# What Is ML-DSA? Definition and Examples

> ML-DSA is the lattice-based post-quantum digital signature algorithm standardized by NIST in FIPS 204 (August 2024), derived from CRYSTALS-Dilithium.

Source: https://ssl.sh/glossary/ml-dsa/
Last updated: 2026-11-10

ML-DSA is a [digital signature](https://ssl.sh/glossary/digital-signature/) scheme whose security rests on module lattice problems, standardized by NIST in FIPS 204. It defines three parameter sets, ML-DSA-44, ML-DSA-65 and ML-DSA-87, in increasing order of strength. NIST also standardized a hash-based alternative, SLH-DSA, in FIPS 205, with smaller public keys but larger and slower signatures.

## Why it matters
To authenticate TLS connections against a future quantum attacker, certificate and handshake signatures must eventually move away from [RSA](https://ssl.sh/glossary/rsa/) and [ECDSA](https://ssl.sh/glossary/ecdsa/). The obstacle is size. An ML-DSA-44 signature is 2,420 bytes, compared with about 64 bytes for an ECDSA P-256 signature, and a typical handshake carries several signatures and public keys: the leaf key, the signatures on the leaf and intermediate certificates, the CertificateVerify signature and embedded SCTs. Replacing all of them with ML-DSA adds many kilobytes to each handshake. Because authentication cannot be broken retroactively, this migration is less urgent than post-quantum key exchange with [ML-KEM](https://ssl.sh/glossary/ml-kem/).

## Example
Sizes in FIPS 204, and key generation with OpenSSL 3.5 or later:

```text
Parameter set   Public key     Signature
ML-DSA-44       1,312 bytes    2,420 bytes
ML-DSA-65       1,952 bytes    3,309 bytes
ML-DSA-87       2,592 bytes    4,627 bytes
```

```bash
openssl genpkey -algorithm ML-DSA-65 -out mldsa65.key
openssl pkey -in mldsa65.key -pubout -out mldsa65.pub
```

## Common misconceptions
- **"Post-quantum certificates must come before post-quantum key exchange."** The order is the reverse: recorded traffic can be decrypted later, but a signature only needs to resist forgery at the time it is verified.
- **"ML-DSA is a drop-in replacement for ECDSA."** Its keys and signatures are tens of times larger, which affects handshakes, CT logs and hardware security modules.
- **"ML-DSA and ML-KEM do the same job."** ML-DSA signs; ML-KEM establishes shared keys.

## Related terms

- [后量子密码](https://ssl.sh/zh/glossary/post-quantum-cryptography/): 后量子密码（PQC）是专为抵御大规模量子计算机攻击而设计的公钥密码算法，用来替代可能被量子计算机破解的 RSA 和 ECC。
- [数字签名](https://ssl.sh/zh/glossary/digital-signature/): 数字签名是用私钥对消息计算出的一个值，任何持有对应公钥的人都能验证它，从而确认消息来源和内容未被篡改。
- [ML-KEM](https://ssl.sh/zh/glossary/ml-kem/): ML-KEM 是 NIST 于 2024 年 8 月在 FIPS 203 中标准化的后量子密钥封装机制，源自 CRYSTALS-Kyber，用于抗量子的密钥建立。
- [ECDSA](https://ssl.sh/zh/glossary/ecdsa/): ECDSA 是基于椭圆曲线的数字签名算法，在 TLS 证书中作为 RSA 的替代方案，密钥和签名更小、签名运算更快。
- [Ed25519](https://ssl.sh/zh/glossary/ed25519/): Ed25519 是在 Curve25519 爱德华兹形式上实现的 EdDSA 签名方案，由 RFC 8032 定义，公钥 32 字节，签名 64 字节且为确定性签名。
- [RSA](https://ssl.sh/zh/glossary/rsa/): RSA 是 1977 年提出的公钥算法，TLS 用它对证书和握手进行签名，在 TLS 1.3 之前还用它传输会话密钥。