{
  "draft": "draft-ietf-lamps-pq-composite-sigs-19",
  "doc_id": "RFC10073",
  "title": "Composite Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for Use in X.509 Public Key Infrastructure",
  "authors": [
    "M. Ounsworth",
    "J. Gray",
    "M. Pala",
    "J. Klau\u00dfner",
    "S. Fluhrer"
  ],
  "format": [
    "XML",
    "TEXT",
    "HTML",
    "PDF"
  ],
  "page_count": "196",
  "pub_status": "PROPOSED STANDARD",
  "status": "PROPOSED STANDARD",
  "source": "Limited Additional Mechanisms for PKIX and SMIME",
  "abstract": "This document defines a PQ/T hybrid scheme with concrete instantiations that combine the US NIST Module-Lattice-Based Digital Signature Algorithm (ML-DSA) with traditional algorithms RSASSA-PKCS1-v1_5, RSASSA-PSS, ECDSA, Ed25519, and Ed448. These combinations are tailored to meet regulatory guidelines in certain regions. Composite ML-DSA is applicable in applications that use X.509 or PKIX data structures that accept ML-DSA, but where the operator wants extra protection against breaks or catastrophic bugs in ML-DSA and where the level of security provided by Existential Unforgeability under Chosen Message Attack (EUF-CMA) is acceptable.",
  "pub_date": "November 2026",
  "keywords": [
    "PQ/T hybrid",
    "post-quantum",
    "PKI"
  ],
  "obsoletes": [],
  "obsoleted_by": [],
  "updates": [],
  "updated_by": [],
  "see_also": [],
  "doi": "10.17487/RFC10073",
  "errata_url": null
}