[CFRG] Re: Silithium - A Compact, Efficient and Non-separable Hybrid Signature

[John Mattsson <[e-mail]>]

Hi Julien,

I think it is valuable to see continued work on improving the practical deployment options for post-quantum signatures. Designing new composite signature algorithms is something that should have been done in CFRG to begin with.

>Silithium is strongly unforgeable as long as ML-DSA is.

I think this should be considered a minimum requirement for all PQ/T composites. While the T component was the most important part during what ANSSI calls Phase 1, we are now in Phase 2, where the PQ component is the most important. In Phase 3, the PQ component will be the only component that matters.

I really like that Silithium only uses SHA-3 and that it offers several beyond unforgeability (BUFF) features.

While I continue to prefer standalone SLH-DSA/ML-DSA and non-composite signatures where possible, primarily because they simplify PKI deployment and operational management, I believe these composite constructions provide acceptable security properties (which draft-ietf-lamps-pq-composite-sigs do not). Silithium may be particularly attractive for non-PKI protocols, such as SSH.

One question is whether this construction could be instantiated with the CFRG curves. A lot of people (including Ericsson) prefer 25519 and 448 for new systems, as they offer better performance, stronger practical security, and broader global trust.

Cheers,
John Preuß Mattsson

From: DEVEVEY Julien <[e-mail]>
Date: Wednesday, 15 July 2026 at 16:24
To: [e-mail] <[e-mail]>
Cc: ROMEAS Maxime <[e-mail]>; Morgane Guerreau <[e-mail]>
Subject: [CFRG] Silithium - A Compact, Efficient and Non-separable Hybrid Signature

You don't often get email from [e-mail]. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Hi everyone,
We wanted to share with you our first draft of a PQ/T hybrid signature scheme, called Silithium.

Very roughly, Silithium can be seen as ML-DSA sandwiched between elliptic curve operation. Conversely it could be seen as an instance of Schnorr’s signatures with “ML-DSA as the hash function”.
Silithium can be easily implemented, assuming elliptic curve operations and any kind of ML-DSA implementation are available. As we expect both to be available during the PQ transition period, this lessens the burden on developers to deploy PQ/T hybrid cryptography.
Performance-wise, Silithium has (marginally) faster signing and verification time than composite ECDSA+ML-DSA. It also benefits from smaller signature sizes, only increasing it by 32 bytes with respect to ML-DSA.
Security-wise, we claim the following:

  *   Forging a Silithium signature implies breaking ML-DSA and breaking the discrete logarithm problem, which means that hybridization is successful.
  *   However, strong unforgeability is equivalent to that of ML-DSA: while we are not degrading ML-DSA’s security, this is not totally hybridized.
  *   Silithium can safely be used in “backward compatibility mode”, i.e., the T component of the signing key can be extracted and used to sign with ECDSA without decreasing the overall security of the scheme. Applications with a need for backward compatibility are thus not required to generate different keypairs for their legacy uses.
  *   This is unfortunately not the case when it comes to using the PQ component of the signing to key to sign with ML-DSA, as Silithium signatures are comprised of a ML-DSA signature, which could be reused in the PQ-only context. Note that Silithium calls ML-DSA with a different, unpredictable context every time it signs a message. If using Silithium in tandem with ML-DSA is required, then constraints could be put on user-submitted contexts to ML-DSA verification to avoid this issue.

Find the draft here: https://www.ietf.org/archive/id/draft-devevey-cfrg-silithium-00.html
Any kind of feedback would be greatly appreciated, as writing I-D is a novelty for the three of us. We are also suggesting a few variants at the end of the draft, with different trade-offs between “implementation easiness” and security. For instance, the original proposal in our research paper https://eprint.iacr.org/2025/2059 required to modify ML-DSA’s signing key as well as an external-mu implementation of ML-DSA’s verification to be easily implemented, but allowed Silithium’s key to be used in ECDSA and ML-DSA without security issues. Feedback on which variant is the most suited is very useful.

We will also be attending IETF 126, where we will present the scheme Wednesday. See you there!

Best,
Julien Devevey
Expert en Cryptographie
Laboratoire de Cryptographie
Division Scientifique et Technique
Sous-direction Expertise

Agence nationale de la sécurité des systèmes d’information (ANSSI)
31, Quai Grenelle, 75015 Paris 15
Tel : [phone]  / 06 07 74 31 11
cyber.gouv.fr<https://cyber.gouv.fr/> | X<https://twitter.com/anssi_fr> | LinkedIn<https://www.linkedin.com/company/anssi-fr/mycompany/> | Dailymotion<https://www.dailymotion.com/ANSSI_FR> | GitHub<https://github.com/ANSSI-FR> | SoundCloud<https://soundcloud.com/anssi-fr>

[logo signature]<https://cyber.gouv.fr/>

Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d’exécution d’une relation professionnelle et s’opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter [e-mail]. Si vous avez reçu ce message par erreur, nous vous remercions d’en informer l’expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: [e-mail]. If you have received this message in error, we thank you for informing the sender and destroying the message.