wolfSSL optimizes ML-DSA signing for HSM performance

wolfSSL has introduced an optimization for its wolfHSM product that targets performance bottlenecks in post-quantum digital signatures. The company is implementing an "External-Mu" approach for ML-DSA, a post-quantum cryptographic algorithm, to improve signing efficiency when using hardware security modules (HSMs).

What the optimization does

ML-DSA, a post-quantum signature scheme, requires computing a hash value called Mu as the first step in both signing and verification. This hash combines a truncated public key hash, a context string, and the message itself using the SHAKE-256 algorithm. While the Mu value is fixed at 64 bytes, the message being signed can be arbitrarily large, creating potential performance issues when the computation occurs on an HSM with limited processing power or slow transport interfaces.

The External-Mu optimization moves the Mu hash computation from the HSM to the client application. Since Mu depends only on public data—the public key, context string, and message—this shift does not compromise security. By performing this step on the client side, wolfSSL aims to reduce the data volume sent to the HSM and minimize processing delays, particularly for large messages or in environments with constrained HSM performance.

Implementation context

wolfSSL's wolfHSM product provides cryptographic acceleration and secure key storage for embedded systems and enterprise environments. The company notes that while this optimization is specific to ML-DSA, wolfSSL also supports HashML-DSA, a related but distinct algorithm with different identifiers. Interoperability considerations may limit the applicability of External-Mu in some deployments, though wolfSSL has not detailed specific compatibility constraints.

Potential impact and adoption

The optimization is currently in development, with wolfSSL indicating that its priority may increase based on customer demand. Organizations using wolfHSM for ML-DSA signing could see reduced latency, particularly in scenarios involving large messages or performance-constrained HSMs. However, the company has not released benchmarks or specific performance metrics for the External-Mu approach.

For deployments where interoperability with other ML-DSA implementations is critical, the optimization may require additional validation to ensure compatibility. wolfSSL has invited users to contact them to express interest or request further details about the feature.

What to watch

The success of this optimization will likely depend on two factors: customer adoption of ML-DSA in HSM environments and the performance gains achieved in real-world deployments. If wolfSSL releases benchmark data or case studies, these could provide clearer guidance on the practical benefits of External-Mu. Additionally, broader industry trends toward post-quantum cryptography may influence demand for such optimizations as organizations prepare for quantum-resistant security standards.