# ML-DSA-87 explained — the signature behind QRL 2.0

> How ML-DSA-87, the NIST-standardised lattice signature, secures QRL 2.0 — and why it is stateless, unlike XMSS.

[QRL 2.0](/learn/glossary#qrl2) keeps QRL's quantum-resistant promise but signs transactions with a different scheme than QRL Legacy. Where the legacy chain uses the hash-based [XMSS](/learn/xmss-explained), QRL 2.0 uses **ML-DSA-87**, a lattice-based signature standardised by NIST. This guide explains what that means and why the project switched.

## A different kind of post-quantum signature

There are two main families of post-quantum signatures, and QRL uses one of each:

- **Hash-based** (XMSS, on QRL Legacy) — security comes from hash functions; the scheme is stateful.
- **Lattice-based** (ML-DSA-87, on QRL 2.0) — security comes from the hardness of certain problems over mathematical *lattices*; the scheme is stateless.

ML-DSA-87 comes from the **CRYSTALS-Dilithium** scheme, which NIST selected and standardised in 2024 as **FIPS 204**. Its security rests on lattice problems (Module-LWE and Module-SIS) that are believed hard for both classical and quantum computers. As with all of [post-quantum cryptography](/learn/glossary#post-quantum), "believed hard" means no efficient attack is known — there is no mathematical proof of unbreakability for any practical scheme.

## What the "87" means

ML-DSA is defined at three security levels. The number in "ML-DSA-87" identifies the **highest** one — NIST security level 5, the most conservative parameter set. In implementation terms that level uses a larger internal matrix (8 rows by 7 columns) than the lower levels, which is part of what gives it its strong security margin at the cost of larger keys and signatures.

QRL 2.0 deliberately chose the strongest level rather than a smaller, faster one — consistent with a project whose reason to exist is long-term resistance to quantum attack.

## Stateless: the big practical win

The most important everyday difference from XMSS is that **ML-DSA-87 is stateless**.

With XMSS, a wallet must track its [OTS index](/learn/glossary#ots) and never reuse a one-time key. With ML-DSA-87 there is no index and no one-time key — you can sign as many times as you like with the same key, just like you can with ECDSA. That makes wallets, backups and integrations considerably simpler and removes a whole category of "did I reuse a key?" footguns.

The cost is size: lattice signatures are larger than elliptic-curve ones. For a chain that is already EVM-compatible and fee-metered by [gas](/learn/glossary#gas), that size is an accepted trade-off.

## Domain separation and hedged signing

A couple of implementation details are worth knowing, because they show the scheme is used carefully:

- **Context string.** ML-DSA supports a "context" value that separates signatures made for different purposes so a signature can't be replayed out of context. QRL's wallet uses a fixed context derived from the project name.
- **Hedged signing.** By default the implementation signs in *hedged* mode (mixing in fresh randomness), which FIPS 204 recommends because it is more robust against certain side-channel and bad-randomness failures than pure deterministic signing.

## Only ML-DSA-87 at consensus

QRL's cryptographic libraries contain more than one post-quantum scheme (you may see references to Dilithium variants or SPHINCS+). For the **running QRL 2.0 chain, only ML-DSA-87 is accepted** for wallet transactions — the execution client rejects other wallet types. Treat the other schemes as library or tooling history, not as something the chain validates today.

## ML-DSA-87 vs XMSS at a glance

![Side-by-side comparison of the two signature schemes. XMSS on QRL Legacy is hash-based, stateful (it tracks an OTS index), uses each one-time key once, and has no known quantum attack. ML-DSA-87 on QRL 2.0 is lattice-based (NIST FIPS 204), stateless with no index to track, lets a key be reused freely, at the cost of larger signatures.](diagram:signature-schemes "XMSS (hash-based, stateful) versus ML-DSA-87 (lattice-based, stateless) — the two post-quantum signatures QRL uses across its chains.")

| | XMSS (QRL Legacy) | ML-DSA-87 (QRL 2.0) |
|---|---|---|
| Family | Hash-based | Lattice-based |
| Standard | RFC 8391 | NIST FIPS 204 |
| State | Stateful (OTS index) | Stateless |
| Reuse risk | Must not reuse a key | Safe to reuse |
| Address length | 79 chars | 41 chars |

## Where to go next

- [XMSS explained](/learn/xmss-explained) — the hash-based scheme on QRL Legacy.
- [QRL address formats](/learn/qrl-address-formats) — how each chain derives its addresses.
- [The QRL → QRL 2.0 migration](/learn/the-qrl-migration) — how value moves between the two schemes.