DigiCert
digicert.com › insights › post-quantum-cryptography › mldsa
ML-DSA | Post-Quantum Cryptography | DigiCert Insights
ML-DSA is considered a general-purpose digital signature scheme meant to replace RSA- and ECC-based digital signatures. Its performance is already on par with previous schemes and should only improve going forward.
Open Quantum Safe
openquantumsafe.org › liboqs › algorithms › sig › ml-dsa.html
ML-DSA | Open Quantum Safe
Open-source software for prototyping quantum-resistant cryptography
05:57
DSA vs. AI/ML: Which Tech Career Path Should You Choose🧐? ...
08:44
Data Science vs Machine Learning Engineer: Explained - YouTube
01:13:20
Machine Learning vs. DSA: In-Depth Insight | iNeuron - YouTube
07:28
Stateless PQC Digital Signatures: Insights into ML-DSA & SLH-DSA ...
29:27
The impact of ML-KEM and ML-DSA on mTLS connection Time-to-Last-Byte ...
Get Used to Three Boring Acronyms: ML-KEM, ML-DSA and ...
Encryption Consulting
encryptionconsulting.com › home › post quantum cryptography › ml-dsa and pq signing: what you need to know
ML-DSA and PQ Signing: What You Need to Know | Encryption Consulting
January 27, 2026 - It’s a digital signature method designed to stand up against quantum computers, which are expected to break most traditional cryptography in the near future. ML-DSA is built on lattice-based math, specifically, something called module lattices, ...
IBM
ibm.com › docs › en › zos › 3.1.0
ML-DSA, CRYSTALS-Dilithium Digital Signature Algorithm
Get assistance for the IBM products, services and software you own · Provides fixes and updates for your system's software, hardware, and operating system
RFC Editor
rfc-editor.org › info › rfc9882
RFC 9882: Use of the ML-DSA Signature Algorithm in the Cryptographic Message Syntax (CMS) | RFC Editor
October 29, 2025 - The Module-Lattice-Based Digital ... in FIPS 204, is a post-quantum digital signature scheme that aims to be secure against an adversary in possession of a Cryptographically Relevant Quantum Computer (CRQC)....
NIST CSRC
csrc.nist.gov › pubs › fips › 204 › final
Federal Information Processing Standard (FIPS) 204, Module-Lattice-Based Digital Signature Standard
August 13, 2024 - This is known as non-repudiation since the signatory cannot easily repudiate the signature at a later time. This standard specifies ML-DSA, a set of algorithms that can be used to generate and verify digital signatures. ML-DSA is believed to be secure, even against adversaries in possession ...
wolfSSL
wolfssl.com › ml-kem-versus-ml-dsa
ML-KEM Versus ML-DSA - wolfSSL
July 18, 2025 - In summary, ML-KEM and ML-DSA serve different purposes in cryptography, with ML-KEM focused on secure key transport and ML-DSA focused on digital signatures and authentication, but both protecting against a CRQC (Cryptographically Relevant Quantum Computer).
Cloudflare
blog.cloudflare.com › ml-dsa-will-have-to-do
Why we cannot wait for better post-quantum signature algorithms | Cloudflare Blog
2 weeks ago - We are · targeting 2029 for Cloudflare to be fully post-quantum secure. ML-DSA, the best all-around post-quantum signature scheme standardized today, has its downsides: it’s much larger on the wire, and many
IETF
ietf.org › archive › id › draft-connolly-cfrg-ml-dsa-security-considerations-02.html
Security Considerations for ML-DSA
March 19, 2026 - ML-DSA is a digital signature scheme, where a signer generates a key pair consisting of a private signing key and a public verifying key. The signer uses the signing key to produce a signature on a message, and anyone with the verifying key can verify that the signature is valid for that message.
NIST
nvlpubs.nist.gov › nistpubs › fips › nist.fips.204.pdf pdf
FIPS 204 Federal Information Processing Standards Publication
August 13, 2024 - Standards and Technology (NIST) under 15 U.S.C. 278g-3 and issued by the Secretary of Commerce under ... 3. Explanation. This standard specifies ML-DSA, a lattice-based digital signature algorithm for applications
Kivicore
kivicore.com › en › embedded-security-blog › ml-dsa-explained-quantum-safe-digital-signatures-for-secure-embedded-systems
ML-DSA explained: Quantum-Safe digital Signatures for secure embedded Systems
October 31, 2025 - As quantum computers are expected ... art and therefore mandatory. ML-DSA provides quantum-resistant digital signatures based on the difficulty of finding short vectors in module lattices....
AWS
docs.aws.amazon.com › aws kms › developer guide › aws kms concepts › aws kms keys › ml-dsa keys in aws kms
ML-DSA keys in AWS KMS - AWS Key Management Service
For larger messages, you must ... used in ML-DSA signing as defined in NIST FIPS 204 section 6.2. Use the EXTERNAL_MU message type in the AWS KMS Sign operation to specify this pre-processed 64-byte message. The signatures produced by the externally computed μ are the same as the RAW ones when using the same message and private key. Note that this signing is different ...
Chelpis
chelpis.com › post › nist-publishes-new-standards-for-quantum-safe-encryption-and-digital-signatures-ml-kem-ml-dsa-slh
NIST publishes new standards for quantum-safe encryption and digital signatures: ML-KEM, ML-DSA, SLH-DSA to replace current standards
August 16, 2024 - Nonetheless, ML-KEM's computational efficiency is designed to be competitive, often outperforming elliptic-curve cryptography. ML-DSA, or Module-Lattice digital signature algorithm, is the new standard for digital signatures.
Medium
aws.plainenglish.io › advanced-post-quantum-implementation-uncovering-critical-blind-spots-in-aws-ml-dsa-deployment-d165dce9287f
Advanced Post-Quantum Implementation: Uncovering Critical Blind Spots in AWS ML-DSA Deployment | by ViraSecurity | AWS in Plain English
September 18, 2025 - The quantum cryptography landscape shifted dramatically in June 2025 when AWS introduced ML-DSA support in AWS KMS, but critical implementation blind spots remain hidden beneath the surface. Security engineers focus heavily on TLS migrations while overlooking the fundamental KEM/DEM paradigm confusion that plagues production deployments.
Globalplatform
globalplatform.org › wp-content › uploads › 2025 › 01 › 4_ML-DSA-and-ML-KEM-Landmines-1.pdf pdf
4_ML-DSA-and-ML-KEM-Landmines-1.pdf
December 4, 2024 - SLH-DSA (FIPS 205) signature APIs accept a “context string”: Sign(sk, M, ctx) • The benefit here is that, for example, S/MIME email and signed PDF use the same message · structure, so a client might be tricked into confusing them. • A well-chosen ctx hard-coded into both signer and verifier strongly prevents · this by failing the signature. ML-DSA Context (ctx) ctx=“smime-v4” ·
Medium
medium.com › @kcl17 › ml-dsa-fips-204-dd151ace3493
FIPS 204. In our previous exploration of ML-KEM… | by kcl17 | Medium
December 25, 2025 - Formerly known as CRYSTALS-Dilithium, this algorithm is now the primary workhorse for verifying digital identity in the post-quantum era. While RSA relies on the difficulty of factoring large numbers (N=p×q), ML-DSA relies on the hardness of finding short vectors in high-dimensional lattices.
Reddit
reddit.com › r/cryptography › what are proper use cases for the context string in ml-dsa-87 (fips 204)?
r/cryptography on Reddit: What are proper use cases for the context string in ML-DSA-87 (FIPS 204)?
February 4, 2025 -
First of all, sorry for posing a more practical question, if this is the wrong sub please direct me to another one. The FIPS 204 document mentions that applications may use the context string or leave it empty. But what are the proper use cases for this string and are there any caveats for using it (except that it needs to be up to 255 bytes)? Can using a non-empty string create incompatibilities?
I wasn't following the development of ML-DSA and the NIST process so I'm a bit unsure about the proper use/purpose of context in this signature scheme.
Top answer 1 of 2
5
If you track down where ctx is used, it essentially leads to domain separation of the used hash function, and thus it allows for domain separation of the signatures, preventing the use of signatures from one context within other contexts.
2 of 2
3
Like the other person said, domain separation. It prevents things like many oracle attacks / replay attacks by requiring that every distinct use enforces a different context value both when signing and when validating. The context string is defined by the protocol that is using the algorithm, it's often a protocol defined salt plus additional values tied to the session and/or specific function / protocol step, or similar. "incompatibility" when the other part doesn't understand the context string is intentional. When such strings are used it's because you're expecting every client to know how they're defined and enforce them in the same way.
Thalesdocs
thalesdocs.com › gphsm › luna › 7 › docs › network › Content › sdk › extensions › pqc › ML-DSA_programming_guide.htm
ML-DSA Programming Guide for Luna HSM
July 10, 2026 - ML-DSA services are exposed through mechanisms, objects and attributes of the Cryptoki interface. Two Signing algorithms are described in SP 800-204 that differ depending on whether the message M being signed is the hash of a message (PreHash) or the message itself (Pure).
Encryption Consulting
encryptionconsulting.com › home › post quantum cryptography › how ml-dsa replaces ecc and rsa for digital signatures
How ML-DSA Replaces ECC and RSA for Digital Signatures | Encryption Consulting
January 27, 2026 - ML-DSA (Module Lattice–based Digital Signature Algorithm) is a post-quantum digital signature scheme derived from the CRYSTALS-Dilithium project. It relies on the hardness of lattice-based problems, specifically Module-LWE (Learning With Errors) ...
Reddit
reddit.com › r/cryptography › are the new pqc algorithms (ml-kem, ml-dsa, and slh-dsa) meant to just replace older asymmetric algos like rsa?
r/cryptography on Reddit: Are the new PQC algorithms (ML-KEM, ML-DSA, and SLH-DSA) meant to just replace older asymmetric algos like RSA?
May 20, 2025 -
So, the data encryption of larger chunks of data (not keys) are still expected to be encrypted with symmetric algos like AES? Because AES is still expected to be resistant to QC attacks, but things like RSA are not, so the new algos just replace the asymmetric part? Just like you wouldn't usually directly encrypt data like a file with RSA, you won't use the new PQC algos to encrypt a file, but use them to exchange/protect keys?
Top answer 1 of 4
14
The KEM in ML-KEM stands for "key-encapsulation mechanism". So yes. The other two are about signatures.
2 of 4
4
Yes and no: yes, the new PQC algorithms are meant to replace other (Classic) asymmetric ones (RSA,ECC, etc.); no, because the interfaces to PQC algorithms (specifically, for Key Exchange) differ from their Classic counterparts - as one commenter above pointed out, ML-KEM is a Key Encapsulation Mechanism, with a different semantics. I think signatures are suitable for direct swapping, feel free to correct me if I’m wrong.