Skip to content

Update EIP-8051: define ML-DSA beta norm bound #11040

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eth-bot merged 1 commit into from
Feb 6, 2026
Merged

Update EIP-8051: define ML-DSA beta norm bound #11040

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions EIPS/eip-8051.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,10 +60,10 @@ For the two variants of ML-DSA of this EIP, the following parameters are fixed:
* Polynomial degree: `n = 256`,
* Field modulus: `q = 8380417`,
* Matrix dimensions: `k=4`, `l=4`,
* Bounds of rejection: `γ_1 = 2¹⁷`, `γ_2 = (q-1)/88`,
* Bounds of rejection: `γ_1 = 2¹⁷`, `γ_2 = (q-1)/88`, `β = 78`,
* Additional parameters: `η = 2`, `τ = 39`, `d = 13`.

These parameters strictly follow NIST. More precisely, `q`, `n`, `k`, `l` and `η` are chosen in order to ensure a hard MLWE related problem, and the remaining parameters are chosen for the hardness of MSIS as well as for the efficiency of the scheme.
These parameters strictly follow NIST. More precisely, `q`, `n`, `k`, `l` and `η` are chosen in order to ensure a hard MLWE related problem, and the remaining parameters are chosen for the hardness of MSIS as well as for the efficiency of the scheme. The parameter `β = τ * η = 78` is the norm bound used in the rejection condition `||z||_∞ < γ_1 - β` for the ML-DSA-44 parameter set in FIPS-204.

In terms of storage, ML-DSA public key can be derived by the verifier, making the overall public key of 1312 bytes. However, this increases the verifier cost, making the on-chain verification too expensive from a practical point of view. In this EIP, the verification algorithm takes the public key in raw format, meaning that the storage for the public key is:

Expand Down