A share link records only the selected algorithm and the filters.
From the zoo to the standards
To use the standardized algorithms rather than time them, the post-quantum signature lab signs and verifies ML-DSA, SLH-DSA and Falcon with every FIPS option, and the ML-KEM lab runs the TLS hybrids. FN-DSA vs ML-DSA and ML-DSA vs SLH-DSA weigh the signature families against each other, and Post-quantum migration in 2026 explains which deadlines apply.