ML-DSA

ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is the NIST-standardized post-quantum signature scheme defined in FIPS 204, derived from CRYSTALS-Dilithium. Its security rests on lattice problems believed hard for both classical and quantum computers. At security category 3 (ML-DSA-65), signatures are 3,309 bytes, larger than classical signatures but fast to produce and verify.

The size is the engineering consequence worth planning for. At 3,309 bytes a signature does not fit where a 64-byte ECDSA signature did, so formats that inlined signatures, HTTP headers, QR codes and embedded metadata need re-sizing rather than re-encoding.

Verification cost is modest, which makes ML-DSA practical for artifacts that are signed once and checked many times, such as credentials and audit evidence.

The parameter sets exist so implementers can trade size against margin, and the choice is worth making explicitly rather than accepting a library default. Higher security categories produce larger signatures and keys, which lands directly on whatever format carries them, so the decision is as much a systems decision as a cryptographic one.

Verification being cheap relative to size is what makes the scheme practical for evidence rather than for chatty protocols. An artifact signed once and checked many times over years, a credential, an audit record, an attestation, pays the size cost once at rest and gets fast verification at every check.

Implementation quality is the part that does not show up in a specification comparison. Lattice schemes have their own side-channel considerations, and correctness of a signature does not demonstrate constant-time behaviour, which is why the implementation and its version deserve to be pinned and reviewed as deliberately as the algorithm choice.

Pinning the implementation to an exact version, and treating a change to it as a change to the signing path rather than a routine dependency bump, is the discipline that keeps the guarantee reviewable over time.

Deployed alongside a classical scheme, it forms the post-quantum half of the hybrid signatures used during migration.