The author criticizes ML-DSA's hash function design, specifically the practice of hashing the public key first (µ), which complicates verification when the signer's identity is embedded in the message body. The post highlights a tension between signing practices that prevent replay attacks and the practical challenges of verifying signatures without first reading the entire message.
Background
ML-DSA (Module-Lattice-based Digital Signature Algorithm) is a NIST-standardized post-quantum signature scheme. The article discusses a subtle design concern in its domain separation and hashing approach that impacts real-world protocol implementation.
- Source
- Lobsters
- Published
- Oct 14, 2026 at 06:01 AM
- Score
- 6.0 / 10