Pith. sign in

REVIEW 3 major objections 3 minor 55 references

DSA Nonce Vulnerabilities: An Interactive Analysis

T0 review · 3 major / 3 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper's central claim is that an interactive DSA analysis platform can correctly reproduce the standard signing and verification workflow and three nonce-based key-recovery attacks while rendering every intermediate computation inspect

desk verdict A reasonable CTF teaching GUI whose nonce-reuse and linear-nonce attacks are correct, but the HNP lattice section is mis-specified and the code isn't available; fixable, but as written the third attack claim doesn't hold up. read the letter →

arxiv 2607.17107 v1 pith:CYKPY5BF submitted 2026-07-19 cs.CR

Rundong Wei , Xiaomei Tian , Xiaoqi Li This is my paper · ORCID
classification cs.CR MSC 94A60
keywords DSAnoncereuselinearattackHiddenNumberProblemLLLlatticereductionCTFcryptographysignatureverificationvisualizationtool
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish a practical teaching claim: one interactive platform can make DSA's internal mathematics and its most common failure modes visible to beginners. It implements the standard DSA key generation, signing, and verification, then reproduces three nonce attacks—two signatures sharing one nonce, nonces linked by a known linear recurrence, and hidden-number-problem recovery from partially known nonce bits via lattice reduction. The evidence is functional and performance testing in which every workflow completes as specified, the private key is recovered for each attack, and the platform stays responsive for the tested sizes. A sympathetic reader would take the contribution as an educational and forensic inspection tool whose value is showing intermediate values, not as a new cryptanalytic method.

What carries the argument

The load-bearing mechanism is the ordered computation trace: every signing, verification, and key-recovery step is rendered as a formula paired with its numeric result, with security-critical values (the nonce k and private key x) visually highlighted. The three attack derivations supply the transformations the trace displays: subtraction of the two signing equations for nonce reuse; substitution of the linear nonce relation for the linear attack; and the HNP lattice matrix G—rows of q on a diagonal, attack coefficients A_i and B_i, with K = 2^m in the final column—whose LLL-reduced second-to-last entry is taken to be x. The trace is what turns known equations into an inspectable workflow an

What would settle it

Feed the HNP module a signature set generated with a known high-bit leakage pattern that does not match the K = 2^m model (for example, fewer known bits or biased nonces), and check whether the extracted candidate key still validates against every signature; a mismatch would bound the module's true scope. Similarly, generate two signatures with independent random nonces and run the nonce-reuse module: the r1 != r2 failure is expected, but if any input pair with equal r and unrelated messages fails to recover x, the trace itself is wrong.

Watch

Extended reading notes

Core claim

The paper's central claim is that the three standard DSA nonce attacks can be embedded in a single workflow that shows each algebraic step alongside its numerical result. For nonce reuse, the platform subtracts the two signing equations to recover the shared nonce k and then the private key x. For linear nonce leakage, it uses two signatures whose nonces satisfy k2 = a*k1 + b to solve for k1 and x. For partially known nonces, it converts the DSA signing equation into an HNP instance, builds a lattice basis with rows of q and coefficients A_i = s_i^-1 r_i and B_i = s_i^-1 h_i, applies LLL reduction, and reads the private key from the reduced vector. The platform then validates the recovered k

Load-bearing premise

The load-bearing premise is that the embedded attack mathematics—in particular the Section 3.4 HNP assertion that LLL on matrix G yields the private key as the second-to-last entry of a short vector—is correct for the platform's accepted parameter ranges; the paper states this from prior HNP/LLL theory and confirms it on a five-signature test, while Section 6 notes the evaluation covers only the implemented leakage model and test data.

Editorial extensions

If this is right

  • With the platform, a CTF learner can watch a shared nonce across two signatures reduce to k = (h1 - h2)(s1 - s2)^-1 mod q and then to x, so the most common DSA nonce oversight becomes a line-by-line recovery exercise.
  • For linearly related nonces, an analyst with two signatures and known coefficients a, b can see both nonces and the private key recovered from two equations, making the mechanism of the leak explicit.
  • For HNP-style attacks, the platform constructs the lattice, runs LLL, and validates the candidate key against all signatures, showing that high-bit nonce leakage can be turned into full key recovery.
  • Because verification traces compute v from the public parameters and compare it to r, the platform can illustrate why a signature fails when the message or key differs.
  • Performance measurements indicate interactive use is feasible: modular exponentiation and inversion complete in milliseconds at tested sizes, and a ten-signature HNP instance solves in about two milliseconds.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same trace-and-validate design should transfer to ECDSA nonce attacks, where the algebra is analogous over the curve order; none of the platform's three attack derivations is DSA-specific except parameter naming.
  • The nonce-reuse derivation is parameter-free beyond the two signatures and the public key, so a student can verify the platform's arithmetic with a handheld calculator; the visualisation may serve as a checkable proof rather than a black box.
  • A natural stress test would randomize nonce relations, signature counts, and bit-leakage sizes across whole families rather than single datasets, turning the current functional evaluation into a coverage measurement.
  • The paper's own limitations section narrows the scope: the HNP module is tested under one leakage model with a small dataset, and educational benefit remains a design objective rather than a measured outcome, so the strong claim to watch is reproducibility of the attacks on the supplied inputs, not generality.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper presents an interactive DSA analysis and visualization platform aimed at CTF competitions. The platform implements standard DSA key generation, signing, and verification, and claims to reproduce three nonce-related attack workflows: nonce reuse, linear nonce leakage, and HNP-based lattice key recovery with LLL reduction. The paper gives algebraic derivations for the attacks, describes a Tkinter/PyCryptodome/SageMath implementation with step-by-step visualization, and reports functional and performance tests. The main contribution is the platform itself, intended to make the intermediate mathematics of DSA and its attacks inspectable for learners.

Significance. If the claims are correct, the platform would be a useful educational tool for CTF cryptography training, addressing a real gap in existing tools that typically hide intermediate computations. Strengths of the work include the use of external libraries (PyCryptodome, SageMath) for the underlying primitives rather than a fully self-contained implementation, and the correctness of the basic nonce-reuse derivation. The interactive stepwise visualization is a genuinely valuable feature. However, the HNP/lattice section is under-specified to the point of being incorrect as written: the lattice construction omits the known-nonce information that HNP requires, and the module description does not indicate how leakage parameters are supplied. This directly undermines the claim that all three attack scenarios are correctly reproduced.

major comments (3)
  1. [§3.4, Eqs. (14)–(16)] The HNP construction is not specified correctly for the stated scenario of partially known nonce high-order bits. Eq. (14)–(15) give k_i = A_i x + B_i mod q, with B_i = s_i^{-1} h_i. If k_i = a_i + e_i with known a_i and small e_i, the correct HNP relation is e_i = A_i x + (B_i - a_i) mod q, so the bottom row of lattice (16) should contain t_i = (B_i - a_i) mod q, not B_i alone. As written, the lattice vector contains full-size residues k_i and is not short, so LLL will not expose x in the general known-high-bits scenario. The constant K=2^m is never defined, and the HNP module description in §4.3 supplies no leakage parameters. The paper must specify the leakage model (known MSBs, small nonces, etc.), define m, include the known nonce part in the lattice, and state the corresponding HNP page inputs.
  2. [§5, Table 3] The evaluation does not provide the test data used for the attack modules. Table 3 lists only qualitative case descriptions ('Input two signatures'), not the actual messages, signatures, q, or nonce-leakage parameters. Without these values, the reader cannot verify the HNP case or reproduce the claimed key recovery. The paper says 'standardised test datasets were used' but no dataset is given. At minimum, include the concrete test vectors or provide a repository link.
  3. [§3.3 and §4.3] The linear-nonce derivation assumes both signatures are generated for the same message hash h; Eq. (11) is only correct when h1 = h2. Section 4.3, however, states that the linear-nonce module accepts a user-managed set of message-signature entries and hashes each message. If the module permits different messages, Eq. (11) must be replaced by k1 = (h2 r1 - h1 r2 - b r1 s2) * (a r1 s2 - s1 r2)^{-1}, and the module must either enforce or clearly document the same-message restriction. Otherwise the reproduced workflow can silently produce incorrect keys.
minor comments (3)
  1. [Table 4] The rows for 2048-bit and 4096-bit results are visually split across lines, making the table ambiguous (e.g., '20.4' and '0.4' appear to be under the 1024-bit column). Please reformat so each row is clearly associated with its bit length.
  2. [References [49]–[51]] These references are cited for SageMath capabilities but are actually DSA-related papers. Please cite the SageMath documentation or a standard reference for the SageMath system.
  3. [§6] The limitation statement that 'the HNP experiments use a specific leakage model' is too vague and appears only in the discussion. The specific leakage model and its parameters should be described in §3.4 and §4.3, where the HNP attack is defined and implemented.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's derivations are standard and independently checkable, and its validation is not constructed to force the stated outcomes.

full rationale

The paper makes no new mathematical derivation claim. The DSA signing and verification equations in Section 3.1 are textbook identities; the nonce-reuse and linear-nonce attacks in Sections 3.2 and 3.3 are derived algebraically from the signing equation (Eqs. 1-12) rather than from any fitted parameter. The HNP/lattice section (3.4) invokes the standard Hidden Number Problem framework and gives an explicit lattice basis; the exposition is compact but the construction is not circular—it neither defines the private key x in terms of the claimed output nor fits the recovered key to the signatures. Validation relies on externally implemented primitives (PyCryptodome for DSA, SageMath for LLL) and test signatures, while Section 6 explicitly limits the HNP tests to a specific leakage model and states that functional correctness was assessed through black-box tests, not formal verification. Those limitations affect correctness confidence, not circularity. Self-citations ([1]-[4], [55]) appear only in introductory and related-work context and are not load-bearing. No step reduces, by the paper's own equations or by self-citation, to its own inputs.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The platform depends on standard cryptographic assumptions and the correctness of third-party libraries; no new mathematical entities are postulated. The only hand-set constant is K=2^m in the HNP lattice.

free parameters (1)
  • K = 2^m in HNP lattice = unspecified (paper says 'treat K=2^m as a fixed constant', Section 3.4)
    The lattice matrix G (Eq. 16) uses K to balance the last row; the choice of m (number of known nonce bits) determines K but is not derived from first principles. It is a hand-set parameter of the attack scenario.
assumptions (4)
  • domain assumption PyCryptodome implements DSA key generation, signing, and verification faithfully per NIST standards.
    The platform's basic DSA module uses PyCryptodome; any deviation from standard DSA would invalidate both signing and attack tests.
  • domain assumption SageMath's LLL implementation correctly reduces the basis in Eq. (16) and yields a vector containing the private key.
    The HNP module relies on SageMath's LLL; the paper states the result but does not prove or externally validate it.
  • standard math HNP lattice reduction recovers x when x is the second-to-last element of the short vector (Eq. 16).
    This is a known lattice-attack result (see Shparlinski [48]), asserted in Section 3.4 rather than derived in this paper.
  • standard math SHA-1/SHA-256 digest values used in the attack equations are computed as specified.
    Attack derivations treat h=H(m) as an exact digest; no hash properties beyond determinism are used.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DSA Nonce Vulnerabilities: An Interactive Analysis." pith.science (2026). https://pith.science/paper/CYKPY5BF

@misc{pith2026260717107,
  author       = {Pith},
  title        = {Pith review of: DSA Nonce Vulnerabilities: An Interactive Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CYKPY5BF}},
  note         = {Machine review of arXiv:2607.17107}
}
read the original abstract

Digital signatures are fundamental to identity authentication and data integrity in cybersecurity, and the NIST-standardized Digital Signature Algorithm (DSA) frequently appears in the cryptography track of CTF competitions. However, DSA relies on number theory, modular arithmetic, and large-integer computation, making both the algorithm and its associated attacks difficult for beginners to follow. Conventional tools often expose only inputs and outputs, leaving the intermediate computations of signing, verification, and key-recovery attacks opaque. This paper presents a DSA signature analysis and visualisation platform tailored to CTF competitions. The platform provides three main capabilities: basic signature generation and verification, reproduction of common CTF attack methods, and dynamic visualisation of attack workflows. It covers three representative nonce vulnerabilities: nonce reuse, linear nonce leakage, and HNP-based lattice attacks. Stepwise displays and highlighted intermediate values make the underlying computations directly inspectable. Experiments show that the platform correctly reproduces the standard DSA workflow and all three attack scenarios.

Figures

Figures reproduced from arXiv: 2607.17107 by the authors.

Figure 1
Figure 1. Overall platform architecture. Performance evaluation focuses on modular exponentiation and modular inversion for 1024-bit to 4096-bit integers, together with LLL reduction for HNP instances. The target latency is below 10 seconds for an HNP instance containing 10 signatures, while routine interface actions such as page transitions should complete within 0.5 seconds. Usability requirements emphasise a consistent lay… view at source ↗
Figure 2
Figure 2. Structure of the auxiliary function module. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 7 linked inside Pith

  1. [1]

    Penetrating the hostile: Detecting DeFi protocol exploits through cross-contract analysis.IEEE Transactions on Information F orensics and Security, 20:11759–11774, 2025

    Xiaoqi Li, Wenkai Li, Zhiquan Liu, Yuqing Zhang, and Yingjie Mao. Penetrating the hostile: Detecting DeFi protocol exploits through cross-contract analysis.IEEE Transactions on Information F orensics and Security, 20:11759–11774, 2025

    2025

  2. [2]

    SmartBugBert: BERT-enhanced vulnerability detection for smart contract bytecode.arXiv preprint arXiv:2504.05002, 2025

    Jiuyang Bu, Wenkai Li, Zongwei Li, Zeng Zhang, and Xiaoqi Li. SmartBugBert: BERT-enhanced vulnerability detection for smart contract bytecode.arXiv preprint arXiv:2504.05002, 2025

    arXiv 2025

  3. [3]

    Exploring vulnerabilities and concerns in Solana smart contracts.arXiv preprint arXiv:2504.07419, 2025

    Xiangfan Wu, Ju Xing, and Xiaoqi Li. Exploring vulnerabilities and concerns in Solana smart contracts.arXiv preprint arXiv:2504.07419, 2025

    arXiv 2025

  4. [4]

    Interaction-aware vulnerability detection in smart contract bytecodes

    Wenkai Li, Xiaoqi Li, Yingjie Mao, and Yuqing Zhang. Interaction-aware vulnerability detection in smart contract bytecodes. IEEE Transactions on Dependable and Secure Computing, 23(1):298–315, 2026

    2026

  5. [5]

    On the modifications of a digital signature algorithm with secret sharing.2021 9th International Conference on Information and Communication Technology (ICoICT), 37:417–422, 2021

    Umi Zulfah and Mareta Ardyani. On the modifications of a digital signature algorithm with secret sharing.2021 9th International Conference on Information and Communication Technology (ICoICT), 37:417–422, 2021

    2021

  6. [6]

    Two-party generation of DSA signatures.Int

    Philip MacKenzie and Michael Reiter. Two-party generation of DSA signatures.Int. J. Inf. Sec., 2(3-4):218–239, 2004

    2004

  7. [7]

    Proactive DSA application and implementation.Laboratories for the 21st century, San Francisco, CA (United States), 5-7 May 1998, 1998

    Timothy Draelos, Victoria Hamilton, and Istrail. Proactive DSA application and implementation.Laboratories for the 21st century, San Francisco, CA (United States), 5-7 May 1998, 1998

    1998

  8. [8]

    Advances in digital signature algorithms: Performance, security and future prospects.ITM Web of Conferences, 73:03010–03010, 2025

    Shuhan Lyu. Advances in digital signature algorithms: Performance, security and future prospects.ITM Web of Conferences, 73:03010–03010, 2025

    2025

Show all 55 references
  1. [9]

    Security system analysis in combination method: RSA encryption and digital signature algorithm.2018 4th International Conference on Science and Technology (ICST), 2018

    Farah Aufa and Achmad Affandi. Security system analysis in combination method: RSA encryption and digital signature algorithm.2018 4th International Conference on Science and Technology (ICST), 2018

    2018

  2. [10]

    Data integrity and security using keccak and digital signature algorithm (dsa).IJCCS (Indonesian Journal of Computing and Cybernetics Systems), 13(3):273–273, 2019

    Muhammad Nazal, Reza Pulungan, and Mardhani Riasetiawan. Data integrity and security using keccak and digital signature algorithm (dsa).IJCCS (Indonesian Journal of Computing and Cybernetics Systems), 13(3):273–273, 2019

    2019

  3. [11]

    Implementation of dual security through DSA and audio steganography.2015 International Conference on Green Computing and Internet of Things (ICGCIoT), 3:1349–1352, 2015

    Natasha Taneja and Prinima Gupta. Implementation of dual security through DSA and audio steganography.2015 International Conference on Green Computing and Internet of Things (ICGCIoT), 3:1349–1352, 2015

    2015

  4. [12]

    Bagas Yulianto, Budi Handoko, Eko Rachmawanto, and Arief Soeleman. Digital certificate authentication with three-level cryptography (SHA-256, DSA, 3DES).2022 International Seminar on Application for Technology of Information and Communication (iSemantic), pages 343–350, 2022

    2022

  5. [13]

    Eko Rachmawanto, Lekso Handoko, Chaerul Umam, Cahaya Jatmoko, and Rabei Ali. Triple DES cryptography based on hash function and DSA for digital certificate authentication.2022 International Seminar on Application for Technology of Information and Communication (iSemantic), pag...

    2022

  6. [14]

    Signature verification time reduction for GOST digital signature algorithm.2021 International Conference on Communication & Information Technology (ICICT), pages 279–283, 2021

    Hamza Al-Sewadi, Ruqa Al-Shnawa, and Mohammed Rifaat. Signature verification time reduction for GOST digital signature algorithm.2021 International Conference on Communication & Information Technology (ICICT), pages 279–283, 2021

    2021

  7. [15]

    Arindam Sarkar and Mandal. Energy-efficient wireless communication using genetic algorithm-guided faster lightweight digital signature algorithm (GADSA).International Journal Of Advanced Smart Sensor Network Systems ( IJASSN ), V ol 2, No.3, July 2012, 9-25, 2012

    2012

  8. [16]

    Nur Fitriani, Aminudin Aminudin, and Sofyan Arifianto. Perbandingan kinerja algoritma elliptic curve digital signature algorithm (ECDSA) menggunakan fungsi hash Secure Hash Algorithm (SHA-1) dan Keccak pada tanda tangan digital.Jurnal Repositor, 3(3), 2021

    2021

  9. [17]

    Implementasi hybrid cryptography dan secret sharing untuk menjaga kerahasiaan data pada cloud storage.2025, 2021

    AB Shaff. Implementasi hybrid cryptography dan secret sharing untuk menjaga kerahasiaan data pada cloud storage.2025, 2021

    2025

  10. [18]

    Implementasi algoritma asimetris DSA (Digital Signature Algorithm) dalam aplikasi sederhana untuk tanda tangan digital.JIKUM Jurnal Ilmu Komputer, 1(1):22–26, 2025

    Aulia Fitri, Izza Abdullah, Tegar Ramada, Rosita Saputri, Juwita Saharani, and Frizki Gultom. Implementasi algoritma asimetris DSA (Digital Signature Algorithm) dalam aplikasi sederhana untuk tanda tangan digital.JIKUM Jurnal Ilmu Komputer, 1(1):22–26, 2025

    2025

  11. [19]

    Implementasi tanda tangan digital berbasis kombinasi algoritma Digital Signature Algorithm dan Rivest–Shamir–Adleman.Jurnal Informatika, 2026

    Candra Kharisma, Suprapto Suprapto, and Alhadi Saputra. Implementasi tanda tangan digital berbasis kombinasi algoritma Digital Signature Algorithm dan Rivest–Shamir–Adleman.Jurnal Informatika, 2026

    2026

  12. [20]

    Ldsegov: An efficient lightweight digital-signature algorithm based on cdlp and provable security for e-governance authentication.Journal of Cybersecurity and Privacy, 2026

    Seema Sirpal, Pardeep Singh, and Om Pal. Ldsegov: An efficient lightweight digital-signature algorithm based on cdlp and provable security for e-governance authentication.Journal of Cybersecurity and Privacy, 2026

    2026

  13. [21]

    Introduction to cryptography for blockchain

    Islambek Saymanov, Iouliia Skliarova, Ilkhom Boykuziev, and Orif Allanov. Introduction to cryptography for blockchain. Transactions on Computer Systems and Networks, pages 1–38, 2025

    2025

  14. [22]

    Pre-shared key agreement for secure public wi-fi.arXiv preprint arXiv:1711.02293v4, 2017

    Seokseong Jeon, Chansu Yu, and Young-Joo Suh. Pre-shared key agreement for secure public wi-fi.arXiv preprint arXiv:1711.02293v4, 2017

    2017 arXiv

  15. [23]

    Towards ECDSA key derivation from deep embeddings for novel blockchain applications.arXiv preprint arXiv:1711.04069v1, 2017

    Christian Perone. Towards ECDSA key derivation from deep embeddings for novel blockchain applications.arXiv preprint arXiv:1711.04069v1, 2017

    2017 arXiv

  16. [24]

    On a new fast public key cryptosystem.arXiv preprint arXiv:1508.07756v2, 2015

    Samir Bouftass. On a new fast public key cryptosystem.arXiv preprint arXiv:1508.07756v2, 2015

    2015 arXiv

  17. [25]

    WalnutDSA: A quantum-resistant digital signature algorithm.arXiv preprint, 2017

    Iris Anshel, Derek Atkins, Goldfeld, and Paul Gunnells. WalnutDSA: A quantum-resistant digital signature algorithm.arXiv preprint, 2017. 10 DSA Nonce Vulnerability Analysis for CTF

    2017

  18. [26]

    Unconditionally secure quantum signatures.Entropy 2015, 17(8), 5635-5659, 2015

    Ryan Amiri and Erika Andersson. Unconditionally secure quantum signatures.Entropy 2015, 17(8), 5635-5659, 2015

    2015

  19. [27]

    NIST post-quantum cryptography standard algorithms based on quantum random number generators.Journal of Web Engineering ( V olume: 25, Issue: 5, July 2026), 2025

    Abel Chen. NIST post-quantum cryptography standard algorithms based on quantum random number generators.Journal of Web Engineering ( V olume: 25, Issue: 5, July 2026), 2025

    2026

  20. [28]

    Post-quantum blockchain: Challenges and opportunities.arXiv preprint arXiv:2508.17071v1, 2025

    Sufyan Al-Janabi. Post-quantum blockchain: Challenges and opportunities.arXiv preprint arXiv:2508.17071v1, 2025

    2025 arXiv

  21. [29]

    Towards Post-Quantum Blockchain: A Review on Blockchain Cryptography Resistant to Quantum Computing Attacks,

    Tiago Fernandez-Carames and Paula Fraga-Lamas. Towards post-quantum blockchain: A review on blockchain cryptography resistant to quantum computing attacks.T. M. Fernandez-Carames and P . Fraga-Lamas, "Towards Post-Quantum Blockchain: A Review on Blockchain Cryptography Resista...

    2020

  22. [30]

    Quorus: Efficient, scalable threshold ML-DSA signatures from MPC.Zenodo (CERN European Organization for Nuclear Research), 2026

    Alex Bienstock, Leo de Castro, Daniel Escudero, Antigoni Polychroniadou, and Akira Takahashi. Quorus: Efficient, scalable threshold ML-DSA signatures from MPC.Zenodo (CERN European Organization for Nuclear Research), 2026

    2026

  23. [31]

    Efficient threshold ML-DSA.IACR Cryptol

    Sofia Celi, Rafael del Pino, Thomas Espitau, Guilhem Niot, and Thomas Prest. Efficient threshold ML-DSA.IACR Cryptol. ePrint Arch., 2026:13, 2026

    2026

  24. [32]

    Towards post-quantum secure pharma- covigilance with ML-KEM and ML-DSA.arXiv preprint arXiv:2606.09412v1, 2026

    Saee Desai, Tom Shimoni, Eddie Cameron, David Akamine, and Aniketh Chunduri. Towards post-quantum secure pharma- covigilance with ML-KEM and ML-DSA.arXiv preprint arXiv:2606.09412v1, 2026

    2026 arXiv

  25. [33]

    Efficient ML-DSA public key management method with identity for PKI and its application.arXiv (Cornell University), abs/2603.25043, 2026

    Penghui Liu, Yi Niu, Xiaoxiong Zhong, Jiahui Wu, Weizhe Zhang, Kaiping Xue, and Bin Xiao. Efficient ML-DSA public key management method with identity for PKI and its application.arXiv (Cornell University), abs/2603.25043, 2026

    2026 arXiv

  26. [34]

    The qey: Implementation and performance study of post-quantum cryptography in FIDO2

    Aditya Mitra and Sibi Sethuraman. The qey: Implementation and performance study of post-quantum cryptography in FIDO2. arXiv preprint arXiv:2510.21353v1, 2025

    2025

  27. [35]

    High-performance unified hardware architecture for ML-DSA and ML-KEM PQC standards.IEEE Access, 13:189444–189460, 2025

    Quang Truong, Yunseong Jang, and Hanho Lee. High-performance unified hardware architecture for ML-DSA and ML-KEM PQC standards.IEEE Access, 13:189444–189460, 2025

    2025

  28. [36]

    High-performance NTT hardware accelerator to support ML-KEM and ML-DSA.ASHES@CCS, pages 100–105, 2024

    Dur-e-Shahwar Kundi, Jose Mera, Pierre-Yves Strub, and Michael Hutter. High-performance NTT hardware accelerator to support ML-KEM and ML-DSA.ASHES@CCS, pages 100–105, 2024

    2024

  29. [37]

    An area-efficient ML-DSA accelerator with interleaved and dynamic execution.IEEE Trans

    Jinwei Pu, Yan Xu, Yuan Zhang, and Jiliang Zhang. An area-efficient ML-DSA accelerator with interleaved and dynamic execution.IEEE Trans. Circuits Syst. I Regul. Pap., 73(5):1–14, 2025

    2025

  30. [38]

    Deferred reduction optimizations for post-quantum lattice cryptography: ML-KEM and ML-DSA.Zenodo (CERN European Organization for Nuclear Research), 2025

    Mamone Kurdi. Deferred reduction optimizations for post-quantum lattice cryptography: ML-KEM and ML-DSA.Zenodo (CERN European Organization for Nuclear Research), 2025

    2025

  31. [39]

    Optimized NTT architecture based on the plantard algorithm for ML-KEM and ML-DSA.IEEE Transactions on Computers, 75(6):2141–2154, 2026

    Jiansheng Chen, Bei Wang, Ziying Ni, Mengxue Li, Fei Lyu, Yijun Cui, and Weiqiang Liu. Optimized NTT architecture based on the plantard algorithm for ML-KEM and ML-DSA.IEEE Transactions on Computers, 75(6):2141–2154, 2026

    2026

  32. [40]

    Shreya Khodanpur. Accelerating the post-quantum transition: A GPU-based performance comparison of ML-KEM and ML-DSA.2026 International Conference on Current Trends in Advanced Computing (ICCTAC), 2026

    2026

  33. [41]

    Improved ML-DSA hardware implementation with first-order masking countermeasure.J

    Kamal Raj, Prasanna Ravi, Tee Chia, and Anupam Chattopadhyay. Improved ML-DSA hardware implementation with first-order masking countermeasure.J. Hardw. Syst. Secur ., 10(1):9, 2026

    2026

  34. [42]

    RVSLH: Acceleration of postquantum standard SLH-DSA with customized RISC-V processor.IEEE Trans

    Zewen Ye, Xin Li, Chuhui Wang, Ray Cheung, and Kejie Huang. RVSLH: Acceleration of postquantum standard SLH-DSA with customized RISC-V processor.IEEE Trans. V ery Large Scale Integr . Syst., 33(7):1999–2003, 2025

    1999

  35. [43]

    Side-channel analysis dataset for unified ML-DSA and ML-KEM hardware implementations (ML-DSA part).Zenodo (CERN European Organization for Nuclear Research), 2026

    Patrik Dobias, Aikata Aikata, Azade Rezaeezade, Lejla Batina, Lukas Malina, and Tomas Gerlich. Side-channel analysis dataset for unified ML-DSA and ML-KEM hardware implementations (ML-DSA part).Zenodo (CERN European Organization for Nuclear Research), 2026

    2026

  36. [44]

    Benchmarking post-quantum cryptography on resource-constrained IoT devices: ML-KEM and ML-DSA on ARM Cortex-M0+.arXiv (Cornell University), 2026

    Rojin Chhetri. Benchmarking post-quantum cryptography on resource-constrained IoT devices: ML-KEM and ML-DSA on ARM Cortex-M0+.arXiv (Cornell University), 2026

    2026

  37. [45]

    SLasH-DSA: Breaking SLH-DSA using an extensible end-to-end rowhammer framework.Proceedings of the Microarchitecture Security Conference, 2026

    Jeremy Boy, Antoon Purnal, Anna Patschke, Luca Wilke, and Thomas Eisenbarth. SLasH-DSA: Breaking SLH-DSA using an extensible end-to-end rowhammer framework.Proceedings of the Microarchitecture Security Conference, 2026

    2026

  38. [46]

    Security evaluation of post-quantum ML-DSA implementations against software-induced fault attacks.RIT Scholar Works (Rochester Institute of Technology), 2026

    Alexis Korensky. Security evaluation of post-quantum ML-DSA implementations against software-induced fault attacks.RIT Scholar Works (Rochester Institute of Technology), 2026

    2026

  39. [47]

    Signature split method for a PQC-DSA compliant with V2V communication standards

    Youngbeom Kim and Seog Seo. Signature split method for a PQC-DSA compliant with V2V communication standards. SHILAP Revista de lepidopterología, 13(10):5874–5874, 2023

    2023

  40. [48]

    The insecurity of the digital signature algorithm with partially known nonces.Birkhäuser Basel eBooks, pages 201–206, 2003

    Igor Shparlinski. The insecurity of the digital signature algorithm with partially known nonces.Birkhäuser Basel eBooks, pages 201–206, 2003

    2003

  41. [49]

    Digital signature algorithm: A hybrid approach.International Journal of Advanced Computer Science and Applications, 14(3), 2023

    Prajwal Hegde and Veena Shastrimath. Digital signature algorithm: A hybrid approach.International Journal of Advanced Computer Science and Applications, 14(3), 2023

    2023

  42. [50]

    The variant of digital signature algorithm for constant message.J

    Kritsanapong Somsuk, Sarutte Atsawaraungsuk, Chanwit Suwannapong, Suchart Khummanee, and Chalida Sanemueang. The variant of digital signature algorithm for constant message.J. Internet Serv. Inf. Secur ., 13(2):81–95, 2023

    2023

  43. [51]

    Cryptography survey of DSS and DSA.Lecture Notes in Mechanical Engineering, pages 661–669, 2020

    Mohammed Al-Absi, Azamjon Abdullaev, Ahmed Al-Absi, Mangal Sain, and Hoon Lee. Cryptography survey of DSS and DSA.Lecture Notes in Mechanical Engineering, pages 661–669, 2020

    2020

  44. [52]

    Elliptic curve digital signature algorithm.arXiv preprint https://libres.uncg.edu/ir/asu/listing.aspx?id=36182, 2021

    Johnson. Elliptic curve digital signature algorithm.arXiv preprint https://libres.uncg.edu/ir/asu/listing.aspx?id=36182, 2021. 11 DSA Nonce Vulnerability Analysis for CTF

    2021

  45. [53]

    ECC, RSA, and DSA analogies in applied mathematics.International Conference on Statistics, Applied Mathematics, and Computing Science (CSAMCS 2021), 2022

    Wenxin Yang. ECC, RSA, and DSA analogies in applied mathematics.International Conference on Statistics, Applied Mathematics, and Computing Science (CSAMCS 2021), 2022

    2021

  46. [54]

    The improvement of digital signature algorithm based on elliptic curve cryptography.Advances in Intelligent Systems and Computing, pages 327–337, 2020

    Svitlana Kazmirchuk, Anna Ilyenko, Sergii Ilyenko, Olena Prokopenko, and Yana Mazur. The improvement of digital signature algorithm based on elliptic curve cryptography.Advances in Intelligent Systems and Computing, pages 327–337, 2020

    2020

  47. [55]

    Penetration testing for system security: Methods and practical approaches.arXiv preprint arXiv:2505.19174, 2025

    Wei Zhang, Ju Xing, and Xiaoqi Li. Penetration testing for system security: Methods and practical approaches.arXiv preprint arXiv:2505.19174, 2025. 12

    2025

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.