← Wednesday, October 14, 2026SecurityDeep dive

ML-DSA hashes the public key before signing, raising protocol-design concerns

blog.erincandescent.net 4 min read Editor score 7/10

The piece explains how signing a message hash can enable signatures on messages the signer has not seen, and compares protections in Ed25519 and ML-DSA. Protocol designers should understand how signature construction affects message-binding assumptions.

What

ML-DSA includes a hash of its public key in the digest used for signing a message.

How

Verification may require parsing signed content to find a key and repeating message hashing for trial keys; the post proposes moving the key hash to the end.

Why it matters

Protocol designers must account for parsing and repeated-hash costs, especially when a message may be checked against multiple keys.

Read on blog.erincandescent.net → Lobsters · 1 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.