A signature scheme proves that whoever holds the matching private key signed a message, and that the message hasn't been altered since. Today, that job often runs on RSA or discrete-log schemes like ECDSA and Schnorr, all of which a large enough quantum computer running Shor's algorithm could break. Dilithium is built to take over.
This article explains how it works and why NIST put it ahead of the other candidates.
What Dilithium is
Dilithium is a lattice-based digital signature scheme. It’s a brainchild of CRYSTALS, a research project that also produced Kyber, now the ML-KEM key standard.
In August 2024, NIST took Dilithium, made some technical changes, and published the result as ML-DSA, short for Module-Lattice-Based Digital Signature Algorithm. People use the two names interchangeably in general talk, but the standard isn’t a byte-for-byte copy of the original Dilithium.
The standard defines three parameter sets, from ML-DSA-44 up to ML-DSA-87, each mapped to a higher NIST security level. Stronger sets use larger keys and signatures, and ML-DSA-65 sits in the middle.
Its security comes from two hard problems on module lattices, Module-LWE and Module-SIS. Both stay hard for quantum computers as far as anyone can tell, which is why a Dilithium signature holds up where an elliptic-curve one falls. We dig deeper into the underlying math in Lattice-Based Cryptography: Why Quantum Can't Crack It.
How Dilithium signs
The design is a twist on an old idea. Start with a Schnorr-style identification scheme, the kind that proves you know a secret without revealing it, then use the Fiat-Shamir transform to turn it into a signature anyone can check. Dilithium adds rejection sampling, one step that makes it safe on lattices.
After building a candidate signature, it checks whether that candidate is within set norm bounds. A candidate outside those bounds could reveal something about the secret key, so it gets discarded, and the signer tries again. The rejection checks are meant to keep the accepted responses statistically independent of the secret key, at the cost of a few repeated tries per signature.
Verification is public and quick, and requires no secrecy, so anyone holding the matching public key can check a signature.
Dilithium builds a candidate signature, keeps it only if it stays within safe bounds, and otherwise discards it and retries. It takes a few tries on average.
One choice sets Dilithium apart from Falcon, the other lattice signature NIST picked. ML-DSA samples its secret coefficients and masking vectors from bounded uniform distributions. This avoids Falcon's discrete-Gaussian sampler.
Falcon signing needs delicate discrete-Gaussian sampling and FFT-based arithmetic, usually built with tightly controlled floating-point operations or exact emulation. This makes Falcon harder to implement without side-channel leaks.
Why Dilithium is NIST’s primary choice
When NIST announced its signature picks, it named Dilithium the primary algorithm and reserved Falcon for applications that need smaller signatures. NIST's rationale points to Dilithium's high efficiency and its relatively simple implementation, along with a strong theoretical basis and an encouraging cryptanalytic history.
It also found Falcon harder to implement because of its floating-point arithmetic and complex data structures. ML-DSA trades some compactness for lower implementation complexity, though production systems should still rely on reviewed, standards-conformant libraries. This balance is why NIST recommends ML-DSA as the first choice and Falcon for cases where smaller signatures justify the added complexity.
The size trade-off
ML-DSA signatures are large by elliptic-curve standards. A Dilithium signature at its middle security level runs about 3,300 bytes, with public keys near 2,000. The lightest setting produces 2,420-byte signatures and the heaviest 4,627.
If you set that against a raw ECDSA signature of 64 bytes, typically 70 to 72 once DER-encoded in Bitcoin, you’ll get a dramatic jump. Dilithium is still far more compact than the hash-based SPHINCS+, whose signatures reach into the tens of thousands of bytes, and larger than Falcon, whose submitted parameter sets run 666 or 1,280 bytes.
Falcon has been selected for standardization as FN-DSA, though that standard is still in development, so those Falcon figures come from the submitted scheme.
Post-quantum signatures dwarf ECDSA. Dilithium sits between the compact Falcon and the much larger hash-based SPHINCS+, on a log scale.
In case of anything that runs at scale, such a size carries a cost. Bigger signatures mean heavier network traffic and more storage, and on a blockchain, they mean heavier transactions and potentially higher fees. That pressure is why on-chain designs care so much about signature size, and it shapes which scheme a system picks.
Dilithium and crypto wallets
In the crypto sphere, Dilithium is a leading candidate to replace the signatures that guard wallets. Many major chains authorize transactions with quantum-vulnerable discrete-log signatures like ECDSA and EdDSA, and all of them don’t measure up to Shor's algorithm.
Dilithium is NIST's finalized lattice-signature standard, and its comparatively simple design lowers the risk of a botched build compared to Falcon. Even so, teams should use a reviewed implementation instead of writing the cryptography themselves.
On-chain, the choice boils down to signature size. Every byte that a signature adds gets repeated across transactions, so Falcon becomes attractive when compactness is the overriding constraint.
qLABS applies a post-quantum layer in qVAULT, a non-custodial vault the company describes as using Falcon-based authorization, the more compact lattice scheme NIST selected as FN-DSA. The vault listed qONE and HYPE as its supported assets as of August 2026. qLABS develops and promotes qVAULT and qONE and publishes the L1 Quantum Vulnerability Index, which gives it a commercial and reputational interest in the claims here, so read the product details with that ownership in mind. None of this is financial advice.
FAQ
What is Dilithium?
Dilithium is a lattice-based digital signature scheme designed to resist attacks coming from both classical and quantum computers. No efficient quantum attack against the standardized ML-DSA parameter sets is known. NIST standardized Dilithium in 2024 as ML-DSA and named it the general-purpose signature most systems should use, with its security resting on hard problems in module lattices.
Is Dilithium the same as ML-DSA?
ML-DSA is the standardized descendant of CRYSTALS-Dilithium. The names are treated as equivalent in general discussion, but FIPS 204 includes technical changes, so an older Dilithium implementation shouldn't be automatically assumed to be ML-DSA-compatible or FIPS-compliant.
Is Dilithium quantum safe?
As far as anyone in this area of expertise knows, yes. It rests on module-lattice problems with no known efficient quantum attack threatening it, which is why NIST standardized it. That's what today’s cryptanalysis shows, but it’s not a mathematical guarantee, so NIST also standardized the hash-based SLH-DSA as a backup in case ML-DSA's lattice assumptions prove vulnerable.
Dilithium or Falcon, which is better?
They serve different needs. Dilithium is simpler to implement safely, so NIST made it the primary pick. Falcon produces much smaller signatures, which helps when bandwidth or on-chain space is tight, at the cost of more delicate code, and its FN-DSA standard is still in development. Neither is strictly better than the other.
Who created Dilithium?
It came from the CRYSTALS team, a group of academic and industry cryptographers including Vadim Lyubashevsky and Leo Ducas. The same project produced Kyber, now the ML-KEM key standard.
qLABS Editorial. Sources are linked inline. See the L1 Quantum Vulnerability Index for our full methodology and conflict-of-interest disclosure.
