ml_dsa_65.nx

ml_dsa_65.nx -- ML-DSA-65 post-quantum digital signature. NIST FIPS 204 (August 2024). Lattice-based (Module-LWE + rejection sampling). Drop-in replacement for Ed25519 once fault-tolerant quantum computers exist -- Ed25519 is broken by Shor's algorithm. Parameters (FIPS 204 Table 2, ML-DSA-65 = NIST security category 3, AES-192 equivalent): n = 256 polynomial degree q = 8380417 prime modulus d = 13 dropped-bits parameter tau = 49 signing challenge weight lambda = 192 collision-resistance security parameter gamma1 = 524288 gamma2 = 261888 (k, l) = (6, 5) matrix dimensions eta = 4 beta = tau * eta = 196 omega = 55 Key / signature sizes: public key = 1952 bytes secret key = 4032 bytes signature = 3309 bytes Status (2026-04-23): SKELETON. Same scaffolded-then-filled approach as ml_kem_768.nx -- API locked so TLS / X.509 / OTR / email crypto callers can write against the signatures now; the NTT + ExpandA + Keccak-streamed sampling core lands as a separate push (~800 LoC). Dependencies (pending full impl): - sha3.nx: SHAKE-256 for ExpandA, ExpandS, challenge c - rand.nx: 32-byte seed at keygen - ct.nx: constant-time rejection sampling Invariants: DSA1 Output bytes match FIPS 204 Appendix A test vectors. DSA2 Verify ALWAYS accepts a genuine signature from the