The Parameter Sets

ML-DSA introduces more symbols than any other chapter of this book. This note lists them, gives the three parameter sets, and explains where each number comes from.

01.The table

Shared by all three: $n = 256$, $q = 8380417 = 2^{23} - 2^{13} + 1$, and a rounding parameter $d = 13$.

02.What each symbol is

$k$ and $\ell$. The module matrix is $A \in R_q^{k \times \ell}$, the secret is $\mathbf{s}_1 \in R_q^{\ell}$, and the error is $\mathbf{s}_2 \in R_q^{k}$.

Note that this is rectangular, where ML-KEM's was square. The two dimensions do different jobs: $\ell$ sets the size of the response $\mathbf{z}$, which dominates the signature, while $k$ sets the size of the commitment. They are tuned separately because the signature size and the security level pull on them differently.

$\eta$. The centred binomial width for $\mathbf{s}_1$ and $\mathbf{s}_2$, so their coefficients lie in $[-\eta, \eta]$.

$\tau$. The challenge $c$ is a polynomial with exactly $\tau$ non-zero coefficients, each $\pm 1$, and all the rest zero. That peculiar shape is deliberate and is explained below.

$\gamma_1$. The commitment randomness $\mathbf{y}$ has coefficients uniform on $(-\gamma_1, \gamma_1]$. This is the $\gamma$ of Rejection Sampling, or Fiat-Shamir With Aborts.

$\gamma_2$. The bucket width used by the high and low bit decomposition in Signing.

$\beta$. A bound on how large $c\mathbf{s}_1$ and $c\mathbf{s}_2$ can get. This is the $\beta$ of the rejection rule.

$\omega$. A cap on how many bits may be set in the hint vector, which Signing introduces.

03.Where $\beta$ comes from

The one relationship worth deriving, because it explains why the challenge has its odd shape.

The challenge $c$ has $\tau$ non-zero coefficients, each $\pm 1$. The secret $\mathbf{s}_1$ has coefficients bounded by $\eta$. When they are multiplied in $R_q$, each output coefficient is a sum of at most $\tau$ terms, each of size at most $\eta$. So

$$\|c\,\mathbf{s}_1\|_\infty \;\le\; \tau \cdot \eta \;=\; \beta .$$

Check it against the table:

ML-DSA-44: $\tau \eta = 39 \times 2 = 78 = \beta$.

ML-DSA-65: $\tau \eta = 49 \times 4 = 196 = \beta$.

ML-DSA-87: $\tau \eta = 60 \times 2 = 120 = \beta$.

Exact in all three cases. $\beta$ is not an independent parameter at all, it is defined by the other two.

That derivation is also the reason $c$ is sparse with unit coefficients. From Rejection Sampling, or Fiat-Shamir With Aborts, the acceptance rate is $(1 - \beta/\gamma_1)^N$, so keeping $\beta$ small is what keeps signing from restarting endlessly. A dense challenge with large coefficients would make $\beta$ enormous and the rejection rate catastrophic. A sparse $\pm 1$ challenge keeps $\beta$ in the low hundreds against a $\gamma_1$ of $2^{17}$ or more, so $\beta/\gamma_1$ stays under one percent per coordinate.

Meanwhile the challenge still has to be unguessable. With $\tau = 39$ positions chosen among 256 and each carrying a sign, the number of possible challenges is around $2^{192}$, which is far beyond search.

So the sparse-and-small shape serves two constraints at once: enough entropy to be a real challenge, small enough norm to keep the rejection loop viable.

Why $q$ is so much larger than the KEM's

ML-KEM used $q = 3329$, twelve bits. ML-DSA uses $q = 8380417$, twenty-three bits. Same ring degree, same lattice family, a modulus two thousand times larger.

The reason is dynamic range. In the KEM, every quantity is small: secrets, errors and messages all fit in a narrow band, and the modulus only has to be big enough that the noise does not wrap around.

In the signature, $\mathbf{y}$ alone has coefficients up to $\gamma_1 = 2^{19}$, which is already larger than the whole of ML-KEM's $\mathbb{Z}_q$. The commitment $\mathbf{w} = A\mathbf{y}$ is wider still. The algebra must not wrap during honest operation, so $q$ has to accommodate all of it.

There is a second reason, and it is the one from Chapter 4. Because

$$q - 1 \;=\; 2^{23} - 2^{13} \;=\; 2^{13}\left(2^{10} - 1\right),$$

there are thirteen factors of two available, and the transform needs only nine. So ML-DSA gets the complete length-256 negacyclic NTT that ML-KEM cannot have. The larger modulus that dynamic range forced turns out to also solve the transform problem.

05.Signature sizes

At 2420 to 4627 bytes, ML-DSA signatures are large. An Ed25519 signature is 64 bytes, so the increase is a factor of thirty-eight to seventy-two.

Most of it is $\mathbf{z}$, which is $\ell$ ring elements with coefficients up to $\gamma_1$, so roughly $\ell \cdot 256 \cdot 18$ bits. The hint is small by design, under a hundred bytes, which is what $\omega$ enforces. The third piece is the challenge hash, carried at $\lambda/4$ bytes, so 32, 48 and 64 across the three sets.

That last field is worth pinning down, because it is where published tables disagree with each other. Round-three Dilithium and the FIPS 204 draft carried a 32-byte challenge hash at every security level, giving 3293 and 4595 for the two larger sets. The final standard widened it to $\lambda/4$, and $\mathbf{z}$ and the hint did not move, so the whole difference between the two tables is that one field. A table quoting 3293 is reading the draft.

This is the cost that makes signatures the harder half of the post-quantum migration. A kilobyte added to a TLS handshake is tolerable. A certificate chain contains several signatures plus several public keys, and inflating all of them at once is what makes the transition genuinely awkward for constrained protocols. It is also why SLH-DSA, whose signatures are larger still, is positioned as a conservative backup rather than a default.