ML-DSA signing scheme for TUF metadata by kommendorkapten · Pull Request #195 · theupdateframework/taps

kommendorkapten · 2026-05-04T08:04:55Z

Wrote up a TAP on how to encode ML-DSA keys when used within TUF and added a section on pre-auth encoding as certain targets can be fairly larger, and ML-DSA operates in pure mode, that is, no pre-hashing which is the case for RSA and ECDSA.

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

mnm678

I left a few minor comments, but overall I think this is a great scheme, and addresses some of the performance concerns around ML-DSA

Hayden-IO

This is fantastic!

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

kommendorkapten · 2026-05-05T08:50:09Z

Thanks for the feedback ❤️
All comments should be adressed/answered. See https://github.com/kommendorkapten/taps/blob/pqc/tap21.md for a rendered version.

Hayden-IO

Really great work on this spec!

TAP 21 is in active draft (PR theupdateframework/taps#195) and adds an ml-dsa keytype with FIPS 204 parameter sets plus an application-level pre-hashing protocol so HSMs can sign large TUF metadata in pure mode. Also bump README counts from 14 to 15 toggleable TAPs.

jku

Looks good to me. Left one question

This is related to proposed TAP: theupdateframework/taps#195 This currently enables the key for verification and signing for easier testing: In reality we may want to leave the verify support disabled until the TAP is approved. This makes cryptography 48 a requirement * we could make this more complicated with a separate feature but I'm not going to unless someone has a good reason for it * ML-DSA support was added in 47 already but support via openssl only became available in 48 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku · 2026-05-19T08:49:11Z

For testing: https://jku.github.io/pqc-test-repo/metadata/ is a live repository with ML-DSA-44 online keys that should match this proposal

JustinCappos · 2026-05-19T12:27:40Z

with ML-DSA-44 online keys

Note for anyone else who is glancing quickly at this early in the AM, only the snapshot / timestamp keys are ML-DSA-44, as I should have expected from the use of the word online. 😆

We probably should list some ballpark numbers in the TAP for the metadata size (key / sig size differences) and signing / verification time differences.

kommendorkapten · 2026-05-19T12:30:03Z

Yeah, I can add that.

jku · 2026-05-26T09:26:08Z

TUF Metadata Size Analysis: ECDSA to ML-DSA Transition

This uses the sigstore repository as an example (5 root/targets keys, 1 timestamp/snapshot key).

Note that I did not actually create a working repository like this: this result comes from a script that calculates the sizes, script is made by an AI -- I've made point verifications but feel free to do you own homework.

TUF Role	Keys	Sigs	ECDSA Size	ML-DSA-44 Size (% Increase)	ML-DSA-65 Size (% Increase)	ML-DSA-87 Size (% Increase)
root	6	5	5,630 B	39,326 B (+598.5%)	53,406 B (+848.6%)	71,968 B (+1,178.3%)
targets	1	5	4,942 B	30,133 B (+509.7%)	39,813 B (+705.6%)	53,965 B (+992.0%)
timestamp	0	1	447 B	5,147 B (+1,051.5%)	6,907 B (+1,445.2%)	9,561 B (+2,038.9%)
snapshot	0	1	1,760 B	6,458 B (+266.9%)	8,218 B (+366.9%)	10,872 B (+517.7%)
registry.npmjs.org	0	1	642 B	5,338 B (+731.5%)	7,098 B (+1,005.6%)	9,752 B (+1,419.0%)

For this specific case the timestamp growth is the most worrying: that is the only file that every single client downloads constantly.

The table is based on these estimates:

Public keys:

ECDSA: DER size= 91 bytes. PEM size = 178 bytes. On-disk size inside JSON literal = 180 bytes.
ML-DSA-44: DER size= 1334 bytes. PEM size = 1,860 bytes. On-disk size inside JSON literal = 1,888 bytes.
ML-DSA-65: DER size= 1974 bytes. PEM size = 2,726 bytes. On-disk size inside JSON literal = 2,768 bytes.
ML-DSA-87: DER size= 2614 bytes. PEM size = 3,595 bytes. On-disk size inside JSON literal = 3,650 bytes.

signatures

ECDSA:_ 140 hex characters
ML-DSA-44: 4,840 hex characters
ML-DSA-65: 6,600 hex characters
ML-DSA-87: 9,254 hex characters

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

kommendorkapten · 2026-05-28T09:29:04Z

Updated with three summary tables on the expected growth from ECDSA inspired by @jku's comment.

JustinCappos

As discussed in the TUF community meeting today, we think this is in sufficient state to merge as a draft / assign TAP number 21 to this.

This is related to proposed TAP: theupdateframework/taps#195 This currently enables the key for verification and signing for easier testing: In reality we may want to leave the verify support disabled until the TAP is approved. This makes cryptography 48 a requirement * we could make this more complicated with a separate feature but I'm not going to unless someone has a good reason for it * ML-DSA support was added in 47 already but support via openssl only became available in 48 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Hayden-IO · 2026-07-27T18:13:23Z

Just wanted to check in on the status of getting this merged.

JustinCappos · 2026-07-28T23:37:35Z

I'd also like to point out that we are looking for TAP editors. #197 If dont' know if this is blocking on waiting for review there, but more eyeballs to review may help. (Review load is very minimal)

…

On Mon, Jul 27, 2026 at 2:13 PM Hayden ***@***.***> wrote: *Hayden-IO* left a comment (theupdateframework/taps#195) <#195 (comment)> Just wanted to check in on the status of getting this merged. — Reply to this email directly, view it on GitHub <#195?email_source=notifications&email_token=AAGRODYRIBXKKI2R6G5HZWT5G6LVVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBZGUYDKNZUGMYKM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5095057430>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGROD2IRZHKPNCS2TCMLEL5G6LVVAVCNFSNUABEKJSXA33TNF2G64TZHM3DONRUGUZDQOB3JFZXG5LFHM2DGNZUHEZTINZYGOQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAGRODY45M5ZJTEV3CCCROL5G6LVVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBZGUYDKNZUGMYKM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/AAGROD5UJOWZHJZCTM3DVO35G6LVVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBZGUYDKNZUGMYKM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you commented.Message ID: ***@***.***>

mnm678 · 2026-07-29T14:23:12Z

This is ready to merge as a draft. Once theupdateframework/go-tuf#758 moves forward we can also look at getting this TAP accepted.

First (incomplete) draft of ml-dsa signing scheme.

0acf1fd

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

kommendorkapten changed the title ~~First draft of ml-dsa signing scheme.~~ ML-DSA signing scheme for TUF metadata May 4, 2026

mnm678 reviewed May 4, 2026

View reviewed changes

Comment thread tap21.md

mnm678 reviewed May 4, 2026

View reviewed changes

Comment thread tap21.md

mnm678 previously approved these changes May 4, 2026

View reviewed changes

Hayden-IO reviewed May 4, 2026

View reviewed changes

Comment thread tap21.md

Comment thread tap21.md

Comment thread tap21.md

Comment thread tap21.md

Comment thread tap21.md Outdated

Comment thread tap21.md

Comment thread tap21.md Outdated

Updated based on feedback. Only editorial.

786619a

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

kommendorkapten dismissed mnm678’s stale review via 786619a May 5, 2026 08:38

kommendorkapten added 2 commits May 5, 2026 10:40

Clarified version encoding in scheme

abecf81

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

Added a section on "ml-dsa-mu" API variants.

b2f3167

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

Hayden-IO approved these changes May 5, 2026

View reviewed changes

mnm678 previously approved these changes May 6, 2026

View reviewed changes

jku reviewed May 11, 2026

View reviewed changes

Comment thread tap21.md

jku approved these changes May 11, 2026

View reviewed changes

jku mentioned this pull request May 12, 2026

Support ML-DSA secure-systems-lab/securesystemslib#1123

Open

jku mentioned this pull request May 12, 2026

Add ML-DSA support secure-systems-lab/securesystemslib#1124

Open

Added summary tables inspired by jku's comment.

d748a59

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

kommendorkapten dismissed mnm678’s stale review via d748a59 May 28, 2026 09:24

Spelling fixes

070e030

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

JustinCappos approved these changes Jun 3, 2026

View reviewed changes

JustinCappos requested a review from mnm678 June 3, 2026 14:13

JustinCappos requested a review from lukpueh June 3, 2026 14:16

This was referenced Jun 29, 2026

tuf, crypto: Support ML-DSA sigstore/sigstore-rust#142

Draft

Test ML-DSA keytypes theupdateframework/tuf-conformance#398

Draft

Hayden-IO mentioned this pull request Jul 28, 2026

Add support for ML-DSA (TAP 21) theupdateframework/go-tuf#758

Open

mnm678 approved these changes Jul 29, 2026

View reviewed changes

mnm678 merged commit 3820809 into theupdateframework:master Jul 29, 2026

Uh oh!

Conversation

kommendorkapten commented May 4, 2026

Uh oh!

Uh oh!

Uh oh!

mnm678 left a comment

Choose a reason for hiding this comment

Uh oh!

Hayden-IO left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kommendorkapten commented May 5, 2026

Uh oh!

Hayden-IO left a comment

Choose a reason for hiding this comment

Uh oh!

jku left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jku commented May 19, 2026

Uh oh!

JustinCappos commented May 19, 2026

Uh oh!

kommendorkapten commented May 19, 2026

Uh oh!

jku commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TUF Metadata Size Analysis: ECDSA to ML-DSA Transition

Uh oh!

kommendorkapten commented May 28, 2026

Uh oh!

JustinCappos left a comment

Choose a reason for hiding this comment

Uh oh!

Hayden-IO commented Jul 27, 2026

Uh oh!

JustinCappos commented Jul 28, 2026 via email

Uh oh!

mnm678 commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jku commented May 26, 2026 •

edited

Loading