How to sign and verify with ML-DSA-65 with OpenSSL

1# An ML-DSA-65 key pair (OpenSSL 3.5 or later)
2openssl genpkey -algorithm ML-DSA-65 -out key.pem
3openssl pkey -in key.pem -pubout -out pub.pem
4 
5# -rawin: the whole message goes in, ML-DSA hashes it internally
6openssl pkeyutl -sign -inkey key.pem -rawin -in message.txt -out message.sig
7openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in message.txt -sigfile message.sig

1# A context string binds the signature to one purpose; verify must pass the same one
2openssl pkeyutl -sign -inkey key.pem -rawin -in message.txt -pkeyopt context-string:invoice-v1 -out ctx.sig
3openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in message.txt -sigfile ctx.sig -pkeyopt context-string:invoice-v1
4 
5# Deterministic signing and a key from a known 32-byte seed: the same signature every time
6openssl genpkey -algorithm ML-DSA-65 -pkeyopt hexseed:$SEED_HEX -out seeded.pem
7openssl pkeyutl -sign -inkey seeded.pem -rawin -in message.txt -pkeyopt deterministic:1 -out det.sig

How it works

1. openssl genpkey -algorithm ML-DSA-65 creates the private key; openssl pkey -pubout writes the public key as SubjectPublicKeyInfo (BEGIN PUBLIC KEY, 1974 bytes of DER).
2. openssl pkeyutl -sign -rawin passes the whole message to ML-DSA, which hashes it internally; the signature is always 3309 bytes for ML-DSA-65.
3. -pkeyopt context-string:… binds the signature to a purpose (FIPS 204 allows up to 255 bytes); verification must pass the same context.
4. -pkeyopt hexseed: derives the key from a 32-byte seed and -pkeyopt deterministic:1 turns off the signing randomness: the run reproduces the shared test signature (SHA-256 9456b955…68a6) exactly, and verifies it with the shared public key.

Gotchas

• Default signing is randomized ("hedged"): two signatures of the same message differ, and both verify. Do not compare signatures to check them; compare only with deterministic signing on both sides.
• OpenSSL writes the private key as seed plus expanded key by default (4098 bytes of DER). Go and pyca/cryptography refuse that form; openssl pkey -provparam ml-dsa.output_formats=seed-only writes the 54-byte seed-only PKCS#8 every library reads.
• ML-DSA takes no separate digest: openssl dgst -sha256 -sign key.pem fails with error:1C80007A:Provider routines:ml_dsa_digest_signverify_init:invalid digest. Use pkeyutl -rawin.
• A signature made with a context string fails without it (Signature Verification Failure), as does a tampered message.

Related recipes

• How to sign and verify with ML-DSA-65 in Python
• How to sign and verify with ML-DSA-65 in Go
• How to sign and verify with ML-DSA-65 in Node.js
• How to encapsulate and decapsulate a shared secret with ML-KEM-768 with OpenSSL
• How to sign and verify Ed25519 signatures with OpenSSL