{
  "node_id": "fips-204-quantum-dsa",
  "title": "Post-Quantum DSA (FIPS 204)",
  "domain": "Cybersecurity",
  "version": "1.1.0",
  "last_updated": "2026-04-10",
  "bluf": "Compliance with Federal Information Processing Standard 204 mandates a strict implementation of the Module-Lattice-Based Digital Signature Algorithm (ML-DSA). Systems must exclusively employ one of the three standardized parameter sets-ML-DSA-44, ML-DSA-65, or ML-DSA-87-and satisfy a minimum security strength where the selected set corresponds to NIST security category 3 or 5, reflecting a policy threshold where the value must be greater than or equal to 3. The foundational cryptographic operations are equally prescribed: the internal hash function must be SHAKE-256 per FIPS 202, and randomness for key generation or randomized signing must originate from a DRBG compliant with NIST SP 800-90A. For utilization in U.S. Federal contexts, the entire cryptographic implementation needs to be encapsulated within a FIPS 140-3 validated module. Verification requires that the implementation correctly process all relevant Known Answer Test vectors from the NIST CAVP for its claimed parameter set. Furthermore, component sizes are non-negotiable; the public key, private key, and signature dimensions must exactly match byte specifications detailed in FIPS 204, such as the 4000-byte private key for ML-DSA-65. Finally, operational security dictates that generated ML-DSA keys are single-purpose and must be disallowed for any other cryptographic function.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "ai_overlay_2026",
      "industry_mapping"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-fips-186-5-dss",
    "fips-203-quantum-kem",
    "nist-sp-800-131a-rev-2-crypto-transitions"
  ],
  "primary_citations_count": 6
}