What is ML-DSA?

ML-DSA is the lattice-based digital signature standard that NIST published in August 2024 as FIPS 204. It was derived from CRYSTALS-Dilithium, and its signatures are much shorter than those of the hash-based standard SLH-DSA.

Also called Dilithium, CRYSTALS-Dilithium or FIPS 204.

How it signs

ML-DSA is a Schnorr-like signature with several optimizations. A holder of the private key signs a message, and anyone can check that signature with the public key. Its security rests on the Module Learning With Errors problem and on a variant of the Module Short Integer Solution problem, and the standard says it is believed to stay secure even against a large-scale fault-tolerant quantum computer.

Sizes

  • The standard defines ML-DSA-44, ML-DSA-65 and ML-DSA-87, which target NIST security categories 2, 3 and 5.
  • Public keys are 1,312, 1,952 and 2,592 bytes.
  • Signatures are 2,420, 3,309 and 4,627 bytes.

Where it comes from

NIST selected CRYSTALS-Dilithium in July 2022 as its primary signature algorithm, with FALCON for applications that need smaller signatures and SPHINCS+ as a backup built on different mathematics. FIPS 204 derives ML-DSA from CRYSTALS-Dilithium and lists the differences in its appendix D, and NIST published it in August 2024.

In Redacted

Bunker mode builds its notes, proofs and signatures with no lattices, so ML-DSA, a lattice scheme, is not one of its signatures. Nodes sign their approvals and Spending accounts sign their actions with SLH-DSA.

Bunker mode →

Related terms

ML-KEMML-KEM is the key-encapsulation standard that NIST published in August 2024 as FIPS 203. It was derived from CRYSTALS-Kyber, and its security rests on the Module Learning With Errors problem, a lattice problem that is believed to resist quantum attacks.FIPS 205FIPS 205 is the NIST standard for SLH-DSA, a digital signature scheme built on hash functions alone, published in August 2024. It sits beside FIPS 203 and FIPS 204 as one of NIST’s first three post-quantum standards.SLH-DSASLH-DSA is the hash-based signature standard NIST published as FIPS 205 on 13 August 2024. It is based on SPHINCS+, its security rests on hash functions alone, and the signer keeps no state between signatures.Hash-based signatureA hash-based signature proves that the holder of a private key approved a message, and its security rests only on a hash function. Leslie Lamport described the basic idea in 1979, and SLH-DSA, published as FIPS 205 in 2024, is a modern version.Post-quantum cryptographyPost-quantum cryptography is ordinary cryptography designed to stay secure when large quantum computers exist. It replaces the key exchanges and signatures that Shor’s algorithm breaks, such as RSA and elliptic curves, with schemes built on lattices, hash functions or error-correcting codes.

Sources: FIPS 204, Module-Lattice-Based Digital Signature Standard, NIST, 2024 · NIST announces first four quantum-resistant cryptographic algorithms, NIST, July 2022

Updated November 1, 2026. All terms