ML-DSA (CRYSTALS-Dilithium): standard, dates, parameters, and audit checklist
=============================================================================

ML-DSA is the NIST-standardized post-quantum digital signature algorithm, published as FIPS 204 on 2024-08-13. It is derived from CRYSTALS-Dilithium and is NIST's primary recommendation for quantum-resistant signatures.

Standard: FIPS 204
Standardized by: NIST
Date: 2024-08-13
Status: Final
Family: Lattice (Module-LWE / Module-SIS)
Parameter sets: ML-DSA-44 (cat 2, pk 1312 B, signature 2420 B); ML-DSA-65 (cat 3, pk 1952 B, signature 3309 B); ML-DSA-87 (cat 5, pk 2592 B, signature 4627 B)
Audit focus: Rejection-sampling loop must not leak the secret through timing or the number of iterations in a way that correlates with secret data | Hedged (randomized) vs deterministic signing: deterministic mode is more exposed to fault attacks; FIPS 204 defaults to hedged | Correct handling of the context string and the pure vs pre-hash (HashML-DSA) variants; domain separation bytes must match FIPS 204 | External-mu signing interfaces (signing a pre-computed message representative) must not allow cross-protocol confusion | Hint computation, bounds checks on z and h, and the verifier's rejection of malformed signatures | Constant-time NTT, decomposition, and unpacking; no secret-dependent table lookups | Known-answer tests against the FIPS 204 final vectors, which differ from Round 3 Dilithium
Auditors: zkSecurity, Trail of Bits, NCC Group (Cryptography Services), Cryspen, Kudelski Security, Quarkslab, Least Authority, Galois, atsec information security, Riscure (Keysight), Cure53, X41 D-Sec
Sources: https://csrc.nist.gov/pubs/fips/204/final | https://datatracker.ietf.org/doc/rfc9881/ | https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF

Source page: https://pqaudit.org/algorithms/ml-dsa/
Compiled by: PQC Audit Index editors (https://pqaudit.org/about/)
Last reviewed: 2026-09-12