Home / Tools / Post-quantum key sizes
Free tool · runs in your browser
Post-quantum key and signature sizes: ML-KEM and ML-DSA vs RSA and ECC
Post-quantum cryptography is bigger. An ML-KEM-768 public key is 1,184 bytes against 32 for X25519, and an ML-DSA-65 signature is 3,309 bytes against 64 for Ed25519. The chart compares them; the tables below list every size.
Built by Kyeson Blake Utley for the free Quantum Defense course.
Key exchange (KEMs), in bytes
| Algorithm | Type | Public key | Ciphertext | Notes |
|---|---|---|---|---|
| X25519 | Classical | 32 | 32 | Classical elliptic-curve key exchange. Broken by Shor. |
| RSA-2048 | Classical | 256 | 256 | Classical RSA key transport. Broken by Shor. |
| ML-KEM-512 | Post-quantum | 800 | 768 | FIPS 203, NIST category 1. |
| ML-KEM-768 | Post-quantum | 1,184 | 1,088 | FIPS 203, category 3. The one inside X25519MLKEM768. |
| ML-KEM-1024 | Post-quantum | 1,568 | 1,568 | FIPS 203, category 5. Required by CNSA 2.0. |
Signatures, in bytes
| Algorithm | Type | Public key | Signature | Notes |
|---|---|---|---|---|
| Ed25519 | Classical | 32 | 64 | Classical. Broken by Shor. |
| ECDSA P-256 | Classical | 33 | 64 | Classical. Broken by Shor. |
| RSA-2048 | Classical | 256 | 256 | Classical. Broken by Shor. |
| ML-DSA-44 | Post-quantum | 1,312 | 2,420 | FIPS 204, lattice-based. |
| ML-DSA-65 | Post-quantum | 1,952 | 3,309 | FIPS 204, lattice-based. |
| ML-DSA-87 | Post-quantum | 2,592 | 4,627 | FIPS 204. Required by CNSA 2.0. |
| SLH-DSA-SHA2-128s | Post-quantum | 32 | 7,856 | FIPS 205, hash-based. Tiny key, big signature, slow to sign. |
| SLH-DSA-SHA2-128f | Post-quantum | 32 | 17,088 | FIPS 205, hash-based. Faster signing, even bigger signature. |
Why the sizes matter
For most web traffic, a few extra kilobytes in a handshake are invisible. They bite anywhere that assumed public keys and signatures were tiny: a TLS ClientHello that no longer fits in one packet, certificate chains that carry several signatures, constrained devices, firmware images, and blockchains that store every signature forever.
- ML-KEM (FIPS 203) replaces key exchange. Its keys and ciphertexts are around a kilobyte, which is why hybrid TLS already works on the web.
- ML-DSA (FIPS 204) is the general-purpose signature replacement. Its signatures are 2.4 to 4.6 KB.
- SLH-DSA (FIPS 205) relies only on hash functions. Its public key is just 32 bytes, but signatures run from 7,856 to 17,088 bytes and signing is slow, so it suits rare, high-value signatures such as firmware.
Sizes are from NIST FIPS 203, 204 and 205. ECDSA signatures are shown in raw form; DER encoding adds a few bytes.
This tool comes from Lesson 7: Meet the new standards: ML-KEM, ML-DSA and friends, part of a free 18-lesson post-quantum cryptography course. Every figure there links to its source.
Questions
How big is an ML-KEM key?
ML-KEM-512, 768 and 1024 have encapsulation (public) keys of 800, 1,184 and 1,568 bytes, and ciphertexts of 768, 1,088 and 1,568 bytes, per NIST FIPS 203.
How big is an ML-DSA signature?
ML-DSA-44, 65 and 87 produce signatures of 2,420, 3,309 and 4,627 bytes, with public keys of 1,312, 1,952 and 2,592 bytes, per NIST FIPS 204.
Why are post-quantum signatures so much bigger than ECDSA?
Elliptic-curve schemes get their compactness from a mathematical structure that Shor's algorithm breaks. Lattice and hash-based schemes rest on problems with no known quantum shortcut, and that security currently costs bytes.
Which post-quantum standard has the smallest public key?
Among the NIST standards, SLH-DSA has a 32-byte public key, the same as Ed25519, but pays for it with signatures of roughly 8 to 17 KB.