ML-DSA
Lattices · MLWE/MSIS · pq-crystals.org(opens in a new tab)
- Programmes
- FIPS 204
- Latest version
- FIPS 204 ·
- Security flags
- None on current sets
Parameter sets
FIPS 204 · 13 Aug 2024
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| ML-DSA-87 | 5 | 2,592 | 4,627 | 7,219 | 93.1 µs | 52.0 µs |
| ML-DSA-65 | 3 | 1,952 | 3,309 | 5,261 | 73.3 µs | 33.5 µs |
| ML-DSA-44 | 2 | 1,312 | 2,420 | 3,732 | 50.2 µs | 20.9 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Only one version of ML-DSA is recorded, so there is nothing to compare yet.
History
- Update
ML-DSA, MAYO and ML-KEM: we moved our builds to the latest upstream code. ML-DSA uses the pq-crystals reference at d35ba3f, with two AVX2 conformance fixes by Gregor Seiler: the stricter infinity-norm check FIPS 204 requires (issue 113) and the rounding of
use_hintwhen the low part is zero (bba9534, reported by Eric Biggers). MAYO uses MAYO-C at 412cb8a, which makes the generic echelon-form routine constant-time; our GFNI/AVX-512 build uses the AVX2 echelon-form code, which this commit does not change. ML-KEM uses mlkem-native v2.0.0. Sizes are unchanged and upstream's known-answer tests pass for every set. We re-benchmarked all three on AWS c8i.4xlarge; the timings do not change beyond run-to-run variation. - New version
FIPS 204