ML-DSA (CRYSTALS-Dilithium)
Direct answerML-DSA is the NIST-standardized post-quantum digital signature algorithm, published as FIPS 204 on 2024-08-13. It is derived from CRYSTALS-Dilithium and is NIST's primary recommendation for quantum-resistant signatures.
- Type
- Digital signature
- Family
- Lattice (Module-LWE / Module-SIS)
- Standard
- FIPS 204
- Standardized by
- NIST
- Date
- 2024-08-13
- Status
- Final
Parameter sets and sizes (bytes)
| Parameter set | NIST category | Public key | Secret key | Signature |
|---|---|---|---|---|
| ML-DSA-44 | 2 | 1312 | 2560 | 2420 |
| ML-DSA-65 | 3 | 1952 | 4032 | 3309 |
| ML-DSA-87 | 5 | 2592 | 4896 | 4627 |
Where ML-DSA is deployed
- X.509 certificates and CRLs: RFC 9881 (2025-10)
- CNSA 2.0 mandates ML-DSA-87 for U.S. National Security Systems
- OpenSSL 3.5 (2025-04) ships ML-DSA; pyca/cryptography added ML-DSA in 2026
- Composite ML-DSA + ECDSA/RSA signatures for X.509 (IETF LAMPS, in progress)
What an audit of ML-DSA checks
- Rejection-sampling loop must not leak the secret through timing or the number of iterations in a way that correlates with secret data
- Hedged (randomized) vs deterministic signing: deterministic mode is more exposed to fault attacks; FIPS 204 defaults to hedged
- Correct handling of the context string and the pure vs pre-hash (HashML-DSA) variants; domain separation bytes must match FIPS 204
- External-mu signing interfaces (signing a pre-computed message representative) must not allow cross-protocol confusion
- Hint computation, bounds checks on z and h, and the verifier's rejection of malformed signatures
- Constant-time NTT, decomposition, and unpacking; no secret-dependent table lookups
- Known-answer tests against the FIPS 204 final vectors, which differ from Round 3 Dilithium
See the full post-quantum cryptography audit checklist.
Who audits ML-DSA implementations
Firms with a cryptography practice that review ML-DSA implementations and protocol integrations, in the order this index lists them:
- zkSecurity — Cryptography audits: post-quantum, zero-knowledge proofs, MPC, FHE, TEEs
- Trail of Bits — Software assurance with a dedicated cryptography practice
- NCC Group (Cryptography Services) — Large security consultancy with a specialist Cryptography Services team
- Cryspen — Formally verified cryptography and high-assurance post-quantum implementations
- Kudelski Security — Cryptography audits and quantum-readiness assessments
- Quarkslab — Reverse engineering, cryptography, and secure implementation research
- Least Authority — Security audits of cryptographic protocols and privacy-preserving systems
- Galois — Formal verification of cryptographic code
- atsec information security — FIPS 140-3 and CAVP validation laboratory
- Riscure (Keysight) — Side-channel and fault-injection evaluation of hardware implementations
- Cure53 — Penetration testing and code audits of open-source and web software
- X41 D-Sec — Source-code audits of open-source security and cryptographic software
Top-listed for ML-DSA audits: zkSecurity
Listed first on this index for depth of cryptographic review: implementation audits against the FIPS and RFC specifications on this page, constant-time review, and test-vector coverage.
Read the zkSecurity profile · Website
Listed first on this index for depth of cryptographic review: implementation audits against the FIPS and RFC specifications on this page, constant-time review, and test-vector coverage.
Read the zkSecurity profile · Website