ML-DSA

Module-Lattice Digital Signature Algorithm (FIPS 204), formerly known as Dilithium. The NIST-standardized post-quantum replacement for ECDSA and RSA signatures.

How it works

Like ml-kem, based on the Module Learning With Errors (MLWE) problem over structured lattices. A signer produces a signature using their private key; a verifier checks it against the public key. Forging a signature requires solving MLWE, which resists known quantum attacks.

Three security levels:

• ML-DSA-44 — roughly equivalent to 128-bit security (recommended for most uses)
• ML-DSA-65 — roughly equivalent to 192-bit security
• ML-DSA-87 — roughly equivalent to 256-bit security

Trade-offs vs classical signatures

ML-DSA signatures are larger than ECDSA (a few KB vs 64 bytes) and public keys are larger too. Verification is fast. The main ecosystem pain point is size: certificates, handshakes, and signed artifacts all grow.

The upside: lattice signatures are simpler to implement correctly than ECC. No constant-time scalar multiplication, no curve-specific edge cases that have historically produced subtle bugs.

The hybrid debate

Early guidance recommended hybrid signatures (classical + PQ combined). crqc-timeline argues this is now counterproductive: hybrid adds 18+ composite types for interoperability, wastes implementation time, and delays pure PQ adoption. With two years of lattice deployment building confidence, the safety margin from hybrids no longer justifies the cost.