mldsa_native 1.0.0

ML-DSA (FIPS 204) post-quantum signatures for Flutter. Native C/assembly implementation via FFI.

mldsa_native

A Flutter FFI plugin that provides native ML-DSA (Module Lattice-based Digital Signature Algorithm) cryptographic operations. This plugin wraps the mldsa-native library to provide high-performance post-quantum signatures for Flutter applications.

Features

• Post-Quantum Security: Implements ML-DSA, a quantum-resistant digital signature scheme standardized as FIPS 204
• Multiple Security Levels: Support for ML-DSA-44 (category 2), ML-DSA-65 (category 3), and ML-DSA-87 (category 5)
• High Performance: Native C/Assembly implementation optimized for ARM64 and x86_64
• Deterministic or Randomized: Supports both randomized signing and deterministic key generation from a seed
• Domain Separation: Context parameter support for application-level domain separation
• Cross-Platform: Works on Android, iOS, macOS, Linux, and Windows
• Type Safety: Full Dart type safety with proper error handling

Supported Platforms

• Android (ARM64, x86_64)
• iOS (ARM64)
• macOS (ARM64, x86_64)
• Linux (x86_64, ARM64)
• Windows (x86_64)

Security Levels

Parameter Set	Public Key	Secret Key	Signature	Security Category
ML-DSA-44	1312 bytes	2560 bytes	2420 bytes	Category 2
ML-DSA-65	1952 bytes	4032 bytes	3309 bytes	Category 3
ML-DSA-87	2592 bytes	4896 bytes	4627 bytes	Category 5

Quick Start

Installation

Add mldsa_native to your pubspec.yaml:

dependencies:
  mldsa_native: ^0.0.1

Basic Usage

import 'package:mldsa_native/mldsa44.dart';

void main() {
  // Create an instance for ML-DSA-44
  final mldsa = MLDSA44();

  // Generate a key pair
  final keyPair = mldsa.generateKeyPair();

  // Sign a message
  final signature = mldsa.sign(keyPair.secretKey, utf8.encode('Hello, world!'));

  // Verify the signature
  final valid = mldsa.verify(keyPair.publicKey, utf8.encode('Hello, world!'), signature);
  print('Signature valid: $valid');
}

Choosing a Security Level

import 'package:mldsa_native/mldsa44.dart';
import 'package:mldsa_native/mldsa65.dart';
import 'package:mldsa_native/mldsa87.dart';

void main() {
  final mldsa44 = MLDSA44();  // Category 2 — smallest keys/signatures
  final mldsa65 = MLDSA65();  // Category 3 — balanced
  final mldsa87 = MLDSA87();  // Category 5 — strongest security

  final message = utf8.encode('Sign this message');

  // Each variant works identically
  final kp = mldsa65.generateKeyPair();
  final sig = mldsa65.sign(kp.secretKey, message);
  final ok = mldsa65.verify(kp.publicKey, message, sig);
  print('ML-DSA-65 verify: $ok');
}

Deterministic Key Generation

import 'dart:typed_data';
import 'package:mldsa_native/mldsa44.dart';
import 'package:mldsa_native/src/models.dart' show getRandomCoins;

void main() {
  final mldsa = MLDSA44();
  final coins = getRandomCoins();  // 32 random bytes

  // Same coins produce the same key pair
  final kp1 = mldsa.generateKeyPair(coins: coins);
  final kp2 = mldsa.generateKeyPair(coins: coins);
  assert(kp1.publicKey == kp2.publicKey);
}

Domain Separation (Context)

final ctx = utf8.encode('my-application-context');

// Sign with context
final sig = mldsa.sign(sk, msg, context: ctx);

// Verify with context — must match
final ok = mldsa.verify(pk, msg, sig, context: ctx);

// Wrong context — verification fails
final fail = mldsa.verify(pk, msg, sig, context: utf8.encode('other'));

API Reference

Classes

MLDSA44, MLDSA65, MLDSA87 — main classes for ML-DSA operations at different security levels. All implement the MLDSA interface.

Methods:

• KeyPair generateKeyPair({Uint8List? coins}) — generates a new key pair (deterministic if coins is provided)
• Uint8List sign(Uint8List secretKey, Uint8List message, {Uint8List? context, Uint8List? coins}) — signs a message, returns the signature
• bool verify(Uint8List publicKey, Uint8List message, Uint8List signature, {Uint8List? context}) — verifies a signature, returns true if valid

KeyPair

• Uint8List publicKey — the public verification key
• Uint8List secretKey — the secret signing key

Exceptions

• MLDSAException — base exception for all ML-DSA errors
• MLDSAKeyPairGenerationException — key generation failed (also thrown on signing failures)
• MLDSACoinsWrongSize — the provided coins buffer was not exactly 32 bytes

About

This is a Flutter port of the mldsa-native library, a high-assurance C implementation of ML-DSA (FIPS 204) developed by the Post-Quantum Cryptography Alliance. The native code is compiled via native_toolchain_c and invoked through Dart FFI with bindings generated by package:ffigen.

Links

• mldsa-native Repository
• FIPS 204 — ML-DSA Specification
• Post-Quantum Cryptography at NIST
• Flutter FFI Documentation