Struct MlDsa87Params 

pub struct MlDsa87Params {
    pub n: usize,
    pub q: u32,
    pub d: u32,
    pub k: usize,
    pub l: usize,
    pub eta: u32,
    pub tau: usize,
    pub public_key_size: usize,
    pub secret_key_size: usize,
    pub signature_size: usize,
}

Structure containing ML-DSA-87 parameters FIPS 204, Table 1: ML-DSA-87 (NIST security category 5)

Fields

n: usize

Polynomial degree n = 256

q: u32

Modulus q = 8380417

d: u32

Dropped bits d = 13

k: usize

Matrix dimension k = 8 (rows)

l: usize

Matrix dimension ℓ = 7 (columns)

eta: u32

Infinity norm bound η = 2

tau: usize

Challenge weight τ = 60

public_key_size: usize

Public key size = 2592 bytes

secret_key_size: usize

Secret key size = 4896 bytes (includes 32-byte K seed)

signature_size: usize

Signature size = 4627 bytes

Trait Implementations

impl MlDsaSchemeParams for MlDsa87Params

const NAME: &'static str = "ML-DSA-87"

Algorithm name (ML-DSA-44, ML-DSA-65, ML-DSA-87)

const D_PARAM: u32 = 13

Dropped bits parameter d (FIPS 204, Table 1)

const K_DIM: usize = 8

Number of polynomials in s₂ and t (rows in matrix A)

const L_DIM: usize = 7

Number of polynomials in s₁ and y (columns in matrix A)

const LAMBDA: usize = 256

Classical security parameter λ in bits ML-DSA-44: λ = 128, ML-DSA-65: λ = 192, ML-DSA-87: λ = 256

const CHALLENGE_BYTES: usize = 64

Challenge hash size in bytes (λ/4) ML-DSA-44: 32 bytes, ML-DSA-65: 48 bytes, ML-DSA-87: 64 bytes

const ETA_S1S2: u32 = 2

Bound η for secret polynomials s₁, s₂

const GAMMA1_PARAM: u32

Range parameter γ₁ for masking vector y

const GAMMA1_BITS: usize = 20

Number of bits to represent z coefficients Computed as ceil(log₂(2·γ₁)) DEPRECATED: Use Z_BITS for packing z coefficients

const GAMMA2_PARAM: u32

Decomposition parameter γ₂

const BETA_PARAM: u32 = 120

Rejection bound β = τ·η (FIPS 204, Table 1)

const OMEGA_PARAM: u32 = 75

Maximum number of hint bits ω (FIPS 204, Table 1)

const TAU_PARAM: usize = 60

Number of ±1 coefficients in challenge polynomial c

const PUBLIC_KEY_BYTES: usize = 2592

Public key size in bytes

const SECRET_KEY_BYTES: usize = 4896

Secret key size in bytes (includes 32-byte K seed)

const SIGNATURE_SIZE: usize = 4627

Signature size in bytes

const W1_BITS: usize = 4

Bits for packing w₁ coefficients FIPS 204, Algorithm 28: b = bitlen((q-1)/(2·γ₂) − 1)

const Z_BITS: usize = 20

Number of bits used when packing each z-coefficient in signatures This is determined by the range [-γ₁+β, γ₁-β] which requires:

const N: usize = ML_DSA_N

Polynomial degree n = 256 (FIPS 204, Table 1)

const Q: u32 = ML_DSA_Q

Prime modulus q = 2²³ - 2¹³ + 1 (FIPS 204, Table 1)

const SEED_RHO_BYTES: usize = 32

Seed size for matrix A generation (ρ)

const SEED_KEY_BYTES: usize = 64

Seed size for secret/error sampling (ρ’)

const SEED_ZETA_BYTES: usize = 32

Master seed size for key generation (ζ)

const HASH_TR_BYTES: usize = 64

Hash output size for tr = H(pk)

const MAX_SIGN_ABORTS: u16 = 1000

Maximum signing attempts before failure

const FIXED_SIGNING_WINDOW: u16 = FIPS204_SIGN_INTERNAL_MIN_LOOP_LIMIT

Fixed public signing window used by the constant-time signer.