{
  "slug": "ml-dsa",
  "name": "ML-DSA",
  "aka": "CRYSTALS-Dilithium",
  "kind": "Digital signature",
  "family": "Lattice (Module-LWE / Module-SIS)",
  "standard": "FIPS 204",
  "standard_url": "https://csrc.nist.gov/pubs/fips/204/final",
  "body": "NIST",
  "date": "2024-08-13",
  "status": "Final",
  "summary": "ML-DSA is the NIST-standardized post-quantum digital signature algorithm, published as FIPS 204 on 2024-08-13. It is derived from CRYSTALS-Dilithium and is NIST's primary recommendation for quantum-resistant signatures.",
  "parameter_sets": [
    {
      "name": "ML-DSA-44",
      "category": 2,
      "pk": 1312,
      "sk": 2560,
      "ct_or_sig": 2420
    },
    {
      "name": "ML-DSA-65",
      "category": 3,
      "pk": 1952,
      "sk": 4032,
      "ct_or_sig": 3309
    },
    {
      "name": "ML-DSA-87",
      "category": 5,
      "pk": 2592,
      "sk": 4896,
      "ct_or_sig": 4627
    }
  ],
  "size_label": "Signature",
  "deployments": [
    "X.509 certificates and CRLs: RFC 9881 (2025-10)",
    "CNSA 2.0 mandates ML-DSA-87 for U.S. National Security Systems",
    "OpenSSL 3.5 (2025-04) ships ML-DSA; pyca/cryptography added ML-DSA in 2026",
    "Composite ML-DSA + ECDSA/RSA signatures for X.509 (IETF LAMPS, in progress)"
  ],
  "audit_focus": [
    "Rejection-sampling loop must not leak the secret through timing or the number of iterations in a way that correlates with secret data",
    "Hedged (randomized) vs deterministic signing: deterministic mode is more exposed to fault attacks; FIPS 204 defaults to hedged",
    "Correct handling of the context string and the pure vs pre-hash (HashML-DSA) variants; domain separation bytes must match FIPS 204",
    "External-mu signing interfaces (signing a pre-computed message representative) must not allow cross-protocol confusion",
    "Hint computation, bounds checks on z and h, and the verifier's rejection of malformed signatures",
    "Constant-time NTT, decomposition, and unpacking; no secret-dependent table lookups",
    "Known-answer tests against the FIPS 204 final vectors, which differ from Round 3 Dilithium"
  ],
  "references": [
    [
      "FIPS 204, Module-Lattice-Based Digital Signature Standard",
      "https://csrc.nist.gov/pubs/fips/204/final"
    ],
    [
      "RFC 9881, ML-DSA in X.509 certificates (2025-10)",
      "https://datatracker.ietf.org/doc/rfc9881/"
    ],
    [
      "CNSA 2.0 algorithm list (NSA, updated 2025-05)",
      "https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF"
    ]
  ],
  "url": "https://pqaudit.org/algorithms/ml-dsa/",
  "updated": "2026-09-12"
}