NIST finalized FIPS 204 in August 2024, defining ML-DSA (Module-Lattice-Based Digital Signature Algorithm) as the post-quantum signature standard. If you are building systems that need long-lived audit integrity, the algorithm you choose today determines whether those records are still verifiable in 2040.
From Dilithium to ML-DSA
- 2017: NIST launches the post-quantum standardization process.
- 2022: CRYSTALS-Dilithium selected for standardization.
- August 2024: FIPS 204 published. Dilithium becomes ML-DSA.
Three parameter sets: ML-DSA-44 (Level 2), ML-DSA-65 (Level 3, recommended for most applications), ML-DSA-87 (Level 5, national security).
How it works
Classical algorithms (RSA, ECDSA) rely on factoring or discrete logarithms, problems Shor's algorithm solves on a quantum computer. ML-DSA uses the Module Learning With Errors problem, based on finding hidden structure in high-dimensional lattices. No efficient quantum algorithm exists for this.
The signing flow: generate key pair, sign message using private key with rejection sampling (discarding candidates that leak key information), verify with public key. Verification is fast and deterministic.
Key and signature sizes
| Parameter Set | Public Key | Signature | Private Key |
|---|---|---|---|
| ML-DSA-44 | 1,312 bytes | 2,420 bytes | 2,560 bytes |
| ML-DSA-65 | 1,952 bytes | 3,309 bytes | 4,032 bytes |
| ML-DSA-87 | 2,592 bytes | 4,627 bytes | 4,896 bytes |
ML-DSA-65 signatures are ~50x larger than ECDSA. For TLS handshakes, this matters. For audit records in a database, a million signed actions add about 3.2 GB, a rounding error in any modern storage budget.
Why ML-DSA for AI agent actions
Long-lived records: Regulatory retention requirements (DORA: 5 years, EU AI Act: system lifetime plus a reasonable period) mean records may need to remain verifiable for a decade or more. CNSA 2.0 requires post-quantum signatures by 2035.
Harvest now, forge later: An adversary who records signed audit records today could forge them once quantum computers arrive. ML-DSA mitigates this attack vector.
Per-agent identity: Each agent gets its own ML-DSA key pair. The public key is the agent's verifiable identity, bound to both the agent and the specific action payload.
The CNSA 2.0 timeline
- By 2025: Software signing must use post-quantum algorithms (already passed).
- By 2030: Web, cloud, and networking must support post-quantum.
- By 2035: Full transition to quantum-resistant algorithms.
Organizations that adopt ML-DSA now avoid a costly migration later. The Open Quantum Safe project provides open-source implementations for testing and validation. Asqav uses ML-DSA-65 for every agent action signature. Explore our documentation or see how we align with CNSA 2.0.