ML-DSA Sign

Category: Post-Quantum Cryptography · Node Type ID: pqc-mldsa-sign

Creates post-quantum digital signature (FIPS 204)

Overview

Signs an arbitrary-length message using the post-quantum lattice-based ML-DSA signature algorithm standardized in NIST FIPS 204.

Produces a 2,420-byte (ML-DSA-44), 3,309-byte (ML-DSA-65), or 4,627-byte (ML-DSA-87) signature.

When to Use

Creating quantum-resistant digital signatures over documents, certificates, firmware, or protocol transcripts.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Variant `variant`	`select` Default: `65`	Always visible	Must match the ML-DSA security level of the connected `Secret Key` (`44`, `65`, or `87`). `44`: ML-DSA-44 `65`: ML-DSA-65 `87`: ML-DSA-87

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (2 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Secret Key`	`secretKey`	`Bytes`	Required	Always visible	Signer's ML-DSA secret key (2560B, 4032B, or 4896B).
`Message`	`message`	`Bytes`	Required	Always visible	Message bytes (`Uint8Array`) of any length to sign.

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Signature`	`signature`	`Bytes`	Always visible	Computed ML-DSA signature (2420B, 3309B, or 4627B).

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_MATERIAL`	Invalid key length or format	Raised when `Secret Key` byte length does not match the selected ML-DSA variant.

Examples

Signing a Message with ML-DSA-65

Sign a payload with an ML-DSA-65 secret key.

Connect Secret Key from ML-DSA KeyGen and your message bytes to ML-DSA Sign.