NIST's main quantum-safe signature, standardized in 2024. Bigger than today's signatures.
The idea: ML-DSA works like a Schnorr signature rebuilt with lattices. The signer commits to a random short vector, derives a challenge from the hash of the commitment and the message, and answers with a mix of the random vector and the secret key. That answer could leak the secret, so the signer checks it first and starts over if it falls outside a safe range (rejection sampling). Verifiers check the answer is short and fits the public key. Forging would mean finding a short solution to the public equations.
Why it matters: Will gradually replace RSA and ECDSA for signing.
On the map: FIPS 204
NIST's main post-quantum signature (FIPS 204)[1], formerly Dilithium. Signatures are about 2.4 KB and public keys about 1.3 KB, much larger than ECDSA.
It rests on Module-LWE and Module-SIS, made non-interactive with the Fiat-Shamir transform (ROM)[2]. It is being rolled into certificates, firmware signing and hardware security modules.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.