ML-DSA Will Have to Do: Why We Can't Wait for Better Post-Quantum Signatures

RSA and ECC are toast once sufficiently advanced quantum computers arrive. That much has been clear for years. The good news: ML-KEM for encryption and ML-DSA for signatures are already standardized by NIST and are being deployed at scale—Cloudflare reports that the majority of its traffic now uses ML-KEM. The bad news: ML-DSA is bulky on the wire and lacks the cryptographic flexibility we've grown accustomed to with classical schemes. And the better alternatives? They're still years away from standardization.

In a detailed post, Cloudflare's Bas Westerbaan and Christopher Patton walk through the current state of post-quantum signature algorithms and why the organization is betting on ML-DSA for the first wave of migration. The punchline: we can't wait for the ideal algorithm. As Eric Rescorla put it,

You go to war with the algorithms you have, not the ones you wish you had.

The Candidate Landscape

NIST recently advanced nine post-quantum signature schemes to the third round of its signatures on-ramp. Among them are lattice-based, hash-based, and multivariate candidates, each with trade-offs in signature size, verification speed, and key size. FN-DSA (formerly Falcon) is expected to be standardized soon, offering smaller signatures than ML-DSA but with more complex implementation requirements.

Cloudflare's own analysis—updated annually since 2021—shows that while these newer schemes improve on ML-DSA in specific dimensions (e.g., smaller signatures or faster verification), none are ready for production use today. The standardization process alone will take several more years, and then comes implementation, auditing, and ecosystem adoption.

Why ML-DSA Is the Pragmatic Choice

ML-DSA is battle-tested, standardized, and already shipping in major TLS libraries. It's not perfect: signatures are roughly 10x larger than RSA-2048, and the algorithm doesn't support many of the cryptographic tricks (like signature aggregation or blind signatures) that developers rely on. But it works, and waiting for a better scheme means leaving traffic vulnerable to harvest-now-decrypt-later attacks in the interim.

Cloudflare's target is 2029 for full post-quantum security across its infrastructure. That timeline is aggressive, but achievable with ML-DSA. The newer algorithms will arrive eventually—and they'll be critical for use cases where signature size or performance is paramount—but they won't be ready for the first migration wave.

The Bottom Line

The post-quantum transition is a marathon, not a sprint. ML-DSA gets us out of the gate. The next generation of signature schemes will let us run faster, but only if we start moving now.