ML-DSA-87 explained — the signature behind QRL 2.0

QRL 2.0 keeps QRL's quantum-resistant promise but signs transactions with a different scheme than QRL Legacy. Where the legacy chain uses the hash-based XMSS, QRL 2.0 uses ML-DSA-87, a lattice-based signature standardised by NIST. This guide explains what that means and why the project switched.

A different kind of post-quantum signature

There are two main families of post-quantum signatures, and QRL uses one of each:

• Hash-based (XMSS, on QRL Legacy) — security comes from hash functions; the scheme is stateful.
• Lattice-based (ML-DSA-87, on QRL 2.0) — security comes from the hardness of certain problems over mathematical lattices; the scheme is stateless.

ML-DSA-87 comes from the CRYSTALS-Dilithium scheme, which NIST selected and standardised in 2024 as FIPS 204. Its security rests on lattice problems (Module-LWE and Module-SIS) that are believed hard for both classical and quantum computers. As with all of post-quantum cryptography, "believed hard" means no efficient attack is known — there is no mathematical proof of unbreakability for any practical scheme.

What the "87" means

ML-DSA is defined at three security levels. The number in "ML-DSA-87" identifies the highest one — NIST security level 5, the most conservative parameter set. In implementation terms that level uses a larger internal matrix (8 rows by 7 columns) than the lower levels, which is part of what gives it its strong security margin at the cost of larger keys and signatures.

QRL 2.0 deliberately chose the strongest level rather than a smaller, faster one — consistent with a project whose reason to exist is long-term resistance to quantum attack.

Stateless: the big practical win

The most important everyday difference from XMSS is that ML-DSA-87 is stateless.

With XMSS, a wallet must track its OTS index and never reuse a one-time key. With ML-DSA-87 there is no index and no one-time key — you can sign as many times as you like with the same key, just like you can with ECDSA. That makes wallets, backups and integrations considerably simpler and removes a whole category of "did I reuse a key?" footguns.

The cost is size: lattice signatures are larger than elliptic-curve ones. For a chain that is already EVM-compatible and fee-metered by gas, that size is an accepted trade-off.

Domain separation and hedged signing

A couple of implementation details are worth knowing, because they show the scheme is used carefully:

• Context string. ML-DSA supports a "context" value that separates signatures made for different purposes so a signature can't be replayed out of context. QRL's wallet uses a fixed context derived from the project name.
• Hedged signing. By default the implementation signs in hedged mode (mixing in fresh randomness), which FIPS 204 recommends because it is more robust against certain side-channel and bad-randomness failures than pure deterministic signing.

Only ML-DSA-87 at consensus

QRL's cryptographic libraries contain more than one post-quantum scheme (you may see references to Dilithium variants or SPHINCS+). For the running QRL 2.0 chain, only ML-DSA-87 is accepted for wallet transactions — the execution client rejects other wallet types. Treat the other schemes as library or tooling history, not as something the chain validates today.

ML-DSA-87 vs XMSS at a glance

Where to go next

• XMSS explained — the hash-based scheme on QRL Legacy.
• QRL address formats — how each chain derives its addresses.
• The QRL → QRL 2.0 migration — how value moves between the two schemes.