ML-DSA Certificate-Chain Byte Budget

Estimate the raw ML-DSA key and signature contribution to a certificate chain, then add user-measured DER/TLS overhead and compare the result with a byte budget. This is a byte arithmetic tool, not a certificate encoder or TLS handshake simulator.

ML-DSA parameter setML-DSA public keys in chain (keys)ML-DSA signatures in chain (signatures)Other certificate-chain bytes (DER/TLS overhead) (bytes)Certificate-chain byte budget (bytes)

Result

Projected chain bytes

Raw ML-DSA key and signature bytes

Budget headroom (negative means over budget)

Budget used

Public key size per key

Signature size per signature

How to use this tool

Choose the ML-DSA parameter set used for the keys and signatures being counted.
Enter the number of ML-DSA public keys and certificate signatures present in the transmitted chain.
Enter the bytes for all other certificate and DER/TLS framing, then set the chain budget you need to meet.
Compare projected chain bytes and budget headroom; measure an encoded chain for a precise result.

Assumptions

Raw FIPS 204 sizes are ML-DSA-44 public key 1,312 bytes/signature 2,420 bytes; ML-DSA-65 1,952/3,309 bytes; ML-DSA-87 2,592/4,627 bytes.
DER tags and lengths, algorithm identifiers, certificate names/extensions, other algorithms and TLS framing are not added automatically; include them in otherChainBytes or measure a real encoded chain.
The calculator does not assume that every certificate or signature in a mixed chain uses ML-DSA. Enter only the counts that apply.

Sources & reference data

NIST FIPS 204: Module-Lattice-Based Digital Signature Standard

Technical details: what the fields mean

ML-DSA parameter set parameterSet: FIPS 204 ML-DSA parameter set. The public-key and signature sizes are selected from the standard set sizes.
ML-DSA public keys in chain publicKeyCount: How many certificates in the transmitted chain carry an ML-DSA public key.
ML-DSA signatures in chain signatureCount: How many certificate signatures in the transmitted chain use ML-DSA.
Other certificate-chain bytes (DER/TLS overhead) otherChainBytes: Measured or estimated bytes for certificate fields, DER tags/lengths, algorithms, names, extensions and TLS framing, excluding the raw ML-DSA key/signature bytes counted above.
Certificate-chain byte budget chainBudgetBytes: The byte limit you want to compare against, such as a local handshake, proxy or protocol budget.

Methodology

Raw ML-DSA bytes = public-key count × public-key size + signature count × signature size. Projected chain bytes = raw ML-DSA bytes + other certificate-chain bytes. Budget headroom = budget − projected bytes; budget use = projected bytes ÷ budget × 100.

Worked example

Three ML-DSA-65 public keys and signatures in a chain

Inputs: ML-DSA parameter set: ML-DSA-65, ML-DSA public keys in chain: 3 keys, ML-DSA signatures in chain: 3 signatures, Other certificate-chain bytes (DER/TLS overhead): 8000 bytes, Certificate-chain byte budget: 16384 bytes

Result: Raw ML-DSA material is 15,783 bytes; projected chain is 23,783 bytes. Headroom is -7,399 bytes, so this estimate is 145.2% of the entered budget.

Practical guidance

Use the exact ML-DSA parameter set and count the public keys and signatures actually present in the transmitted chain; a root certificate may not be sent by every peer.
For a production budget, measure DER-encoded certificates and a captured TLS Certificate message; the raw primitive sizes are only one part of the wire size.

Common mistakes

Counting only signatures and omitting the public keys carried by certificates.
Treating raw FIPS 204 key/signature sizes as the complete DER certificate-chain or TLS handshake size.

FAQs

Does this calculate a complete TLS Certificate message?

No. It adds the raw ML-DSA key/signature sizes to an overhead value you provide. It does not encode certificates or TLS framing.

Why are public-key and signature counts separate?

A chain can be mixed: some certificates may carry ML-DSA keys while others use different algorithms. Enter the counts that match the chain you are estimating.

Last reviewed: 2026-10-18

An estimate from fixed FIPS 204 primitive sizes and user-supplied overhead; it does not parse X.509, DER-encode a certificate, simulate TLS negotiation or predict a particular server's chain behavior.

This tool provides an indicative estimate, based on the assumptions stated above.

Theme and tool preferences, along with saved and recently used lists, are stored only in this browser.