[CFRG] Re: Silithium - A Compact, Efficient and Non-separable Hybrid Signature

[Ilari Liusvaara <[e-mail]>]

On Wed, Jul 15, 2026 at 04:27:16PM +0000, John Mattsson wrote:
> Hi Julien,
> 
> I think it is valuable to see continued work on improving the
> practical deployment options for post-quantum signatures.
> Designing new composite signature algorithms is something that should
> have been done in CFRG to begin with.
> 
> >Silithium is strongly unforgeable as long as ML-DSA is.
> 
> I think this should be considered a minimum requirement for all PQ/T
> composites. While the T component was the most important part during
> what ANSSI calls Phase 1, we are now in Phase 2, where the PQ
> component is the most important. In Phase 3, the PQ component will be
> the only component that matters.

This gave me the following idea for ECC+ML-DSA hybrid that is strongly
unforgeable as long as either is:

muprime <- H(A|tr|M, 64)
r <-$ ]0,L[
R <- rG
sq <- ML-DSA(sk, alg_id, R|muprime)
s <- r + H(sq, len) * a (mod L)
sig <- R | sq | s

When verifying, check that:

- R and A are canonical encodings for point.
- R and A have high order.
- 0 < s < L.
- sq is valid ML-DSA signature.
- sG = R + H(sq, len)*A.


The idea is that both components essentially sign one another (with s
indirectly signed), and ML-DSA also signs the input.

For security, len needs to be big enough. What is big enough depends on
L, but is Omega(log L).

This does not support pass-through context, but adding that is
trivial.

This construction does not depend on the elliptic curve. However, it
depends on the internal structure of ML-DSA.




-Ilari