filippo.io/mldsa@v1.0.0 is now updated to the Go 1.27 implementation and API.
It's also now a transparent wrapper on Go 1.27+ using type aliases, so the same program can use it alongside crypto/mldsa without issues.
Essentially, it's a drop-in compatibility replacement for crypto/mldsa.
It's also now a transparent wrapper on Go 1.27+ using type aliases, so the same program can use it alongside crypto/mldsa without issues.
Essentially, it's a drop-in compatibility replacement for crypto/mldsa.
September 24, 2026 at 11:45 AM
filippo.io/mldsa@v1.0.0 is now updated to the Go 1.27 implementation and API.
It's also now a transparent wrapper on Go 1.27+ using type aliases, so the same program can use it alongside crypto/mldsa without issues.
Essentially, it's a drop-in compatibility replacement for crypto/mldsa.
It's also now a transparent wrapper on Go 1.27+ using type aliases, so the same program can use it alongside crypto/mldsa without issues.
Essentially, it's a drop-in compatibility replacement for crypto/mldsa.
Alright, here we go, crypto/mldsa API proposal with external μ, deterministic signatures, signature context, and pure seed encoding.
github.com/golang/go/is...
github.com/golang/go/is...
proposal: crypto/mldsa: new package · Issue #77626 · golang/go
Go 1.26 added an internal implementation of the ML-DSA post-quantum signature algorithm, specified in FIPS 204. I propose we expose a public crypto/mldsa in Go 1.27 with the following API.
github.com
February 15, 2026 at 1:26 PM
Alright, here we go, crypto/mldsa API proposal with external μ, deterministic signatures, signature context, and pure seed encoding.
github.com/golang/go/is...
github.com/golang/go/is...
September 25, 2026 at 1:21 AM
Thank you!
mldsa: remove runtime dependency on typing_extensions · FiloSottile/mldsa-py@d18c1a7
github.com
July 26, 2026 at 12:45 PM
Thank you!
It's not my usual beat, but I wrote a pure-Python ML-DSA verifier.
pip install mldsa
It's 350 lines, CC0/0BSD, single-file, no dependencies, and thoroughly tested.
Signature verification handles no secrets, so it doesn't need to be constant-time.
pip install mldsa
It's 350 lines, CC0/0BSD, single-file, no dependencies, and thoroughly tested.
Signature verification handles no secrets, so it doesn't need to be constant-time.
Production ML-DSA Verification in 350 Lines of Python
I am publishing a production, pure-Python ML-DSA verifier. It's just 350 lines, and pretty readable and robust.
words.filippo.io
July 26, 2026 at 11:50 AM
It's not my usual beat, but I wrote a pure-Python ML-DSA verifier.
pip install mldsa
It's 350 lines, CC0/0BSD, single-file, no dependencies, and thoroughly tested.
Signature verification handles no secrets, so it doesn't need to be constant-time.
pip install mldsa
It's 350 lines, CC0/0BSD, single-file, no dependencies, and thoroughly tested.
Signature verification handles no secrets, so it doesn't need to be constant-time.
Wait until you find the mldsa package!
March 29, 2026 at 7:21 PM
Wait until you find the mldsa package!
mlkem and mldsa are very fast period
September 26, 2025 at 7:09 PM
mlkem and mldsa are very fast period
Can you see how to use a test vector that provides (seed, public key, message, µ, signature) to test a deterministic signing API that does (seed, message) → (signature) or a key generation API that does (seed) → (public key)?
Cryptographer D. J. Bernstein can't, certainly in good faith.
*sigh*
Cryptographer D. J. Bernstein can't, certainly in good faith.
*sigh*
[TLS] Re: [Last-Call] Last Call: <draft-ietf-tls-mldsa-03.txt> (Use of ML-DSA in TLS 1.3) to Informational RFC
Search IETF mail list archives
mailarchive.ietf.org
June 2, 2026 at 5:46 PM
Can you see how to use a test vector that provides (seed, public key, message, µ, signature) to test a deterministic signing API that does (seed, message) → (signature) or a key generation API that does (seed) → (public key)?
Cryptographer D. J. Bernstein can't, certainly in good faith.
*sigh*
Cryptographer D. J. Bernstein can't, certainly in good faith.
*sigh*
@bnewbold.net: "IMHO adding a post-quantum option is the top priority. I'm open to removing secp256k1 in theory, but would not prioritize the effort needed over adding MLDSA (or whatever)"
July 23, 2026 at 3:20 PM
@bnewbold.net: "IMHO adding a post-quantum option is the top priority. I'm open to removing secp256k1 in theory, but would not prioritize the effort needed over adding MLDSA (or whatever)"
Fully offline wasm based post quantum signatures in mobile browser 💫
#golang #wasm #postquantum #mldsa
#golang #wasm #postquantum #mldsa
September 19, 2025 at 4:18 AM
Fully offline wasm based post quantum signatures in mobile browser 💫
#golang #wasm #postquantum #mldsa
#golang #wasm #postquantum #mldsa
Nice! Now (to steal Luca's joke) it's only 11 more factors of 2 to go for SQISign to be faster than MLDSA?
September 13, 2025 at 8:57 PM
Nice! Now (to steal Luca's joke) it's only 11 more factors of 2 to go for SQISign to be faster than MLDSA?
July 21, 2026 at 3:12 PM
הקרנל הבא של לינוקס מלא בשיפורים שנשמעים כמו משהו מסטאר טרק.
הצפנה למחשוב קוונטי (ml-dsa):
https://www.digicert.com/insights/post-quantum-cryptography/mldsa
הצפנה למחשוב קוונטי (ml-dsa):
https://www.digicert.com/insights/post-quantum-cryptography/mldsa
ML-DSA | Post-Quantum Cryptography | DigiCert Insights
Dilithium is a lattice-based digital signing scheme that secures data against quantum computing threats. It is based on the CRYSTALS family of PQC algorithms.
www.digicert.com
February 15, 2026 at 11:43 AM
הקרנל הבא של לינוקס מלא בשיפורים שנשמעים כמו משהו מסטאר טרק.
הצפנה למחשוב קוונטי (ml-dsa):
https://www.digicert.com/insights/post-quantum-cryptography/mldsa
הצפנה למחשוב קוונטי (ml-dsa):
https://www.digicert.com/insights/post-quantum-cryptography/mldsa
Oh this stuff is by hand. I have too many opinions.
Claude Opus 4.6 did write mldsa_test.go in the filippo.io/mldsa API prototype, though. Also, there's words.filippo.io/claude-debug....
Claude Opus 4.6 did write mldsa_test.go in the filippo.io/mldsa API prototype, though. Also, there's words.filippo.io/claude-debug....
February 16, 2026 at 2:18 AM
Oh this stuff is by hand. I have too many opinions.
Claude Opus 4.6 did write mldsa_test.go in the filippo.io/mldsa API prototype, though. Also, there's words.filippo.io/claude-debug....
Claude Opus 4.6 did write mldsa_test.go in the filippo.io/mldsa API prototype, though. Also, there's words.filippo.io/claude-debug....
just migrate their keys without their consent, it'll be fine
July 9, 2026 at 2:16 AM
just migrate their keys without their consent, it'll be fine
1, I don't think that's true. 2, MLDSA is a lot worse in terms of public key+ signature size. So I am not sure that is a fair comparison. I think since Luca made this joke there has been several other speed-ups (as the joke was before the HD versions).
September 14, 2025 at 10:43 AM
1, I don't think that's true. 2, MLDSA is a lot worse in terms of public key+ signature size. So I am not sure that is a fair comparison. I think since Luca made this joke there has been several other speed-ups (as the joke was before the HD versions).
I think we agree that hybrids are a good idea.
I think the main point is that ECC hybrids are not a MUST for people who want to go pure-PQ.
I wrote more at soatok.blog/2026/04/13/h... (but it focused on the MLDSA use case) and the follow-up blog post.
I think the main point is that ECC hybrids are not a MUST for people who want to go pure-PQ.
I wrote more at soatok.blog/2026/04/13/h... (but it focused on the MLDSA use case) and the follow-up blog post.
Hybrid Constructions: The Post-Quantum Safety Blanket - Dhole Moments
The funny thing about safety blankets is they can double as stage curtains for security theater. Art: CMYKat “When will a cryptography-relevant quantum computer exist?” is a question ma…
soatok.blog
July 2, 2026 at 8:28 PM
I think we agree that hybrids are a good idea.
I think the main point is that ECC hybrids are not a MUST for people who want to go pure-PQ.
I wrote more at soatok.blog/2026/04/13/h... (but it focused on the MLDSA use case) and the follow-up blog post.
I think the main point is that ECC hybrids are not a MUST for people who want to go pure-PQ.
I wrote more at soatok.blog/2026/04/13/h... (but it focused on the MLDSA use case) and the follow-up blog post.
Open Quantum Safe(OQS)プロジェクトが公開しているOpenSSHのフォーク。こちらはML-DSAに対応しているようなのでこれに差し替えれば一応Secretiveが新たに対応したssh-mldsaが使える。
GitHub - open-quantum-safe/openssh: Fork of OpenSSH that includes prototype quantum-resistant key exchange and authentication in SSH based on liboqs. PROJECT INACTIVE. CONTRIBUTORS WANTED.
Fork of OpenSSH that includes prototype quantum-resistant key exchange and authentication in SSH based on liboqs. PROJECT INACTIVE. CONTRIBUTORS WANTED. - open-quantum-safe/openssh
github.com
September 17, 2025 at 2:33 PM
Open Quantum Safe(OQS)プロジェクトが公開しているOpenSSHのフォーク。こちらはML-DSAに対応しているようなのでこれに差し替えれば一応Secretiveが新たに対応したssh-mldsaが使える。
Linux 7.0 non è una rivoluzione rumorosa.
È il contrario: il "software lento" è quello che tiene in piedi il mondo.
Ne parlo qui:
marcoferrigno.net/linux-kernel...
#alpha #amd #epyc #infrastructure #kernel #kvm #linux #mldsa #opensource #postquantum #rust #security #sparc #xfs #zen5
È il contrario: il "software lento" è quello che tiene in piedi il mondo.
Ne parlo qui:
marcoferrigno.net/linux-kernel...
#alpha #amd #epyc #infrastructure #kernel #kvm #linux #mldsa #opensource #postquantum #rust #security #sparc #xfs #zen5
Linux Kernel 7.0: The Quiet Revolution That Changes Everything - Marco Ferrigno | IT System Engineer
While the industry chases the next AI benchmark and the next model announcement, something genuinely important happened on April 12, 2026, and it arrived with almost no fanfare: Linus Torvalds release...
marcoferrigno.net
April 30, 2026 at 7:18 AM
Linux 7.0 non è una rivoluzione rumorosa.
È il contrario: il "software lento" è quello che tiene in piedi il mondo.
Ne parlo qui:
marcoferrigno.net/linux-kernel...
#alpha #amd #epyc #infrastructure #kernel #kvm #linux #mldsa #opensource #postquantum #rust #security #sparc #xfs #zen5
È il contrario: il "software lento" è quello che tiene in piedi il mondo.
Ne parlo qui:
marcoferrigno.net/linux-kernel...
#alpha #amd #epyc #infrastructure #kernel #kvm #linux #mldsa #opensource #postquantum #rust #security #sparc #xfs #zen5
github.com/lestrrat-go/jwx (v4) works better than ever with Go 1.27, after a json/v2 fix and native crypto/mldsa support without companion module have been merged. #golang #jwt #jwk #jws #jwe
GitHub - lestrrat-go/jwx: Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe
Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe - lestrrat-go/jwx
github.com
August 20, 2026 at 9:10 PM
Cloudflare's 1.1.1.1 now validates 2,420-byte quantum-safe DNS signatures #Cloudflare #DNS #QuantumSafety #Cybersecurity #MLDSA
Cloudflare's 1.1.1.1 now validates 2,420-byte quantum-safe DNS signatures
Each ML-DSA-44 signature runs 38 times larger than ECDSA, forcing resolvers off UDP. What the migration needs to reach the DNS root remains open.
ppc.land
September 11, 2026 at 3:58 AM
Cloudflare's 1.1.1.1 now validates 2,420-byte quantum-safe DNS signatures #Cloudflare #DNS #QuantumSafety #Cybersecurity #MLDSA
AWS KMS adds support for post-quantum ML-DSA digital signatures
AWS KMS now supports FIPS 203 MLDSA, a quantum-resistant signature algorithm. It integrates with existing APIs and introduces new key specs. Available in select regions, it helps protect against future quantum computing threats.
AWS KMS now supports FIPS 203 MLDSA, a quantum-resistant signature algorithm. It integrates with existing APIs and introduces new key specs. Available in select regions, it helps protect against future quantum computing threats.
June 13, 2025 at 7:09 PM
AWS KMS adds support for post-quantum ML-DSA digital signatures
AWS KMS now supports FIPS 203 MLDSA, a quantum-resistant signature algorithm. It integrates with existing APIs and introduces new key specs. Available in select regions, it helps protect against future quantum computing threats.
AWS KMS now supports FIPS 203 MLDSA, a quantum-resistant signature algorithm. It integrates with existing APIs and introduces new key specs. Available in select regions, it helps protect against future quantum computing threats.
ffd42b6d0420c4be97cc28fd1bb5f4c29e286e98 lib/crypto: mldsa: Clarify the documentation for mldsa_verify() slightly
this one is educational. (1) because "slightly" is not applicable to this context (2) because a googler would never be caught dead clarifying documentation
this one is educational. (1) because "slightly" is not applicable to this context (2) because a googler would never be caught dead clarifying documentation
$GIT_DIR/remotes/<origin>. In such a push is.
Disclosed privately to the standard output channel (file descriptor 1) when the merge commits O.
codeberg.org
March 27, 2026 at 3:14 PM
ffd42b6d0420c4be97cc28fd1bb5f4c29e286e98 lib/crypto: mldsa: Clarify the documentation for mldsa_verify() slightly
this one is educational. (1) because "slightly" is not applicable to this context (2) because a googler would never be caught dead clarifying documentation
this one is educational. (1) because "slightly" is not applicable to this context (2) because a googler would never be caught dead clarifying documentation
look at the size difference between an ed25519 pubkey and an mldsa pubkey lmao.
1.8 KiB vs 91 B.
1.8 KiB vs 91 B.
July 21, 2026 at 5:22 AM
look at the size difference between an ed25519 pubkey and an mldsa pubkey lmao.
1.8 KiB vs 91 B.
1.8 KiB vs 91 B.