TL;DR
ECDSA (Elliptic Curve Digital Signature Algorithm) is broken by Shor's algorithm. ML-DSA (FIPS 204, Aug 13, 2024) is NIST's quantum-resistant signature standard based on the Module-Lattice-DSA construction (formerly Dilithium).
Side by Side
| Aspect | ECDSA P-256 | ML-DSA-65 |
|---|---|---|
| Public key size | 64 B | 1952 B |
| Signature size | 64-72 B | 3293 B |
| Classical security | ~128-bit | ~192-bit (cat 3) |
| Quantum-safe | No | Yes |
| Sign speed | Fast | Fast |
| Verify speed | Fast | Fast |
ML-DSA signatures are 40-50x larger than ECDSA. For most applications (code signing, document signing, TLS certificate signing) this is acceptable.
Parameter Sets
- ML-DSA-44: category 2, public key 1312 B, signature 2420 B.
- ML-DSA-65: category 3, public key 1952 B, signature 3293 B (recommended general use).
- ML-DSA-87: category 5, public key 2592 B, signature 4595 B (CNSA 2.0).
NSA CNSA 2.0 Mandate
CNSA 2.0 mandates ML-DSA-87 for US National Security Systems. New NSS by January 2027. Full migration by 2035.
Alternatives to ML-DSA
- SLH-DSA (FIPS 205): hash-based, ultra-conservative, larger signatures (7-50 KB).
- FN-DSA/Falcon (FIPS 206 draft): smaller signatures (~666-1280 B) but implementation complexity.
- LMS (NIST SP 800-208): stateful hash-based, used for code signing.
Migration Path
- Inventory ECDSA usage: code signing, TLS certificates, JWT tokens, SSH keys.
- For code signing: LMS or SLH-DSA (stateless). Transition immediately for long-lived artifacts.
- For certificates: hybrid cross-signed certificates during transition.
- For JWTs: ML-DSA-65 once PQ JWT standards mature (IETF drafts ongoing).
Frequently Asked Questions
Is Ed25519 broken too?
Yes. Ed25519 is an elliptic curve signature scheme broken by Shor's algorithm, just like ECDSA.
Are ML-DSA signatures too large?
For most applications (code signing, certificates, documents) ML-DSA signatures are acceptable. For constrained channels, FN-DSA (smaller) or SLH-DSA (different tradeoff) may fit better.
What does CNSA 2.0 require?
NSA CNSA 2.0 mandates ML-DSA-87 (security category 5) for US National Security Systems. Aligned with AES-256 symmetric strength.
Should I use ML-DSA-87 for everything?
Only if CNSA 2.0 compliance or AES-256-equivalent long-term security is required. ML-DSA-65 (category 3) is the recommended general choice and has smaller signatures.
Sources
Related Articles
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.
Try QNSQYOriginally published at quantumsequrity.com/blog/ecdsa-vs-ml-dsa.