· Michal Pietrus · 4 min read
Ecosystem resilience perspective
Bernstein's latest paper gives the perspective that due to implementation bugs, the estimated number of breakable ML-DSA keys could reach the order of 2²⁷ in 2027.
On the one hand, he is an exceptional mind, someone capable of looking at problems holistically, from the design of cryptographic schemes, through their implementation, all the way to real-world deployment and maintenance. On the other, he is the author or co-author of cryptographic solutions that are now used at significant scale in digital communication, across many market domains.
Thirdly, he is someone who consistently challenges accepted assumptions and often provides his own alternatives, more efficient, more transparent, but often both.. In this context, it is worth comparing, for example, the history of Dual_EC_DRBG, which clearly shows why transparency and trust in the standardization process are of fundamental importance in cryptography.
Fourthly, he is also an idealist who has been fighting for secure digital communication, from the perspective of the ordinary consumer, essentially since the beginning of serious digital transformation (essay, warning: long).
Therefore, DJB’s perspective on potential problems (and their consequences) related to ML-DSA is not some abstract claim pulled out of a hat, but a potentially realistic scenario that is worth including in threat modeling.
The AABBCC problem and the nonce-reuse issue discussed in the paper
Bernstein examines ML-DSA, a recently standardized post-quantum digital signature scheme, and shows how easy-to-make implementation bugs can pass functional tests (and even interoperability tests!).
So what? Bugs have always existed, and they always will.
Sure. That’s exactly why one should consider a hybrid construct for signing, namely, using both ECC (preQ) and ML-DSA (postQ).
The bugs Bernstein points to are subtle, because they produce valid signatures that nevertheless allow an attacker to recover the private key, and therefore forge signatures. The AABBCC coefficients issue practically requires including a deterministic RNG (Random Number Generator) in the tests. In other words, swapping in a component in the ML-DSA scheme that produces predictable output.
In the context of the second issue, involving nonce handling and its similarity to the Sony PlayStation 3 problem from years ago, a small implementation bug indeed leads to a situation where the nonce is no longer one-time-use. This, on the other hand, results in a “nonce-reuse” problem that makes a catastrophic failure from the ecosystem’s point of view, allowing the private key to be recovered.
Especially in the first case, it is hard not to see parallels with kleptographic attacks, for example those manipulating the RNG, which in ML-DSA have similar consequences. Papers: Backdooring Post-Quantum Cryptography: Kleptographic Attacks on Lattice-based KEMs, Kilobyte-Bandwidth Subliminal Channels in FIPS 204 ML-DSA via Packed-Commitment Embedding.
Quantitative model for estimating impact of unpatched vulnerabilities across implementations
The paper demonstrates a quantitative methodology for estimating how hybrid signing vs. solo ML-DSA impacts the whole ecosystem and the number of breakable keys.
Worth mentioning some critical numbers from the paper:
- the total number of active keys used is 2^30
- the total number of unpatched vulnerabilities for ML-DSA implementations is 18% in 2027
- the total number of unpatched vulnerabilities for Ed25519 curve implementations (ECC family) is 1.6% in 2027
- the total number of unpatched vulnerabilities for both (hybrid mode) is 4.0928% in 2027
Thus, the total number of potentially breakable signing keys (due to impl bugs):
- for ML-DSA 2^(27.5) in 2027
- for hybrid mode 2^(25.4) in 2027
- for Ed25519 curve 2^(24) in 2027
To spot the difference:
- 2^(24) = 16 777 216,
- 2^(25.4) ≈ 44 275 338,
- 2^(27.5) ≈ 189 812 531,
- 2^(30) = 1 073 741 824
This is a model full of assumptions, most of which aren’t explained here. It may also be justified why to take such models seriously at all.
Recall, however, that ML-DSA is being considered as the major ingredient for post-quantum WEB PKI, which is the workhorse that lets people access digital services to authenticate them and establish confidential communication channels.
Outcome
But what does this modeling tell you? Merely looking at numbers, it tells you the scale and impact, but it isn’t the full picture. A holistic view of a cryptosystem includes the standardized algorithm, the ecosystem maturity, the implementation, the assembly of cryptographic components (i.e.PRG), and key lifecycle or downgrade resistance.
Aren’t hybrids more complex? Yes, they add complexity. More algorithms, larger certs, more verification logic, and more space for downgrade or integration mistakes.
Governance, agency, and crypto-agility as a path forward
However, this is exactly why the post-quantum transition shouldn’t be treated as a simple algorithm replacement. It should also fix what digital transformation got wrong, and this is treating cryptography as a technical by-product bundled into systems, rather than as an operational asset.
If you think of future agility (i.e., via NIST CSWP 39), it makes the transition (and its complexity) manageable, visible, and governable. The technical execution, whether to use A, B, A and B, becomes the governance policy enforcement.
Caveats exist, i.e., short-lived SPIFFE certs, but hybrid designs reduce the blast radius of single-algorithm and single-implementation failures.
