What is ML-DSA?
ML-DSA is NIST's main post-quantum standard for digital signatures. NIST published it in August 2024 as FIPS 204. A digital signature proves who sent something and that it hasn't been changed; it sits behind certificates, software updates, signed documents and signed payment messages. ML-DSA does that job in place of RSA and elliptic-curve signatures, and it's designed to resist attacks by quantum computers. It runs on ordinary computers. The main practical cost is size.
What the name means
ML stands for module lattice, the same family of mathematical problems behind ML-KEM. DSA stands for digital signature algorithm. ML-DSA was developed from CRYSTALS-Dilithium, which came through NIST's open international competition. The standardised version has small changes from the competition entry, so results from tests of Dilithium don't automatically carry over.
How it compares with today's signatures
| RSA-2048 | ML-DSA-65 | |
|---|---|---|
| Public key size | 256 bytes | 1,952 bytes |
| Signature size | 256 bytes | 3,309 bytes |
| Speed | Signing is relatively slow | Fast to sign and verify |
| Resists a quantum computer | No: broken by Shor's algorithm | Designed to |
FIPS 204 defines three parameter sets: ML-DSA-44, ML-DSA-65 and ML-DSA-87, trading size for security margin. US national security systems are directed to use ML-DSA-87 under CNSA 2.0.
Why signatures need a different plan
A quantum computer couldn't go back and forge a signature on a payment that has already settled, so signatures aren't exposed to harvest now, decrypt later the way encryption is. But once a capable machine exists, new signatures could be forged. Signing keys sit in certificate chains, hardware and devices that take years to replace, so the work has to start well before then.
Size is the real cost. Certificates, message headers, card chips and protocols built around small signatures need testing before ML-DSA can replace RSA or elliptic curves inside them.
Common confusions
- "ML-DSA encrypts data." No. It signs. Agreeing on keys is ML-KEM's job, and bulk encryption stays with AES.
- "Dilithium and ML-DSA are the same." Close, but not identical. Implementations should target FIPS 204.
- "Bigger means slower." Not here. ML-DSA is fast; the cost is the extra bytes.
- "It's the only option." NIST also standardised SLH-DSA and is standardising FN-DSA, each with different trade-offs.
Sources and further reading
Tags show what kind of source each one is (how sources are used). Checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.
- StandardFIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA)NIST, 2024
- StandardNIST releases first 3 finalized post-quantum encryption standardsNIST, 2024
- Government guidanceAnnouncing the Commercial National Security Algorithm Suite 2.0 (advisory, updated 2025)US National Security Agency, 2025
- ExperimentProject Leap phase 2: quantum-proofing payment systemsBIS Innovation Hub, 2025