Why Post-Quantum Signatures Are 10-50x Larger and What That Means for Fees

The headline number for post-quantum signature schemes is the size multiplier. ECDSA secp256k1 signatures are 71-72 bytes. ML-DSA at typical parameters is 3,309 bytes. The ratio is 46x, and that’s the workhorse PQC option. Other schemes range from 9x (FN-DSA, which has smaller signatures but is harder to implement) to 700x (SLH-DSA at its largest parameter set).

That ratio is a real engineering problem. It’s also a misleading number to focus on if you want to predict what users will actually pay.

The frame worth using here is what I’d call the throughput tax. The headline “X-times bigger” framing focuses on individual transactions, but signatures live inside blocks, and Bitcoin’s block budget is fixed. Larger signatures crowd out throughput, and the cost of that scarcity falls on transaction fees.

That’s the real number to track.

Where the size comes from

ECDSA’s compactness comes from the math underneath. An elliptic-curve signature is two integers, each the size of the curve order (256 bits for secp256k1). That’s 64 bytes for the raw signature, plus encoding overhead taking it to 71-72 bytes total. The math is elegant. Each integer carries a lot of information in a small package.

PQC schemes don’t have that compactness because their underlying math is different. Lattice-based signatures include large vectors of polynomial coefficients across multiple modules. The size is structural to the math. The security depends on hard lattice problems like Module-LWE and Module-SIS, which sit underneath the module structure. Hash-based signatures (SLH-DSA) combine several primitives. The package includes WOTS+ keys for the one-time signature layer, FORS for the few-time signature layer, a hypertree binding the keys together, and authentication paths that prove which leaves were used.

The additional data is structural. It’s what gives PQC its quantum resistance, and it’s what makes the signatures big. Quantum-resistant schemes haven’t yet matched the compactness of elliptic-curve cryptography, and the underlying math is the reason.

The witness discount helps, up to a point

Bitcoin transactions get measured in “weight units” since SegWit. Witness data (signatures and other proof material) counts at one-quarter the rate of non-witness data. A 72-byte signature in witness counts as 18 weight units. A 3,309-byte signature in witness counts as 827 weight units.

The witness discount was designed to make signatures cheaper per byte. PQC migration would put signatures in witness data to take advantage of that discount. The effect is real but limited. The discount divides the cost by 4, but the signatures grow by 46x in this example. The net effect is 11.5x more weight per signature than the ECDSA equivalent.

Bitcoin’s block weight ceiling is 4 million weight units. That budget hasn’t changed since SegWit activated in 2017. Larger signatures mean fewer transactions per block. The witness discount softens the arithmetic without changing it.

What happens to block space

Bitcoin processes between 2,000 and 3,000 transactions per block at typical sizes. If PQC migration multiplies signature size by 10x in weight terms (average across the witness-discounted PQC options), the average transaction could grow by 50-80% in weight under one plausible migration scenario, depending on how many inputs and outputs each transaction has.

A 50% weight increase per transaction means 33% fewer transactions per block, assuming demand stays constant and transaction composition doesn’t change. Demand grows over time, and fee market pressure scales with the gap between demand and throughput.

So PQC migration would likely push fees upward by reducing throughput. Reduced throughput per block, combined with steady or growing demand, drives fees higher per transaction. The exact magnitude depends on which PQC scheme gets adopted, but the direction is unambiguous.

The fee forecast

How much higher? The math depends on which scheme gets adopted and how transactions restructure to accommodate larger signatures. A directional forecast for the ML-DSA case looks like this. Average transaction weight grows by 50-80%. Throughput drops correspondingly. Historically, reductions in effective block capacity have tended to increase fee pressure during periods of high demand, though the exact magnitude is difficult to predict.

The fee impact is asymmetric. Applications that handle high transaction volume (exchanges, Lightning channel operations, institutional settlement layers, and other throughput-heavy workflows) pay more. Applications that move large amounts infrequently (cold storage and long-term holdings, for example) barely notice the fee impact relative to the value being moved.

Where the pain lands

If you’re an active Bitcoin user who moves coins between exchanges and wallets regularly, plan on higher fees in the post-PQC era. The fee market won’t be more expensive in nominal terms (Bitcoin fee dynamics depend on demand and price, not just throughput), but it will be more expensive in proportional terms relative to the throughput available.

If you’re a long-term holder who signs maybe twice a year, the fee impact is negligible. Your annual transaction cost goes from negligible to negligible plus a small constant. Not worth restructuring your strategy over.

For wallet developers and protocol designers, the math is harder. FN-DSA gives smaller signatures (around 9x) but requires careful implementation to avoid side-channel attacks. SLH-DSA’s conservative math comes with the heaviest signature sizes. ML-DSA sits in the middle on both axes, which is one reason many current discussions focus on it.

BIP-360 (P2MR) and related Bitcoin proposals are the venues where the specific scheme will get decided. The fee implications depend on which way that conversation lands.

The migration math

The 10-50x signature size multiplier is the input. The output, in the fee market, is a structural shift toward higher per-transaction costs that affects throughput-heavy applications disproportionately. The exact magnitude is unknown until adoption happens, which is years off, and depends on which scheme Bitcoin ultimately picks.

The hedge is layer-2. Lightning and similar channel networks compress on-chain footprint by amortizing many off-chain transactions into one on-chain commitment. They were already attractive for fee reasons in the pre-PQC era. Post-PQC, the case for them gets stronger. The applications that need cheap throughput are likely to rely more heavily on off-chain settlement, and the on-chain layer would increasingly be where high-value or final settlement happens.

That’s the migration math. Signature size is the engineering constraint that gets headlines. Fee market dynamics determine what users actually pay. The throughput tax is the better way to think about it.