[CFRG] Silithium - A Compact, Efficient and Non-separable Hybrid Signature

[DEVEVEY Julien <[e-mail]>]

Hi everyone,
We wanted to share with you our first draft of a PQ/T hybrid signature scheme, called Silithium.

Very roughly, Silithium can be seen as ML-DSA sandwiched between elliptic curve operation. Conversely it could be seen as an instance of Schnorr's signatures with "ML-DSA as the hash function".
Silithium can be easily implemented, assuming elliptic curve operations and any kind of ML-DSA implementation are available. As we expect both to be available during the PQ transition period, this lessens the burden on developers to deploy PQ/T hybrid cryptography.
Performance-wise, Silithium has (marginally) faster signing and verification time than composite ECDSA+ML-DSA. It also benefits from smaller signature sizes, only increasing it by 32 bytes with respect to ML-DSA.
Security-wise, we claim the following:

  *   Forging a Silithium signature implies breaking ML-DSA and breaking the discrete logarithm problem, which means that hybridization is successful.
  *   However, strong unforgeability is equivalent to that of ML-DSA: while we are not degrading ML-DSA's security, this is not totally hybridized.
  *   Silithium can safely be used in "backward compatibility mode", i.e., the T component of the signing key can be extracted and used to sign with ECDSA without decreasing the overall security of the scheme. Applications with a need for backward compatibility are thus not required to generate different keypairs for their legacy uses.
  *   This is unfortunately not the case when it comes to using the PQ component of the signing to key to sign with ML-DSA, as Silithium signatures are comprised of a ML-DSA signature, which could be reused in the PQ-only context. Note that Silithium calls ML-DSA with a different, unpredictable context every time it signs a message. If using Silithium in tandem with ML-DSA is required, then constraints could be put on user-submitted contexts to ML-DSA verification to avoid this issue.

Find the draft here: https://www.ietf.org/archive/id/draft-devevey-cfrg-silithium-00.html
Any kind of feedback would be greatly appreciated, as writing I-D is a novelty for the three of us. We are also suggesting a few variants at the end of the draft, with different trade-offs between "implementation easiness" and security. For instance, the original proposal in our research paper https://eprint.iacr.org/2025/2059 required to modify ML-DSA's signing key as well as an external-mu implementation of ML-DSA's verification to be easily implemented, but allowed Silithium's key to be used in ECDSA and ML-DSA without security issues. Feedback on which variant is the most suited is very useful.

We will also be attending IETF 126, where we will present the scheme Wednesday. See you there!

Best,
Julien Devevey
Expert en Cryptographie
Laboratoire de Cryptographie
Division Scientifique et Technique
Sous-direction Expertise

Agence nationale de la sécurité des systèmes d'information (ANSSI)
31, Quai Grenelle, 75015 Paris 15
Tel : [phone]  / 06 07 74 31 11
cyber.gouv.fr<https://cyber.gouv.fr/> | X<https://twitter.com/anssi_fr> | LinkedIn<https://www.linkedin.com/company/anssi-fr/mycompany/> | Dailymotion<https://www.dailymotion.com/ANSSI_FR> | GitHub<https://github.com/ANSSI-FR> | SoundCloud<https://soundcloud.com/anssi-fr>

[logo signature]<https://cyber.gouv.fr/>

Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d'exécution d'une relation professionnelle et s'opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter [e-mail]. Si vous avez reçu ce message par erreur, nous vous remercions d'en informer l'expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: [e-mail]. If you have received this message in error, we thank you for informing the sender and destroying the message.