{
  "number": 10073,
  "title": "Composite Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for Use in X.509 Public Key Infrastructure",
  "authors": [
    "M. Ounsworth",
    "J. Gray",
    "M. Pala",
    "J. Klaußner",
    "S. Fluhrer"
  ],
  "published": "2026-11",
  "status": "Proposed Standard",
  "stream": "IETF",
  "area": "sec",
  "working_group": "lamps",
  "pages": 196,
  "formats": [
    "HTML",
    "TXT",
    "PDF",
    "XML"
  ],
  "abstract": "This document defines a PQ/T hybrid scheme with concrete instantiations that combine the US NIST Module-Lattice-Based Digital Signature Algorithm (ML-DSA) with traditional algorithms RSASSA-PKCS1-v1_5, RSASSA-PSS, ECDSA, Ed25519, and Ed448. These combinations are tailored to meet regulatory guidelines in certain regions. Composite ML-DSA is applicable in applications that use X.509 or PKIX data structures that accept ML-DSA, but where the operator wants extra protection against breaks or catastrophic bugs in ML-DSA and where the level of security provided by Existential Unforgeability under Chosen Message Attack (EUF-CMA) is acceptable.",
  "keywords": [
    "PQ/T hybrid",
    "post-quantum",
    "PKI"
  ],
  "draft": "draft-ietf-lamps-pq-composite-sigs-19",
  "doi": "10.17487/RFC10073",
  "urls": {
    "html": "https://rfc.dk/rfc10073/",
    "text": "https://rfc.dk/rfc10073.txt",
    "rfc_editor": "https://www.rfc-editor.org/rfc/rfc10073",
    "datatracker": "https://datatracker.ietf.org/doc/rfc10073/"
  },
  "text_modified": "2026-11-07T01:43:35.32583189Z"
}