mldsa87

ML-DSA-87 (FIPS 204) digital signature library.

Built in Rust on ml-dsa, compiled to WASM.

ML-DSA-87 (formerly CRYSTALS-Dilithium) provides NIST Level 5 post-quantum signature security.

Native Rust usage

use mldsa87::*;

let kp = generate_keypair();
let sig = sign(&kp.seed, b"hello");
assert!(verify(&kp.verifying_key, b"hello", &sig));

Install

npm install mldsa87-wasm

Usage

import { Signer, verify } from 'mldsa87-wasm';

//=========== Safe (seed lives inside WASM memory) ===========

// seed is a 32-byte Uint8Array that deterministically derives the ML-DSA keypair.
// You are responsible for providing it. Store it securely and never expose it!
// The seed stays inside WASM memory and is zeroized when the Signer is freed or garbage collected.
const signer = new Signer(seed);

// Sign a message
const sig = signer.sign(new TextEncoder().encode('hello'));

// With optional context (per ML-DSA spec)
const sigWithCtx = signer.sign(
    new TextEncoder().encode('hello'),
    new TextEncoder().encode('vexahub:v1:share')
);

// Get the verifying (public) key
const vk = signer.verifyingKey(); // Uint8Array

// Verify
const valid = verify(vk, new TextEncoder().encode('hello'), sig);
console.log(valid); // true

//=========== !WARNING! - UNSAFE ===========

// generateKeypair generates a fresh random seed via the system RNG.
// The seed is returned to JS memory as a Uint8Array.
// You are responsible for zeroizing it after use (e.g. seed.fill(0)).
import { generateKeypair, generateKeypairFromSeed, sign } from 'mldsa87-wasm';

// Generate a keypair
const { seed, verifyingKey } = generateKeypair(); // both Uint8Array

// Reproduce a keypair from an existing seed
const kp = generateKeypairFromSeed(seed); // kp.verifyingKey === verifyingKey

// Sign a message (deterministic but seed exposed to JS heap)
const signature = sign(seed, new TextEncoder().encode('hello'));

// Verify
const ok = verify(verifyingKey, new TextEncoder().encode('hello'), signature);
console.log(ok); // true

// Zeroize the seed when done
seed.fill(0);

Memory management: In all modern browsers (and wasm-bindgen ≥ 0.2.91), WASM memory is freed automatically via the TC39 weak references proposal when the JS object goes out of scope.

In practice, you often don't need to think about this. For deterministic cleanup or environments without weak reference support (older browsers, some Node.js setups), use using (TypeScript 5.2+ / ES2026) or call .free() manually.

Never call .free() on a using-managed instance otherwise it will double-free.

Sizes

| Value | Size | |----------------------------|-------------| | Seed (private key) | 32 bytes | | Verifying key (public key) | 2,592 bytes | | Signature | 4,627 bytes |

Security

• Deterministic signing (no randomness at sign time)
• Seed zeroized on drop
• Based on ml-dsa by RustCrypto

License

Dual-licensed under the MIT License or Apache-2.0 License.