Audit the post-quantum signature and zero-knowledge verifier landscape — and run a real ML-DSA keygen/sign/verify in your browser-side pipeline, in pure TypeScript.
What it checks:
- Standards matrix: ML-DSA (FIPS 204 final — note: not 203, which is ML-KEM), SLH-DSA (FIPS 205, 12 parameter sets), FN-DSA (FIPS 206 draft, Falcon), BBS signatures (CFRG draft, BLS12-381), and the ZK verifier families Groth16 / PLONK / Halo2 — with exact public-key, secret-key and signature sizes, NIST security categories, and COSE/JOSE algorithm IDs from RFC 9964 (-48/-49/-50).
- Trusted-setup audit: which systems need a per-circuit ceremony (Groth16), a universal updatable Powers-of-Tau SRS (PLONK/KZG), or nothing at all (Halo2's transparent IPA over Pasta curves; every lattice/hash PQC scheme).
- CNSA 2.0 timeline: 2027 new-acquisition gate, 2030 software/firmware-signing deadline (LMS/XMSS encouraged now), 2033 browsers/servers/OS, 2035 NSM-10 endpoint.
- Live ML-DSA demo: generates a deterministic keypair, signs your message and verifies it — plus a tamper-detection check — using the repository's pure-TS FIPS-204-final port, which was verified byte-exact against locally compiled PQClean reference binaries (pk/sk/sig identical for ML-DSA-44/65/87, rejection-loop trace matched iteration-for-iteration).
- Blob identifier: paste a hex or base64 public key / signature and the auditor matches its byte length against every parameter set (e.g. 1312 → ML-DSA-44 public key; 3309 → ML-DSA-65 signature; 49856 → SLH-DSA-256f signature).
Good to know: the FIPS numbering in older blog posts is frequently shifted by one — this tool pins the verified mapping (ML-DSA = 204, SLH-DSA = 205, FN-DSA = 206 draft; ML-KEM = 203). BBS proofs are not fixed-size: per draft-12 the deserialization floor is 3 G1 points + 4 scalars = 272 bytes, growing 32 bytes per additional scalar.