What Is It?
ML-DSA (Module Lattice-based Digital Signature Algorithm) is the primary NIST-standardized post-quantum digital signature algorithm, published as FIPS 204 in August 2024. It is based on CRYSTALS-Dilithium, selected during NIST's multi-year post-quantum competition.
ML-DSA is used wherever a signer produces signatures that others verify: code signing, TLS certificate authentication, authentication tokens, firmware integrity, and API request signing. It provides security against both classical and quantum attacks on digital signature operations.
Digital signatures are distinct from key exchange. ML-DSA does not establish shared secrets; it enables a party holding a private key to sign data in a way that any holder of the corresponding public key can verify. This is the mechanism underpinning trust in PKI hierarchies, software supply chains, and identity infrastructure.
Why Does It Matter?
Digital signatures underpin software supply chain integrity, PKI, TLS certificate authentication, firmware attestation, and code signing. ECDSA and RSA signatures are both vulnerable to Shor's algorithm. An adversary with a quantum computer could forge signatures on certificates or code previously signed with vulnerable algorithms retroactively undermining trust in the entire PKI hierarchy.
Unlike key exchange (where HNDL drives immediate urgency), digital signature schemes face a different timing: the primary threat is realized when quantum computers arrive, not when data is currently being transmitted. However, certificates and signing keys have long lifetimes. Code artifacts signed today may need their signatures verified years from now, when a quantum adversary could forge matching signatures on malicious code.
PKI hierarchies are particularly sensitive. Root CA certificates typically have 20-25 year lifetimes. If a root CA continues using ECDSA or RSA into the quantum era, all certificates it has ever signed will be vulnerable to forgery not just certificates issued after quantum computers arrive.
How It Works
ML-DSA is based on the Module Learning With Errors (M-LWE) and Module Short Integer Solution (M-SIS) problems. The signing algorithm produces a signature by sampling from a distribution centered on a secret lattice vector; verification checks that the signature satisfies a specific mathematical relationship with the public key.
Three operations:
KeyGen
Generate a public/private key pair. Public keys are 1312 bytes (ML-DSA-44) to 2592 bytes (ML-DSA-87).
Sign
Use the private key to produce a signature over a message. Signatures range from 2420 bytes (ML-DSA-44) to 4627 bytes (ML-DSA-87). Larger than ECDSA (64 bytes) but generally acceptable for most protocol uses.
Verify
Use the public key to verify that a signature is valid for a given message. Verification is fast and suitable for high-throughput environments.
Enterprise Impact
ML-DSA migration touches every system that relies on public-key authentication. Key areas:
PKI and certificate authorities
CA hierarchies need new root and intermediate certificates using ML-DSA. Root CA migration is an extended multi-year program given the 20+ year lifetimes of root certificates and the need for cross-signing compatibility.
Code signing
Build pipelines should sign binaries with ML-DSA (or hybrid). Any code artifact that must be verified in a quantum era requires migration.
Authentication tokens
JWT, SAML, and similar tokens signed with ECDSA require migration. This includes IdP configurations, token validation middleware, and client verification libraries.
Firmware and secure boot
Secure boot chains and firmware attestation rely on signatures. Hardware roots of trust need ML-DSA support from vendors this often requires hardware replacement rather than firmware update.
API and webhook signing
Any signing key used to authenticate API requests, webhooks, or inter-service communications should migrate to ML-DSA before the quantum era.
NIST Guidance
FIPS 204 specifies ML-DSA in three parameter sets.
ML-DSA-44
Approximately 128-bit quantum security. Smallest signatures and keys. Suitable for high-volume, size-constrained applications.
ML-DSA-65 (recommended)
Approximately 192-bit quantum security. NIST's primary recommended parameter set for most use cases.
ML-DSA-87
Approximately 256-bit quantum security. For environments requiring the highest security margins.