Artifact GuideGLOBALFIPS digital signatures

ML-DSA vs ECDSA under FIPS 204 and FIPS 186-5

A focused comparison for teams choosing, implementing, or reviewing FIPS-aligned digital signature algorithms.

Use it to separate algorithm standards, parameter choices, CAVP evidence, and CMVP module validation scope.

Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
7

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

Choose when the system is adopting the post-quantum signature algorithm in FIPS 204 and can support its larger keys and signatures, protocol identifiers, and validation path. Choose ECDSA when the controlling protocol or public-key infrastructure requires the elliptic-curve signature algorithm in FIPS 186-5. If pre-hashing is required, distinguish from pure ML-DSA; if predictable per-message secret generation is required, distinguish from randomized ECDSA. In every case, record the parameter set or curve, signature interface, implementation evidence, and FIPS 140-3 module boundary separately.

Side-by-side comparison

FIPS 204 ML-DSA vs ECDSA under FIPS 186-5

Compare the algorithm standard, parameters, key handling, validation evidence, and module boundary before reusing claims across and ECDSA.

Review all sources
First framework
FIPS 204 ML-DSA

This side applies when the signature claim is or under FIPS 204, including ML-DSA-44, ML-DSA-65, or ML-DSA-87 parameter choices.

Second framework
ECDSA under FIPS 186-5

This side applies when the signature claim is ECDSA or under FIPS 186-5, including the named curve/domain parameters and hash or XOF choices.

Comparison row 1

Standard scope

FIPS 204 ML-DSA

FIPS 204 specifies , including key generation, signature generation, signature verification, supporting algorithms, and approved ML-DSA parameter sets.

ECDSA under FIPS 186-5

FIPS 186-5 specifies ECDSA signature generation and verification as part of the Digital Signature Standard, with elliptic-curve domain parameters supplied through SP 800-186.

Operational implication

Start by naming the algorithm and standard. Do not use FIPS 204 to justify ECDSA claims or FIPS 186-5 to justify parameter-set claims.

Comparison row 2

Covered actors

FIPS 204 ML-DSA

FIPS 204 applies to federal signature systems operated by agencies or for them under contract when is selected. Private and commercial organizations may also adopt it.

ECDSA under FIPS 186-5

FIPS 186-5 applies to federal signature systems operated by agencies or for them under contract when ECDSA is selected. Private and commercial organizations may also adopt it.

Operational implication

The standards identify approved algorithms; an agency requirement, contract, protocol profile, or risk decision determines which algorithm a particular system must use.

Comparison row 3

Trigger

FIPS 204 ML-DSA

implementations should record whether the claim uses ML-DSA-44, ML-DSA-65, or ML-DSA-87 and whether the pure or pre-hash signing interface is used.

ECDSA under FIPS 186-5

ECDSA implementations should record the curve/domain parameters, hash or XOF, key-size security strength, and whether the signature process is randomized or deterministic.

Operational implication

Record the system requirement that drives the choice. Both algorithms are FIPS-approved signature options, while only is designed around a post-quantum security assumption.

Comparison row 4

Core obligations

FIPS 204 ML-DSA

key generation requires a fresh 256-bit seed from an approved RBG. The RBG must provide at least 128, 192, or 256 bits of security strength for ML-DSA-44, ML-DSA-65, or ML-DSA-87 respectively, with FIPS 204 recommending 192 bits for ML-DSA-44 to retain its category 2 claim.

ECDSA under FIPS 186-5

ECDSA requires approved key generation and protection of the private key. Randomized ECDSA requires a new protected per-message secret number for every signature; derives that number from the message hash and private key through the specified HMAC_DRBG process.

Operational implication

Map every random input and secret to its generator, required strength, storage rule, and zeroization path. Do not assume deterministic signing removes the random-number requirement from key generation.

Comparison row 5

Evidence

FIPS 204 ML-DSA

For , look for CAVP evidence that matches the implementation, FIPS 204 revision, parameter set, and function form being claimed.

ECDSA under FIPS 186-5

For ECDSA, look for CAVP evidence that matches ECDSA or , the applicable curve/domain parameters, hash or XOF, implementation, and certificate status.

Operational implication

Collect CAVP validation evidence matching the specific algorithm variant and parameter set; do not reuse ECDSA CAVP records for claims.

Comparison row 6

Timing

FIPS 204 ML-DSA

availability is tied to FIPS 204 publication and CAVP validation entry availability. Migration planning should account for protocol support, hybrid transition design, and NIST post-quantum migration guidance timelines.

ECDSA under FIPS 186-5

FIPS 186-5 specifies and approves ECDSA, but it does not set a general ECDSA withdrawal date. Any migration schedule must be tied to later NIST transition guidance, an applicable system requirement, or a documented risk decision.

Operational implication

Treat FIPS 204 publication and matching CAVP evidence as separate facts; do not infer a universal ECDSA replacement date from either FIPS 204 or FIPS 186-5.

Comparison row 7

Enforcement

FIPS 204 ML-DSA

An implementation may sit inside a FIPS 140-3 cryptographic module boundary, but the module certificate, security policy, approved mode, and listed algorithms determine the validated claim.

ECDSA under FIPS 186-5

An ECDSA implementation may also sit inside a FIPS 140-3 cryptographic module boundary, but the ECDSA certificate entry must still align with the module version and operational environment.

Operational implication

Both algorithms may sit inside a FIPS 140-3 module boundary; confirm that the module boundary claim covers the correct algorithm variant and parameter set.

Comparison row 8

Overlap

FIPS 204 ML-DSA

Both algorithms use approved randomness for key generation, but their signing dependencies differ: may draw hedged per-signature randomness, randomized ECDSA draws a per-message secret number from an approved RBG, and derives that number from the message hash and private key.

ECDSA under FIPS 186-5

Both algorithms can rely on FIPS-approved module assurance, but the evidence is different: claims should point to the ML-DSA parameter set and CAVP record, while ECDSA claims should point to the curve/domain parameters, the signature method, and the matching validation record.

Operational implication

Both algorithms require an approved RBG for key generation. can use a fresh hedging value for signing, while ECDSA uses a per-message secret number k generated either randomly or through the deterministic process.

Comparison row 9

Practical decision rule

FIPS 204 ML-DSA

Choose when the design is intentionally adopting the FIPS 204 post-quantum signature algorithm and can support the chosen parameter set, implementation interface, and validation evidence.

ECDSA under FIPS 186-5

Choose ECDSA when the design needs a FIPS 186-5 elliptic-curve signature algorithm and can support the required curve/domain parameters, hash choices, key handling, and validation evidence.

Operational implication

Choose the algorithm whose standard, parameters, implementation, protocol support, and validation boundary match the actual system claim. A post-quantum-versus-legacy label does not establish those facts.

Practical decision rule

Which algorithm standard to apply

  • Choose FIPS 204 when the design or procurement requirement specifically requires a NIST-approved post-quantum digital signature algorithm or lattice-based signing.
  • Choose FIPS 186-5 ECDSA when the controlling protocol profile, existing key infrastructure, or interoperability requirement depends on classical elliptic-curve signing with NIST-approved domain parameters.
  • Do not substitute and ECDSA evidence without verifying that the protocol, key size, parameter set, and CAVP validation record match the specific implementation in scope.
  • Review the algorithm choice after applicable NIST transition guidance, module revalidation cycles, or protocol changes affect either algorithm family; do not infer a withdrawal date from FIPS 204 alone.
Section 1

What is the direct standards difference?

FIPS 204 controls an algorithm claim. It defines key generation, signature generation, signature verification, and three approved parameter sets: ML-DSA-44, ML-DSA-65, and ML-DSA-87. Their claimed NIST security categories are 2, 3, and 5 respectively; those categories are not direct bit-security measurements.

FIPS 186-5 controls an ECDSA algorithm claim. It specifies randomized and signature generation and verification, points to SP 800-186 for recommended elliptic curves, and requires the hash or XOF strength and the strength associated with the curve order to meet the required signature-process strength.

  • Use FIPS 204 language for parameter-set and function-interface claims.
  • Use FIPS 186-5 language for ECDSA domain parameters, keys, per-message secret numbers, and verification assurances.
  • Do not describe an algorithm as FIPS 140-3 validated; FIPS 140-3 validation applies to cryptographic modules, while algorithm testing is separate evidence.
Section 2

Implementation facts to capture before choosing

For , record the parameter set, whether the design uses ML-DSA or , whether signing is hedged or deterministic, and any context string. FIPS 204 limits the context string to 255 bytes. It generally prefers pure ML-DSA and recommends that a key pair be used for only one of ML-DSA or HashML-DSA.

For ECDSA, record the curve and domain parameters, hash or XOF, key-pair generation method, and per-message secret-number method. FIPS 186-5 requires ECDSA keys to be used only for ECDSA signatures. For randomized ECDSA, a new secret number k is generated for every signature; k, its inverse, and the private key must be protected from disclosure and modification.

  • -44, ML-DSA-65, and ML-DSA-87 have public-key sizes of 1,312, 1,952, and 2,592 bytes and signature sizes of 2,420, 3,309, and 4,627 bytes respectively; test protocol and storage limits with the selected set.
  • ECDSA depends on a specific elliptic-curve domain-parameter set and approved key generation. Randomized ECDSA also needs approved per-message random generation; derives k through the specified process.
  • For both algorithms, preserve the claim boundary: algorithm implementation, protocol use, key-management process, certificate profile, and cryptographic module are different review objects.
Section 3

Validation evidence that should not be overstated

CAVP evidence can support a claim that a specific algorithm implementation was tested for conformance to the relevant algorithm standard. It does not by itself prove that a product, service, protocol stack, or deployment boundary is a validated cryptographic module.

CMVP evidence is about a cryptographic module validated to FIPS 140-3 and its approved mode, security policy, certificate scope, and listed algorithm certificates. A customer or independent review should therefore ask for both the algorithm evidence and the module certificate when the public claim depends on validated-module use.

  • Check CAVP entries for the exact algorithm, revision, parameter set or mode, implementation name, vendor, and certificate status.
  • Check CMVP entries for the module name, version, operational environment, security level, approved-mode caveats, and linked algorithm certificates.
  • Write public or customer-facing claims as scoped facts, for example: an implementation has CAVP evidence, or a named module is CMVP validated for a listed configuration.
Section 4

Review checklist for ML-DSA vs ECDSA

Use the comparison to review an implementation and its migration evidence. Identify the exact signature function in use and the evidence needed for the claim being made.

  • Name the signing use case: firmware signing, document signing, certificate issuance, protocol authentication, code signing, or another concrete signature flow.
  • Record the controlling standard: FIPS 204 for or FIPS 186-5 for ECDSA.
  • Record parameter set or ECDSA curve/domain parameters, plus hash, XOF, random-bit generation, and key-use assumptions.
  • Check whether CAVP evidence exists for the implementation and whether the evidence matches the claimed algorithm and parameter choices.
  • Check whether the product claim needs a CMVP-validated module and whether the certificate scope covers the shipped version and operating environment.
  • Avoid shortcuts such as calling an algorithm certificate a validated product or treating a legacy ECDSA certificate as evidence for .
Primary sources

References and citations

nvlpubs.nist.gov
Referenced sections
  • Primary source for ECDSA algorithm specification, domain parameters, key generation, signature generation, and verification under FIPS.
"Digital Signature Standard"
Related guides

Explore more topics

AES FIPS 197 requirements and evidence
AES FIPS 197 guidance for identifying supported key sizes, separating the block cipher from modes of operation, and avoiding unsupported FIPS validation claims.
CAVP Algorithm Validation and ACVP Testing
How CAVP algorithm validation, the ACVP protocol, the ACVTS test system, and CMVP module validation fit together without overstating a FIPS claim.
CAVP Validation Evidence Workflow for FIPS Algorithms
Workflow for collecting CAVP validation evidence and ACVP/ACVTS test records: implementation identity, tested parameters, environments, and CMVP handoff records.
FIPS 180-4 and FIPS 202 secure hash guidance
Choose and evidence SHA-2, SHA-3, and SHAKE use under FIPS 180-4, FIPS 202, CAVP validation, and FIPS 140-3 module claims.
FIPS 186-5 and FIPS 204 digital signatures
Compare FIPS 186-5 classical digital signatures with FIPS 204 ML-DSA, including scope, algorithm choices, key-use limits, and validation evidence boundaries.
FIPS 203 ML-KEM vs RSA and ECDH key establishment
Compare FIPS 203 ML-KEM with RSA and ECDH key-establishment schemes using NIST SP 800-56A, SP 800-56B, CAVP, and CMVP evidence.
FIPS 203, 204, and 205 Post-Quantum Algorithms
FAQ on how FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA fit FIPS-approved cryptographic algorithm planning, implementation evidence, and validation checks.
FIPS Algorithm Procurement Evidence FAQ
What procurement teams should collect before accepting FIPS algorithm or module claims: CAVP certificates, CMVP module status, security policy scope, and supplier change triggers.
FIPS approved algorithm selector workflow
A cited workflow for selecting FIPS and NIST-approved cryptographic algorithms without overstating module validation, CAVP evidence, or approved-mode claims.
FIPS approved mode procurement: certificates, boundaries, and evidence
Procurement guidance for FIPS approved mode claims: how to check CMVP certificates, CAVP evidence, module boundaries, tested environments, and supplier evidence before purchase.
FIPS crypto transition and deprecation tracker
Track FIPS algorithm transitions, withdrawn guidance, CAVP evidence, CMVP module impact, procurement triggers, and approved-mode caveats without overstating validation status.
FIPS cryptographic algorithm selector
Choose between FIPS algorithm standards for AES, SHA-2, SHA-3, digital signatures, ML-KEM, ML-DSA, and SLH-DSA without overstating validation scope.
FIPS KDF and MAC coverage for validated modules
Map FIPS 140-3 KDF and MAC coverage to approved security functions, CAVP evidence, self-tests, service indicators, and module security policy entries.
FIPS Key Management Mapping for Algorithms and SSP Evidence
Map FIPS 140-3 key management requirements to approved algorithms, SSP establishment methods, CAVP evidence, module boundaries, and key-use records.
FIPS Procurement Evidence Review Workflow: CAVP, CMVP, Approved Mode
Review FIPS crypto procurement evidence by separating CAVP algorithm certificates from CMVP module certificates, Security Policy scope, approved mode, operating environment, change impact, and retention records.
FIPS validation certificates for cryptographic algorithms
How to read CAVP algorithm validation certificates and CMVP module validation certificates without overstating FIPS-approved cryptographic algorithm claims.
FIPS-approved cryptographic algorithms FAQ
Answers to common FIPS algorithm questions: approved security functions, CAVP validation, CMVP module scope, AES modes, SHA-2, SHA-3, signatures, and post-quantum algorithms.
How FIPS 180-4 and FIPS 202 Hash Functions Fit FIPS Algorithm Approval
Identify SHA-1 and SHA-2 in FIPS 180-4 and SHA-3 and SHAKE in FIPS 202, then check current-use status and CAVP/CMVP evidence separately.
How FIPS 186-5 Signature Algorithms Fit FIPS Approval
Use FIPS 186-5 for RSA, ECDSA, deterministic ECDSA, EdDSA, HashEdDSA, DSA verification limits, approved hashes, and CAVP/CMVP evidence boundaries.
Post-quantum FIPS 203, 204, and 205: ML-KEM, ML-DSA, and SLH-DSA
An official source guide to the three NIST post-quantum FIPS standards: when ML-KEM, ML-DSA, and SLH-DSA apply, what evidence to keep, and how CAVP and CMVP claims differ.
Post-Quantum Migration for FIPS Cryptography
Plan post-quantum migration for FIPS cryptography by separating ML-KEM key establishment, ML-DSA and SLH-DSA signatures, CAVP algorithm evidence, and CMVP module validation boundaries.
Post-Quantum Migration Tracker for FIPS 203, 204, and 205
Track post-quantum cryptography migration evidence for FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA, CAVP algorithm certificates, and CMVP module boundaries.
SHA-2 vs SHA-3 under FIPS 180-4 and FIPS 202
Compare SHA-2 and SHA-3 for FIPS use: approved functions, validation evidence, compatibility, procurement checks, and when migration is not required.
TLS use-case mapping for FIPS algorithm evidence
Map TLS uses to FIPS algorithm, CAVP, CMVP, approved-mode, certificate-authority, and evidence checks without overstating protocol validation claims.
What does FIPS 197 AES mean for FIPS-approved algorithms?
FIPS 197 defines AES as a FIPS-approved block cipher, but AES use alone is not the same as CAVP algorithm testing or FIPS 140-3 module validation.