How ML-DSA works
Like any signature scheme, ML-DSA has three steps.1
- Key generation: the signer makes a private key they keep and a public key they share.
- Signing: the private key turns a message into a signature.
- Verification: anyone with the public key can check the signature matches the message. Change a single bit and the check fails.
Its security rests on lattice problems called Module Learning With Errors and a variant of Module Short Integer Solution.1 No known algorithm, classical or quantum, solves them efficiently at these sizes. RSA and ECDSA signatures rest on factoring and discrete logarithms, which a large quantum computer running Shor’s algorithm could solve. By default ML-DSA mixes fresh randomness into every signature, which FIPS 204 calls hedged signing, and the standard also allows a deterministic variant.1
| Parameter set | NIST category | Public key | Signature |
|---|---|---|---|
| ML-DSA-44 | 2 | 1,312 bytes | 2,420 bytes |
| ML-DSA-65 | 3 | 1,952 bytes | 3,309 bytes |
| ML-DSA-87 | 5 | 2,592 bytes | 4,627 bytes |
The numbers in each name are the dimensions of the matrix at the heart of the scheme, not a security level.1 The price of quantum resistance is size: keys and signatures are tens of times larger than elliptic-curve ones, while signing and checking stay fast.
ML-DSA and ML-KEM
The two NIST lattice standards do different jobs. ML-KEM, in FIPS 203, lets two sides agree on a secret key, which keeps data private. ML-DSA, in FIPS 204, proves who is on the other end and that nothing was altered, which keeps data authentic. A secure connection needs both: a private channel is little use if you can’t tell who you are talking to.
Why ML-DSA matters
Signatures protect software updates, website certificates, signed documents and server logins. Anything that trusts an RSA or elliptic-curve signature could be fooled by forged ones once a large quantum computer exists. NIST’s draft transition plan proposes deprecating the weaker RSA and elliptic-curve signature sizes after 2030 and disallowing both after 2035, with ML-DSA as one of the replacements.2 Keys that must stay trusted for years, such as certificate authority roots and firmware signing keys, are the ones to move early.
Where you’ll see ML-DSA
- Certificates. RFC 9881 defines how ML-DSA keys and signatures go into X.509 certificates, the format behind HTTPS.3
- Signed messages. RFC 9882 adds ML-DSA to the Cryptographic Message Syntax, the signing format used by S/MIME email.4
- Crypto libraries. OpenSSL 3.5, released in April 2025, added ML-DSA alongside ML-KEM and SLH-DSA.5
ML-DSA in Secria
Secria VPN servers prove who they are with ML-DSA-65 from FIPS 204, for post-quantum server authentication. The app talks to our servers over hybrid post-quantum TLS, each connection gets a fresh key sealed with ML-KEM-1024 and mixed into WireGuard, and releases are signed with SLH-DSA.
Related terms
Sources
- NIST, FIPS 204: Module-Lattice-Based Digital Signature Standard (August 2024).
- NIST, IR 8547 (initial public draft): Transition to Post-Quantum Cryptography Standards (November 2024).
- IETF, RFC 9881: Algorithm Identifiers for the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) (October 2025).
- IETF, RFC 9882: Use of the ML-DSA Signature Algorithm in the Cryptographic Message Syntax (CMS) (October 2025).
- OpenSSL, Release notes for OpenSSL 3.5 (April 2025).
Checked October 2026. Secria facts are from our Mail and VPN pages and the whitepaper.
Questions about ML-DSA
Is ML-DSA the same as Dilithium?
Almost. ML-DSA is the standardized version of CRYSTALS-Dilithium. NIST made some changes while standardizing it, listed in an appendix of FIPS 204, so the two aren’t interchangeable byte for byte, but the design is the same.
What is ML-DSA used for?
Proving that data came from a particular signer and wasn’t changed. Typical uses are certificates for websites and servers, software and firmware updates, and signed documents and email.
What is the difference between ML-DSA-44, ML-DSA-65 and ML-DSA-87?
Security margin and size. ML-DSA-44 targets NIST category 2, ML-DSA-65 category 3 and ML-DSA-87 category 5, the highest. Each step up makes keys and signatures larger.
What is the difference between ML-DSA and SLH-DSA?
Both are NIST post-quantum signature standards. ML-DSA, in FIPS 204, is built on lattices and has smaller, faster signatures. SLH-DSA, in FIPS 205, relies only on hash functions, a very conservative assumption, at the cost of larger signatures.