ML-DSA-65: the signature that holds
You will be able to say what problem the scheme rests on, what the three key sizes are, and why that size is the price of the security rather than an inefficiency.
The hard problem
Lattices, and why a quantum computer does not help much.
ML-DSA rests on the difficulty of finding short vectors in a structured lattice — a problem with no known quantum algorithm that changes its scale, unlike factoring or discrete logarithms, which Shor demolishes. The security argument is therefore not “nobody has broken it yet” but “the best known attacks, classical and quantum alike, remain exponential”.
Illustration to come
Real photograph of a physical lattice: a wire grid, a crystal model, a bead frame — anything where regularly spaced points in space are literally visible. It must feel like an object on a table, not a 3D render.
The numbers
Three sizes, and none of them are small.
A public key is 1,952 bytes; an expanded secret key is 4,032; a signature is 3,309. Compare that with an elliptic-curve signature at 64 bytes and you have the engineering problem of this chain in one line: every transaction carries a signature fifty times heavier, so block size, bandwidth, storage and gas all had to be designed around it instead of inherited from Bitcoin.
Illustration to come
Real photograph, side lighting: two stacks of printed paper of dramatically different heights on a desk, the small one a fraction of the large one. It stands in for 64 bytes against 3,309 without needing a chart.
Determinism
A key is a function of a 32-byte seed, and that is why words work.
FIPS 204 key generation is deterministic: the same 32-byte seed always produces the same key pair. That single property is what makes a twenty-four-word recovery phrase possible for a 4,032-byte key — you do not back up the key, you back up the seed it grows from. The node and the wallet derive that seed identically, and a shared vector file is what proves it rather than asserts it.
Illustration to come
Real photograph: a single seed on a surface next to the grown sprout or plant it produced. Literal, and it lands the idea that the small thing determines the large one exactly.
What the node does with it
Every block, every transaction, verified by every node.
Signature verification is not a wallet-side courtesy; it is consensus. A node re-checks each signature against the public key the transaction spends from, and a block carrying one bad signature is rejected outright rather than flagged. It is also why verification speed matters more here than signing speed: one machine signs, thousands verify.
Illustration to come
Real photograph of a quality-control or inspection line where more than one person checks the same items. Conveys “verified many times over”, with real people and real hands.
In short
- ML-DSA-65 rests on lattice problems that no known quantum algorithm collapses.
- Public key 1,952 B, expanded secret 4,032 B, signature 3,309 B — roughly fifty times an elliptic-curve signature.
- Key generation is a deterministic function of a 32-byte seed, which is what makes a word-based backup possible.
- Verification is a consensus rule: one invalid signature invalidates the whole block.