CFRG weighs Silithium hybrid signature against Mothma

A first Internet-Draft on the IRTF Crypto Forum Research Group list proposes Silithium, a post-quantum/traditional hybrid signature meant to ease the transition period when both elliptic-curve and ML-DSA code are already on hand.

Julien Devevey and co-authors cast the design as ML-DSA placed between elliptic-curve operations, or equivalently as a Schnorr signature that treats ML-DSA as its hash. They report signing and verification marginally faster than a straight ECDSA-plus-ML-DSA composite, with signatures only 32 bytes larger than plain ML-DSA. Forgery, they claim, requires breaking both ML-DSA and the discrete-logarithm problem. Strong unforgeability, however, rises no higher than that of ML-DSA alone. The traditional half of a Silithium signing key can be extracted and used for ordinary ECDSA without weakening the hybrid; the post-quantum half cannot safely be reused for standalone ML-DSA, because each Silithium signature already contains an ML-DSA signature that could be stripped and replayed.

Comparison with the earlier Mothma construction quickly became the focus. D. J. Bernstein argued that Mothma’s black-box treatment of existing ECC libraries yields a smaller and less error-prone code footprint, and that real-world speed will favor whichever design can most easily plug in already-optimized curve code. He also questioned whether a 32-byte size difference is operationally meaningful. John Mattsson stressed a preference for hedged nonce generation over pure randomness, citing past RNG and implementation failures, and favored long-term designs that can rely on SHA-3 rather than SHA-2. Other contributors noted that protocols requiring strong unforgeability need two-sided SUF-CMA security, a property black-box hybrids generally cannot deliver.

Instantiations with edwards25519, choices of hash function, and the precise hedging method remain open points as the draft is reviewed.