FIPS 204 — ML-DSA

FIPS 204 specifies the Module-Lattice-Based Digital Signature Algorithm (ML-DSA), the primary post-quantum signature standard. Derived from CRYSTALS-Dilithium, it was finalized by NIST on 13 August 2024 and is the recommended general-purpose replacement for RSA and ECDSA signatures.

What ML-DSA does

A digital signature proves that a message originated from the holder of a private key and was not altered. ML-DSA generates a keypair, signs messages, and verifies signatures. It is one of the primary and most general-purpose PQC signature candidates today, usable for code signing, document signing, certificate issuance, and authentication handshakes; the actual default algorithm still depends on the protocol, compliance requirements, and implementation support.

Parameter sets and sizes

Three parameter sets target NIST security categories 2, 3, and 5. ML-DSA-65 is a strong general-purpose default. Approximate sizes in bytes:

Parameter set	NIST level	Public key	Private key	Signature
ML-DSA-44	2	1312	2560	2420
ML-DSA-65	3	1952	4032	3309
ML-DSA-87	5	2592	4896	4627

Compared with SLH-DSA, ML-DSA signatures are an order of magnitude smaller and signing/verification are far faster — which is why it is the recommended default unless you need SLH-DSA's hash-only conservatism.

How it works: Fiat-Shamir with Aborts

ML-DSA security rests on two lattice problems — Module-LWE and Module-SIS (Short Integer Solution). It is a Fiat-Shamir signature: an interactive identification protocol is made non-interactive by deriving the challenge from a hash of the commitment and message.

The twist is rejection sampling ("with aborts"). A naive Fiat-Shamir lattice signature would leak the secret key through the distribution of signatures. ML-DSA instead samples a candidate signature and, if it falls outside a safe bounded region, discards it and retries with fresh randomness. This makes the output distribution independent of the secret. As a result, signing takes a variable (but bounded) number of iterations.

Deterministic vs hedged signing

FIPS 204 defines two ways to generate the per-signature randomness:

Mode	Randomness source	Property
Deterministic	Derived from the message and key only	Reproducible; no RNG needed at signing time
Hedged	Mixes a fresh random value with message + key	Protects against poor RNGs and certain fault/side-channel attacks

In practice, a randomized (hedged) signing approach is generally recommended to improve robustness against fault and side-channel scenarios.

Warning

Because signing involves rejection-sampling loops and bound checks, naive implementations can leak timing information about the secret. Use a constant-time, audited implementation, and prefer hedged signing on platforms exposed to physical attackers.

Code sketch

import oqs

# Key generation and signing
with oqs.Signature("ML-DSA-65") as signer:
    public_key = signer.generate_keypair()       # 1952-byte pk
    message = b"firmware-image-v2.1"
    signature = signer.sign(message)             # ~3309-byte sig

# Verification (anyone with the public key)
with oqs.Signature("ML-DSA-65") as verifier:
    ok = verifier.verify(message, signature, public_key)
    assert ok

Note

ML-DSA supports both pure signing and a "pre-hash" variant (e.g., signing a SHA-512 digest) for large or streamed messages. Pick the variant your protocol mandates and keep the domain separation context consistent between signer and verifier.

ML-DSA deep dive →

Algorithm internals and parameters.

Signatures explained →

Digital signature fundamentals.

FIPS 205 — SLH-DSA →

The conservative alternative.

Standards & references

FIPS 204 (ML-DSA) — the authoritative standard specified on this page.
NIST PQC project — program background and related publications.
Open Quantum Safe — liboqs implementations and interoperability tooling.
Resources — full standards register

FIPS 204 ML-DSA

FIPS 204 规范了基于模格的数字签名算法 ML-DSA，这是首要的后量子签名标准。该标准源自 CRYSTALS-Dilithium，由 NIST 于 2024 年 8 月 13 日正式发布，是 RSA 与 ECDSA 签名的推荐通用替代方案。

ML-DSA 的作用

数字签名证明消息确实来自私钥持有者，且未被篡改。ML-DSA 负责生成密钥对、对消息签名并验证签名。它是当前最主要、最通用的 PQC 签名候选之一，可用于代码签名、文档签名、证书签发与认证握手等场景；具体默认算法仍取决于协议、合规要求和实现支持。

参数集与尺寸

三个参数集分别对应 NIST 安全类别 2、3、5。ML-DSA-65 是稳健的通用默认值。下表为近似尺寸，单位为字节：

参数集	NIST 等级	公钥	私钥	签名
ML-DSA-44	2	1312	2560	2420
ML-DSA-65	3	1952	4032	3309
ML-DSA-87	5	2592	4896	4627

与 SLH-DSA 相比，ML-DSA 的签名小一个数量级，签名与验证也快得多，这正是它成为推荐默认值的原因——除非你确实需要 SLH-DSA 仅依赖哈希的保守性。

工作原理带中止的 Fiat-Shamir

ML-DSA 的安全性建立在两个格问题之上：模 LWE 与模 SIS（短整数解）。它属于 Fiat-Shamir 签名，通过从承诺与消息的哈希中导出挑战，将交互式身份识别协议转为非交互式。

其精妙之处在于拒绝采样，即带中止。朴素的 Fiat-Shamir 格签名会通过签名分布泄露私钥；ML-DSA 改为采样候选签名，若其落在安全有界区域之外便丢弃，并以新的随机性重试，从而使输出分布与私钥无关。因此，签名所需的迭代次数可变但有界。

确定性签名与加盐签名

FIPS 204 定义了两种生成单次签名随机性的方式：

模式	随机性来源	特性
确定性	仅由消息与密钥派生	可复现签名时无需 RNG
加盐	将新随机值与消息加密钥混合	抵御劣质 RNG 及某些故障与侧信道攻击

实践中通常推荐使用带随机性的签名生成方式，以增加对故障和侧信道场景的稳健性。

警告

由于签名涉及拒绝采样循环与边界检查，朴素实现可能泄露与私钥相关的时序信息。请使用经过审计的常时实现，并在面临物理攻击者的平台上优先采用加盐签名。

代码示例

import oqs

# 密钥生成与签名
with oqs.Signature("ML-DSA-65") as signer:
    public_key = signer.generate_keypair()       # 1952 字节 pk
    message = b"firmware-image-v2.1"
    signature = signer.sign(message)             # 约 3309 字节签名

# 验证 任何持有公钥者皆可
with oqs.Signature("ML-DSA-65") as verifier:
    ok = verifier.verify(message, signature, public_key)
    assert ok

注意

ML-DSA 同时支持纯签名与预哈希变体（例如对 SHA-512 摘要签名），以应对大消息或流式消息。请选用协议规定的变体，并在签名方与验证方之间保持域分隔上下文一致。

标准与参考

FIPS 204 ML-DSA — 本页所述的权威标准。
NIST PQC 项目 — 项目背景与相关出版物。
Open Quantum Safe — liboqs 实现与互操作工具。
资源链接 — 完整标准登记册

Previous上一页← FIPS 203 · ML-KEMFIPS 203 ML-KEM Next下一页FIPS 205 · SLH-DSAFIPS 205 SLH-DSA →