Post-quantumRecommended
ML-DSA (FIPS 204)
Post-quantum digital signatures
How it works
ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is derived from CRYSTALS-Dilithium. It signs and verifies like RSA or ECDSA but relies on lattice problems believed to resist quantum attack. NIST positions it as the general-purpose post-quantum signature.
Sizes: Parameter sets ML-DSA-44, ML-DSA-65 and ML-DSA-87
Status: Finalised by NIST in August 2024 as the primary post-quantum signature.
Strengths
- Quantum-resistant signatures with fast signing and verification
- General purpose: certificates, code signing, authentication
Weaknesses and known attacks
- Public keys and signatures are much larger than ECDSA or Ed25519
- Newer, with less deployment experience
Use it for
- Signatures that must remain trustworthy after large quantum computers exist
- Long-lived roots of trust such as firmware signing
Don't use it for
- Key exchange (use ML-KEM)
Exam tip
FIPS 204 = ML-DSA = Dilithium, lattice-based signatures. FIPS 205 = SLH-DSA = SPHINCS+, hash-based signatures.