Cryptanalysis of the Falcon-M Signature Scheme

Abstract

Symmetry is crucial in lattice cryptography, where secure signatures rely on structural invariants over polynomial rings. This paper conducts a rigorous security and correctness analysis on Falcon-M, a lightweight signature scheme. We first demonstrate a fundamental correctness failure through an explicit experimental instantiation of the scheme: because the signing algorithm is algebraically decoupled from the secret key, no honestly generated signature was accepted in our tested experiments. Furthermore, we reveal that removing the NTRU trapdoor breaks the essential computational asymmetry, causing the verification equation to degenerate into a publicly solvable linear system. Consequently, for invertible public keys, an adversary can execute a direct universal forgery attack purely from public data via pointwise algebraic inversion in the frequency domain with $\mathcal{O}\left(n\log n\right)$ time complexity. For non-invertible keys, we further identify a practical existential forgery utilizing a localized salt-search. Ultimately, these practical cryptanalytic results mathematically invalidate the claimed security under the analyzed instantiation.

1. Introduction

Modern cryptographic frameworks are inherently built upon the principles of mathematical symmetry and asymmetry, where structural invariants govern both efficiency and security. Particularly in lattice-based cryptography, symmetric algebraic structures over polynomial rings play a foundational role. In the standardization process of post-quantum cryptography [1], lattice-based digital signature schemes primarily follow two major design paradigms: the Fiat-Shamir with Aborts (FSWA) [2] transform with rejection sampling (such as Dilithium [3]) and the Hash-and-Sign paradigm based on the GPV framework [4] (such as Falcon [5]). The Falcon scheme achieves compact public keys and signature sizes by utilizing NTRU lattices and fast Fourier transforms (FFT) over polynomial rings. However, because the key generation and signature algorithms are heavily dependent on NTRU trapdoor generation (i.e., satisfying the equation $fG-gF=q$) and high-precision preimage sampling [4,6], the deployment of Falcon in resource-constrained environments like the Internet of Things (IoT) is restricted due to high computational and memory overheads [7]. Recently, Kerimbayeva et al. proposed a lightweight variant named Falcon-M based on the Falcon signature scheme [8]. Falcon-M attempts to abandon the NTRU trapdoor mechanism. Instead, it completes signature generation and verification directly using random polynomials and linear algebraic operations. While this approach reduces memory usage and computational overhead, it fundamentally alters the balanced algebraic symmetry between the signing and verification procedures. Consequently, this alteration potentially compromises the system’s structural invariants.

In this paper, we perform a security analysis on the Falcon-M scheme proposed by Kerimbayeva et al. [8]. The analytical results indicate that this scheme does not satisfy the claimed unforgeability [9]. Without knowing the private key, an adversary can construct a signature satisfying the verification equation via pointwise division in the frequency domain using only public parameters.

The analytical results show that the removal of the trapdoor mechanism while maintaining the Hash-and-Sign paradigm [4] leads to a loss of the algebraic foundation for resisting existential forgery in the cryptosystem [9]. Due to the lack of non-linear algebraic binding constraints on the private key in lattice signature schemes that depart from GPV trapdoor preimage sampling and do not introduce the FSWA masking mechanism [10,11,12], the verification equation of Falcon-M degenerates into an invertible linear system. By exploiting the algebraic isomorphism and splitting properties of the polynomial quotient ring, an adversary can reduce the hard problem on lattices to a conventional algebraic inversion operation in the frequency domain [13,14].

From the viewpoint of structural symmetry, the security degradation of Falcon-M is deeply rooted in the destruction of the balanced algebraic interaction between secret-key information and public verification equations. When this balance disappears, the verification process collapses into a purely public linear transformation characterized by an exploitable algebraic symmetry, allowing an adversary to efficiently compute its inverse in the frequency domain.

The core contributions of this paper are summarized as follows:

1. We demonstrate that removing Falcon-M’s trapdoor degenerates its verification into a publicly solvable linear equation. Specifically, for invertible Falcon-M public keys, an adversary can execute a universal forgery attack [14] purely from public data. While this mathematical method relies on direct algebraic inversion rather than a new frequency-domain cryptanalytic technique, it represents an important practical result: it definitively exposes the structural degradation caused by the trapdoor removal and demonstrate that the claimed EUF-CMA security is not supported under the analyzed instantiation.

2. The core flaw in the security reduction in Falcon-M is pointed out. Since the signature generation process of the original scheme is decoupled from the algebraic structure of the private key, the verification equation solely forms a public linear constraint on the signature variables, which an adversary can directly solve. Therefore, the premise of reducing the forgery behavior to the Short Integer Solution (SIS) problem in the original proof no longer holds [13,15], and the reduction process for extracting short vectors based on the forking lemma is mathematically invalid [16].

3. We provide a rigorous empirical evaluation based on our implementation, strongly supporting the observation that honestly generated Falcon-M signatures failed verification in all of our empirical trials. By implementing strict discrete Gaussian sampling and a specifically defined deterministic hash-to-ring mapping (as an explicit experimental instantiation of the scheme), we empirically demonstrate that the algebraic decoupling of the secret key causes a massive verifiable error, exposing a fundamental correctness failure in the scheme’s design.

2. Description of the Falcon-M Signature Scheme

The Falcon signature scheme is one of the selected algorithms in the NIST post-quantum cryptography standardization [5], playing a significant role in the field of lattice cryptography due to its excellent signature size and computational efficiency. However, a complex NTRU trapdoor needs to be constructed for the key generation of Falcon (i.e., solving the polynomial congruence equation $fG-gF=q(mod \varphi )$), and high-precision discrete Gaussian sampling must be executed in the signing phase. When deployed on resource-constrained embedded systems or IoT devices, these operations cause a noticeable memory burden and simultaneously form a computational complexity bottleneck. Kerimbayeva et al. proposed the Falcon-M scheme to simplify the structure of the Falcon algorithms, thereby making it more suitable for lightweight deployment. Its core design idea lies in eliminating the complex trapdoor sampling mechanism in the original Falcon. Low-norm polynomials sampled randomly and pure fast Fourier transform operations are used to construct the public key and generate signatures, thereby maintaining the proper security properties of lattice cryptography while implementation difficulty is reduced.

2.1. Algorithm Formalization of Falcon-M

The Falcon-M signature scheme consists of three algorithms. To avoid introducing additional explanation bias, the algorithmic structures are strictly recounted in this section according to Literature [8], and the cryptanalysis is carried out directly based on the original verification relationship in the subsequent sections.

The pseudo-code in Algorithms 1–3 strictly reproduces the formalization provided in the original Falcon-M proposal to ensure an authentic cryptanalytic target. Consequently, it inherits the original manuscript’s notational inconsistencies—such as the erroneous use of the variable $x$ instead of the message $m$ in the SHA-512 operations of Algorithms 2 and 3—as well as incomplete distributional definitions, such as the missing coefficient bounds for the private keys $a\left(x\right)$ and $b\left(x\right)$ in Algorithm 1. These underspecified components are rigorously defined as explicit experimental instantiations in our analysis (see Section 3.4).

Algorithm 1: Falcon-M key generation algorithm

Input:

$n$—security parameter (polynomial degree)

$q$—modulus

Output:

Public key $h\left(x\right)$, private key $(a\left(x\right),b(x\left)\right)$

1: Generate $a\left(x\right),b\left(x\right)\in Z_q/(x^n+1)$ with integer coefficients from

2: Compute $A\left(\omega \right)\leftarrow FFT\left(a\right(x\left)\right)$

3: Compute $B\left(\omega \right)\leftarrow FFT\left(b\right(x\left)\right)$

4: Compute $H\left(\omega \right)\leftarrow A\left(\omega \right)\cdot B\left(\omega \right)$//element-wise multiplication in frequency domain

5: Compute $h\left(x\right)\leftarrow IFFT\left(H\right(\omega \left)\right)\mathrm{m}\mathrm{o}\mathrm{d}q$//transform back to time domain

6: Return $h\left(x\right),a\left(x\right),b\left(x\right)$

Algorithm 2: Falcon-M signature generation algorithm

Input:

Private key $(a\left(x\right),b(x\left)\right)$, message m

Output:

Signature $\sigma \left(x\right)$

1: Compute $H\left(m\right)\leftarrow SHA\text{-}512\left(x\right) mod q$

2: Sample $s\leftarrow D_{\delta }\left(H\right(m\left)\right)$//discrete Gaussian sampling centered at $H\left(m\right), \delta \in [10,20]$

3: Compute $S\left(\omega \right)\leftarrow FFT\left(s\right)$

4: Compute $\sigma \left(x\right)\leftarrow IFFT\left(S\left(\omega \right)\right) mod q$

5: Return $\mathsf{\sigma }\left(\mathrm{x}\right)$

Algorithm 3: Verification procedure of Falcon-M signatures

Input:

Public key $h\left(x\right) \mathrm{message} m, \mathrm{signature} \sigma \left(x\right)$

Output: Accept or Reject

1: $\mathrm{Compute} \mathrm{H}\left(\mathrm{m}\right)\leftarrow \text{SHA-512}\left(\mathrm{x}\right)\mathrm{m}\mathrm{o}\mathrm{d} \mathrm{q}$

2: $\mathrm{Compute} \mathrm{H}\left(\mathsf{\omega }\right)\leftarrow \mathrm{F}\mathrm{F}\mathrm{T}\left(\mathrm{h}\right(\mathrm{x}\left)\right)$

3: $\mathrm{Compute} \sum \left(\mathsf{\omega }\right)\leftarrow \mathrm{F}\mathrm{F}\mathrm{T}\left(\mathsf{\sigma }\right(\mathrm{x}\left)\right)$

4: $\mathrm{Compute} \mathrm{Y}\left(\mathsf{\omega }\right)\leftarrow \mathrm{H}\left(\mathsf{\omega }\right)·\sum \left(\mathsf{\omega }\right)$//frequency domain multiplication

5: $\mathrm{Compute} \mathrm{y}\leftarrow \mathrm{I}\mathrm{F}\mathrm{F}\mathrm{T}\left(\mathrm{Y}\right(\mathsf{\omega }\left)\right)\mathrm{m}\mathrm{o}\mathrm{d} \mathrm{q}$

6: $\mathrm{If} \parallel \text{y-H}\left(\mathrm{m}\right)\parallel \le \mathsf{\delta }$ then

7: Accept

8: Else

9: Reject

2.2. Comparison of Core Components and Computational Overhead

As shown in

Table 1. Comparison of Verification Logic Between Original Falcon and Falcon-M Schemes.

Dimension	Original Falcon	Falcon-M
Private-key binding	The trapdoor must be known to solve: $s_1+s_2·h=c\left(\mathrm{m}\mathrm{o}\mathrm{d}q\right)$	The private key only participates in public-key generation; the signing process is decoupled from it
Mathematical assumption	Short-vector problem over NTRU lattices.	The verification relation degenerates into a public linear equation.
System characteristic	Non-linear trapdoor constraint.	Public linear equation.

, the expensive trapdoor sampler in the original Falcon is abandoned by Falcon-M and replaced with regular frequency-domain multiplication. It is precisely this simplified design (e.g., completely removing the binding constraint of $fG-gF=q$ and decoupling the private key from algebraic participation in the signing process) that leads to a polynomial-time universal forgery attack.

3. Security Analysis of the Falcon-M Signature Scheme

A proof of unforgeability for the Falcon-M scheme was provided by Kerimbayeva et al. in [8]. However, our analysis reveals that an adversary can construct a valid signature.

In the original Falcon scheme, the unforgeability of the signature depends on finding an ultra-short vector $(s_1,s_2)$ satisfying $s_1+s_2·h=c\left(\mathrm{m}\mathrm{o}\mathrm{d}q\right)$ given the public key and the message hash. This is inherently a Short Integer Solution (SIS) problem. Specifically, finding short vectors $\left(s_1,s_2\right)$ such that $s_1+s_2\cdot h=c\left(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}q\right)$ reduces to the Ring-SIS problem over NTRU lattices. In Falcon-M, decoupling the private key degenerates this into a publicly solvable linear system. The signer must execute preimage sampling with the aid of the NTRU trapdoor (satisfying $f·G-g·F=q$) hidden behind the public key to correctly generate the signature.

However, to pursue ultimate lightweight performance, Falcon-M removes the NTRU trapdoor mechanism and directly generates the public key using low-norm polynomials $a\left(x\right)$ and $b\left(x\right)$ randomly sampled within a bounded interval. This structural removal causes a severe loss of security. In the equation $\parallel IFFT\left(H_{pk}\right(\omega )\odot \sum (\omega \left)\right)-H\left(m\right){\parallel }_{\mathrm{\infty }}\le \delta$, the only unknown is the signature polynomial itself, and the system is completely linearized. Therefore, as long as the public key polynomial $h\left(x\right)$ is invertible in the ring $R_q=Z_q\left[x\right]/(x^n+1)$ (or an invertible mapping is found by injecting a minor perturbation salt value into the message), an adversary can directly execute pointwise algebraic inversion in the frequency domain.

The time complexity of this inversion and the forward/inverse transform process, expressed as $\Sigma \left(\omega \right)=C\left(\omega \right)\oslash H_{pk}\left(\omega \right)$, is only limited by the theoretical lower bound of the FFT, namely O(nlogn). We explicitly distinguish this theoretical complexity from our released reproducibility scripts. While the vulnerability theoretically permits an $O\left(n\log n\right)$ asymptotic bound via a fast NTT, the provided SageMath implementation utilizes dense matrix multiplication for structural clarity, operating in $O\left(n^2\right)$ time. Achieving the optimal asymptotic performance would require a fully optimized NTT software implementation. As a direct algebraic inversion, this attack requires no novel or complex cryptanalytic solvers. Due to this structural flaw, the forgery problem, which should rely on the hardness of lattices, trivially degrades into an algebraic inversion problem solvable in polynomial time, enabling a valid signature to be constructed by an adversary and invalidating the original scheme’s claimed EUF-CMA security.

Furthermore, honestly generated Falcon-M signatures inherently fail verification. As defined in Algorithm 2, the signing procedure merely samples a vector $s$ around $H\left(m\right)$ without any involvement of the private key. During verification (Algorithm 3), the product $h\left(x\right)\cdot \sigma \left(x\right)\left(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}q\right)$ is computed. Since the public key $h\left(x\right)$ acts as a pseudo-random multiplier, the resulting polynomial is randomly scattered across $R_q$ and possesses no mathematical proximity to the target hash $H\left(m\right)$. Consequently, an honest signature will almost never satisfy the acceptance threshold ${\Vert y-H\left(m\right)\Vert }_{\infty }\le \delta$. This critical error destroys the scheme’s basic correctness. We provide empirical evidence of this structural failure in Section 3.4.

3.1. Threat Model and Practical Attack Assumptions

To formalize the cryptographic attack against Falcon-M, we define the attacker’s capabilities and practical assumptions. The adversary $A$ requires only the target message and the public key $h\left(x\right)$. The primary numerical assumption is that $h\left(x\right)$ is invertible in the frequency domain; the implementation assumption strictly expects the target to execute the verification equation as defined in our instantiation. The attack applies to implementations that adopt this direct mathematical mapping, as the vulnerability is rooted in a fundamental mathematical defect—the degeneration of the verification equation into a publicly solvable linear system—rendering such concrete deployments inherently vulnerable.

3.2. Description of the Forgery Attack on Falcon-M

A universal forgery attack implies that anyone can forge a valid signature for any message of any user using only public information. Suppose an adversary $A$ intends to forge a valid signature ${\sigma }^{\ast }$ for a target message $m^{\ast }$ given only the public key $h$. The attack process is described in Algorithm 4:

Algorithm 4: Formalized Universal Forgery against Falcon-M

Input: Target message ${\mathrm{m}}^{\mathrm{*}}$$, \mathrm{Public} \mathrm{key} h\left(x\right)$$, \mathrm{Modulus} q$

Output: A valid forged signature ${\mathsf{\sigma }}^{\mathrm{*}}\left(\mathrm{x}\right)$

1: $\mathrm{A} \mathrm{computes} \mathrm{the} \mathrm{target} \mathrm{message} \mathrm{hash}:{ c}^{\ast }\leftarrow SHA-512\left(m^{\ast }\right)\mathrm{m}\mathrm{o}\mathrm{d} q$

2: $\mathrm{A} \mathrm{applies} \mathrm{FFT} \mathrm{to} \mathrm{map} c^{\ast }$$\mathrm{and} h\left(x\right)$$\mathrm{to} \mathrm{the} \mathrm{frequency} \mathrm{domain}: C\left(\omega \right)\leftarrow FFT\left(c^{\ast }\right)$$, H\left(\omega \right)\leftarrow FFT\left(h\right(x\left)\right)$

3: A computes the forged signature in the frequency domain via element-wise algebraic division: $\sum \left(\omega \right)\leftarrow C\left(\omega \right)\oslash H\left(\omega \right)$

4: A transforms the result back to the time domain: ${\sigma }^{\ast }\left(x\right)\leftarrow IFFT(\sum (\omega \left)\right)\mathrm{m}\mathrm{o}\mathrm{d} q$

5: $\mathrm{Return} {\mathsf{\sigma }}^{\mathrm{*}}\left(\mathrm{x}\right)$

3.3. Correctness Analysis of the Forgery Attack

Lemma 1

(Uniform Distribution in the Frequency Domain). Let the polynomial ring be $R_q={\mathbb{Z}}_q\left[x\right]/\left(x^n+1\right)$, where the modulus $q$ is a prime satisfying $q\equiv 1\hspace{1em}\left(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}2n\right)$. The Fast Fourier Transform (FFT) over such a finite field, formally known as the Number Theoretic Transform (NTT), acts as a bijective linear mapping. If the coefficients of a polynomial $a\left(x\right)\in R_q$ are uniformly distributed over ${\mathbb{Z}}_q$, then its frequency-domain evaluations $A\left({\omega }_i\right)$ after the FFT/NTT are independent and uniformly distributed over ${\mathbb{Z}}_q$.

Proof of Lemma 1.

This follows directly from the properties of the NTT over completely splitting rings. The transform acts as a bijective linear isomorphism (a basis change) from the spatial domain $R_q$ to the frequency domain $Z_q^n$, which can be represented by an invertible Vandermonde matrix. As established in standard lattice-based cryptography literature [13,14], applying a fixed invertible linear transformation strictly preserves uniformity for inputs uniformly distributed over the full space. However, since Falcon-M private keys are sampled from a bounded small-coefficient distribution, this uniformity acts as an approximation. Our extensive empirical observations confirm this approximation holds sufficiently to support the attack. □

The algebraic forgery attack inherently assumes that the target hash evaluations $C\left({\omega }_i\right)$ and the public key components are independent and uniformly distributed in the frequency domain. Because the original Falcon-M description does not fully define the conversion from the SHA-512 output to a polynomial with the required $n$ coefficients, we present our hash-to-ring procedure as one explicit experimental instantiation. Specifically, in our evaluation, we utilize the 512-bit digest of SHA-512 $\left(m\right)$ as a deterministic seed for a pseudo-random number generator (PRNG) to sample $n$ independent coefficients uniformly from ${\mathbb{Z}}_q$. We acknowledge that other interpretations of the underspecified original algorithm may be possible, which could alter the specific coefficient distribution. However, our explicit instantiation provides a concrete and reproducible baseline for evaluating the structural algebraic vulnerabilities of the scheme. Because this mapping behaves as a random oracle generating coefficients uniformly across ${\mathbb{Z}}_q$, and because the NTT over the completely splitting ring $R_q$ acts as a bijective linear isomorphism, the resulting frequency-domain evaluations $C\left({\omega }_i\right)$ act as independent, uniformly distributed random variables over the finite field ${\mathbb{Z}}_q$. This algebraic mapping strongly supports the probabilistic assumptions underpinning our universal and existential forgery claims in this instantiation.

The forged signature ${\sigma }^{\ast }$ passes the signature verification equation $y=IFFT\left(FFT\right(h\left(x\right)\left)\right)\odot FFT\left({\sigma }^{\ast }\right(x\left)\right)$. According to the properties of isomorphic mapping, $Y\left(\omega \right)=FFT\left(h\right(x\left)\right)\odot FFT\left({\sigma }^{\ast }\right(x\left)\right)$ can be obtained, which yields $Y\left(\omega \right)=H_{pk}\left(\omega \right)\odot \left(C\right(\omega )\oslash H_{pk}(\omega \left)\right)=C\left(\omega \right)$. That is to say, the forged signature ${\sigma }^{\ast }$ is valid for the message $m^{\ast }$ and the public key $H_{pk}\left(\omega \right)$. By transforming the frequency-domain result back to the time domain, $y=IFFT\left(C\right(\omega \left)\right) \mathrm{m}\mathrm{o}\mathrm{d}q=c=H\left(m^{\ast }\right)$ is obtained. At this time, the infinity norm is: $\parallel y-H\left(m^{\ast }\right){\parallel }_{\mathrm{\infty }}=0$. Since the acceptance threshold specified by the Falcon-M scheme is $\delta \in [10,20]$, this equation holds.

The proposed algebraic forgery attack strictly requires that the frequency domain representation of the target public key $h_q\left(x\right)$ is invertible over the underlying polynomial ring $R_q$. In our theoretical analysis, if a generated public key is non-invertible, the linear system cannot be uniquely solved, causing the attack to naturally abort. Therefore, the attack theoretically applies exclusively to the invertible subset of the public key space.

To ensure the rigor of the aforementioned universal forgery attack, the algebraic invertibility of the public key $H_{pk}\left(\omega \right)$ in the ring $R_q$ must be discussed. This attack relies on pointwise division in the frequency domain; however, $H_{pk}\left(\omega \right)$ is not necessarily strictly invertible. Since the modulus $q=12289$ is a prime number and satisfies $q\equiv 1\left(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}2n\right)$ for $n=512$, the polynomial ring ${\mathbb{Z}}_q\left[x\right]/\left(x^n+1\right)$ is completely split into $n$ independent frequency components. The public key is constructed as $H_{pk}\left({\omega }_i\right)=A\left({\omega }_i\right)\cdot B\left({\omega }_i\right)$. For $H_{pk}$ to be strictly invertible at every frequency, both $A\left({\omega }_i\right)$ and $B\left({\omega }_i\right)$ must be non-zero. Assuming these evaluations act as independent and approximately uniform variables over ${\mathbb{Z}}_q$, the probability that a single frequency component is non-zero is ${\left(1-1/q\right)}^2$. Over all $n$ dimensions, the probability of complete invertibility is ${\left(1-1/q\right)}^{2n}$. Therefore, the theoretical probability that $H_{pk}\left(\omega \right)$ contains at least one zero frequency component (i.e., is non-invertible) is expressed as:$P=1-(1-{\displaystyle \frac{1}{q}}{)}^{2n}\approx 1-(1-{\displaystyle \frac{1}{12289}}{)}^{1024}\approx 8.01\mathrm{\%}$.

That is to say, for approximately 91.99% of the randomly generated public keys, complete invertibility is achieved in the frequency domain. In these instances, the proposed algebraic division attack achieves a 100% success rate in forging a valid signature with $O(n\mathrm{l}\mathrm{o}\mathrm{g} n)$ complexity under invertible public key instances, without introducing any residual noise.

Theorem 1.

Consider the Falcon-M scheme defined over $R_q={\mathbb{Z}}_q\left[x\right]/\left(x^n+1\right)$. For a non-invertible public key with $k\ge 1$ zero-frequency components, an adversary can still execute an existential forgery with absolutely zero residual error by appending a random salt r to the message. The success probability of a single salt trial is exactly $p={\left(1/q\right)}^k$. The expected number of hash iterations T follows a geometric distribution with $E\left[T\right]=q^k$.

Proof of Theorem 1.

In the completely splitting ring $R_q$, the verification equation strictly maps to $n$ independent pointwise linear equations in the frequency domain: $H\left({\omega }_i\right)\Sigma \left({\omega }_i\right)\equiv C\left({\omega }_i\right)\left(mod\hspace{0.25em}q\right)$. Let $K$ be the set of indices where the public key is non-invertible, with $\left|K\right|=k\ge 1$ (i.e., $H\left({\omega }_j\right)=0$ for all $j\in K$). The verification equation maps to pointwise linear equations, which for these specific indices become $0\cdot \Sigma \left({\omega }_j\right)\equiv C\left({\omega }_j\right)\left(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}q\right)$. This system has a valid mathematical solution if and only if the target hash evaluations vanish simultaneously, satisfying $C\left({\omega }_j\right)\equiv 0\left(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}q\right)$ for all $j\in K$. Assuming the pseudo-random hash evaluations in the frequency domain are independent and uniform, the probability of strictly satisfying all $k$ constraints in a single trial is precisely ${\left(1/q\right)}^k$.

Under the random oracle model, as the adversary iterates a salt r to compute the target hash $c=H\left(m\left|\right|r\right)$, its frequency-domain evaluations $C\left({\omega }_j\right)$ act as uniformly distributed random variables over the finite field ${\mathbb{Z}}_q$. Thus, the probability of exactly satisfying $C\left({\omega }_j\right)\equiv 0\hspace{1em}\left(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}q\right)$ for all $j\in K$ in a single trial is strictly ${\left(1/q\right)}^k$.

When this condition is met, the adversary can arbitrarily set $\Sigma \left({\omega }_j\right)=0$ (or any value in ${\mathbb{Z}}_q$) for all $j\in K$ and compute the remaining $n-k$ components via direct modular division: $\Sigma \left({\omega }_i\right)=C\left({\omega }_i\right)\cdot H{\left({\omega }_i\right)}^{-1}\left(\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}q\right)$. Because the pointwise equations are satisfied exactly across all $n$ frequencies, the Inverse NTT guarantees that the time-domain signature yields an exact match. The residual error is exactly zero (${\Vert y-c\Vert }_{\infty }=0\le \delta$). The salt search is a sequence of independent Bernoulli trials; hence, the expected number of iterations is $E\left[T\right]=1/p=q$. Since appending a salt modifies the semantic target from $m$ to $m\left|\right|r$, this process strictly constitutes an existential forgery rather than a universal one. □

3.4. Discussion and Experimental Analysis

For the approximately 8.01% of non-invertible cases where zero-frequency components exist, the adversary does not need to accept any truncation error. According to Theorem 1, the adversary simply traverses a localized salt space. For instances with exactly one zero component ($k=1$), the expected iterations are $E\left[T\right]=q=\mathrm{12,289}$, taking mere milliseconds. For $k=2$, $E\left[T\right]\approx 1.5\times {10}^8$. While this expected search count suggests theoretical feasibility, our experiments do not provide an optimized hardware implementation. We explicitly state that the practical exploitability of instances with $k=2$ was not directly evaluated and would strictly depend on low-level implementation efficiency. However, as $k$ increases strictly beyond 2, the salt-search complexity grows exponentially and exceeds practical computational feasibility. Consequently, we rigorously restrict our existential forgery claims to practically exploitable instances where $k\le 2$. Consequently, we moderate our claims: the direct universal forgery applies to approximately 91.99% of the tested key space under the independence approximation. For the remaining non-invertible keys, the salt-append technique yields an existential forgery (violating EUF-CMA), subject to practical computational bounds for small $k$.

To verify both the observed correctness failure of honest signatures and the effectiveness of the universal forgery attack against Falcon-M, we conducted large-scale simulations on a dedicated experimental platform. An Intel Xeon Gold 6271C CPU (2.60 GHz) virtualization instance equipped with 2 GB RAM was used as the experimental environment, and the software stack was based on Debian 9.9 and SageMath 7.4. All algebraic operations were executed under the polynomial ring logic of SageMath to ensure mathematical rigor [17]. For reproducibility, all SageMath scripts initialize the pseudo-random number generators with a fixed seed. Therefore, the reported experimental results can be reproduced under the same software environment.

Prior to evaluating the forgery attack, we experimentally evaluated honest Falcon-M signatures under the specified instantiation. Across 1,000,000 independent trials, honest signatures yielded zero accepted instances. While this finite experiment establishes an observed acceptance rate of 0% rather than an absolute zero probability, the data support an approximate 95% confidence upper bound of three accepted signatures per million. These trials generated a massive empirical error averaging ~6128 (consistent with the expected magnitude of random elements sampled from the finite field ${\mathbb{Z}}_q$) that vastly exceeds the threshold $\delta =20$. In all tested cases, the forged signatures were accepted by our instantiated verification procedure (Algorithm 3), with zero residual error (${\left|\right|y-H\left(m\right)\left|\right|}_{\infty }=0\le \delta$). This empirical evaluation provides strong evidence for the functional failure of honest signatures under the tested instantiation and demonstrates the practical reproducibility of our forgery attack.

Under the parameters $n=512$, $q=\mathrm{12,289}$, and the verification threshold $\delta =20$, 1,000,000 independent random trials were executed for each defined retry budget. For each trial, the private key polynomials $a\left(x\right)$ and $b\left(x\right)$ were uniformly sampled within a concretely defined bounded interval of $\left[-100,100\right]$ using the pseudo-random number generator (PRNG) provided by SageMath 7.4, and the corresponding public key was generated according to the Falcon-M specification.

To strictly evaluate the signature generation process, the discrete Gaussian sampling procedure $D_{\delta }\left(H\left(m\right)\right)$ was implemented precisely. Specifically, we configured the base Gaussian parameter as $\sigma =\delta /3.0$, and enforced a strict truncation interval of $\left[-\delta ,\delta \right]$ where $\delta =20$. The sampling was executed utilizing Cumulative Distribution Function (CDF) inversion with a working precision of standard 53-bit floating-point (IEEE 754) as provided by native mathematical libraries. This precise parameterization ensures that the simulated honest signatures strictly reflect the intended statistical distribution prior to failing the verification equation.

Instead of merely skipping non-invertible keys, the adversary algorithm attempts to achieve exact algebraic cancellation in the finite field within the maximum salt retry limit. These trials were used to statistically measure the overall attack success rate and average execution time under different retry budgets. The experimental statistical results are shown in

Table 2. Experimental Statistics of the Universal Forgery Attack Against Falcon-M (1,000,000 Trials).

Maximum Salt Retries	Forgery Success Rate
0	92.03%
1	92.03%
5	92.04%
10	92.04%
20	92.05%
100	92.09%
500	92.33%
1000	92.63%

:

The experimental data indicate that the complete invertibility rate of the public key is 92.03% (observed at 0 salt retries), which is highly consistent with the theoretical value (approximately 91.99%) predicted based on the splitting ring properties. Under the condition that the public key is invertible, the residual of the forgery attack is constantly 0, which means that an adversary can forge a valid signature immediately without any salt retries. For the approximately 8% of non-invertible cases, an exact algebraic match is strictly required in the finite field. The empirical results demonstrate that increasing the maximum salt retry budget progressively elevates the overall success rate (reaching 92.63% at 1000 retries) in precise accordance with the $1/q$ probability per trial. This confirming that the baseline vulnerability trivially compromises the universal unforgeability for fully invertible keys, and facilitates existential forgeries for non-invertible keys (typically $k\le 2$). Both paths unequivocally invalidate the EUF-CMA security claims of the Falcon-M scheme without relying on continuous-domain approximations.

4. Conclusions

In this paper, we carry out a formal cryptanalysis against the trapdoorless lattice signature scheme Falcon-M. Our evaluations, based on a concrete experimental instantiation, strongly indicate that removing the NTRU trapdoor structurally completely decouples the secret key from the signing process, yielding a 0% observed acceptance rate for honest signatures in our large-scale testing. Furthermore, we reveal the structural defect where the verification equation degenerates into a linear invertible system. By demonstrating a direct universal forgery attack whose theoretical complexity is $\mathcal{O}\left(n\log n\right)$ and an existential forgery via a localized salt-search, we yield a practical result that fundamentally invalidates the scheme’s EUF-CMA security claims. These findings emphasize that structural symmetry and non-linear algebraic binding cannot be sacrificed for lightweight performance in lattice cryptography.