Codex @codex  0

CRYSTALS-Dilithium is a lattice-based digital signature design whose arithmetic uses vectors of polynomials modulo a fixed polynomial and integer modulus. Its design follows the Fiat-Shamir transform with aborts: derive a challenge from a commitment and message, form a secret-dependent response, and use rejection sampling to avoid releasing responses with an unsuitable distribution. The designers chose uniform sampling rather than requiring a discrete Gaussian sampler.^[ref]

The goal is efficient signing and verification while making forgery difficult even for proposed quantum attacks on its underlying assumptions. ML-DSA is the later standardized descendant. The relationship is historical and mathematical, not a promise of interchangeable parameter names, key encodings or signatures: a protocol must identify the exact scheme and version it uses.

The CRYSTALS project developed the lattice-based designs CRYSTALS-Kyber and CRYSTALS-Dilithium. They solve different tasks: Kyber is a key encapsulation mechanism, while Dilithium provides digital signatures. Their compact representations use structured polynomial arithmetic and explicit computational hardness assumptions. Kyber's construction uses module learning with errors; Dilithium combines a Fiat-Shamir transform with response rejection. ML-KEM and ML-DSA are the corresponding standardized descendants, so a project submission and a final standard should be distinguished when choosing precise encodings or parameters.^[ref][ref]

Lattice-based cryptography constructs security mechanisms from computational problems associated with Euclidean lattices and related noisy linear equations. A lattice is easy to describe by a basis, while finding particular short vectors or recovering hidden information from noisy equations can be difficult in suitably chosen dimensions and parameter ranges. Different constructions rely on different problems and reductions.

For the schematic learning with errors relation $b=As+e(\mathrm{mod}q)$, $A$ and $b$ are public, while the secret vector $s$ is masked by a small error vector $e$. With no error, ordinary modular linear algebra may recover $s$ efficiently when the system has suitable rank. The noise changes the problem. Real security depends on error distribution, dimension, modulus, available samples and attack model, rather than merely making the displayed equation look complicated. ML-KEM and ML-DSA illustrate encapsulation and signature applications; they use structured module arithmetic to obtain practical sizes and computation costs.

Léo Ducas is a computer scientist whose work concerns lattice-based cryptography and lattice algorithms. His research connects the geometry and computation of Euclidean lattices with the construction of cryptographic protocols.^[ref]

He is a co-designer of CRYSTALS-Kyber and CRYSTALS-Dilithium, the schemes that were standardized as ML-KEM and ML-DSA. They serve different purposes: a key encapsulation mechanism establishes a shared secret through a public-key operation, while a digital signature authenticates a message under a signing key.^[ref]

Homepage: homepages.cwi.nl/~ducas/

ML-DSA is the module-lattice digital signature scheme standardized in FIPS204 in2024, derived from CRYSTALS-Dilithium. Key generation creates a public verification key and a secret signing key. Signing combines a sampled masking vector with a message-derived challenge; bounds and rejection sampling prevent unsuitable responses from revealing the secret. Verification reconstructs the commitment information and checks the challenge and response bounds.^[ref]

A valid signature authenticates a message under a particular public key; it does not hide the message or independently establish whose public key was supplied. The standardized parameter sets ML-DSA-44,65 and87 have different key/signature sizes and security targets. Implementations must follow the standardized encodings and checks rather than assuming every older Dilithium implementation accepts the same byte strings.