Description

Allow creation and verification of ML-DSA token signatures as in this RFC draft

Value Proposition

For now, this does not add anything beyond opaque tokens, but the long-term goal is to allow for quantum-secure self-contained tokens. This is an intermediate step towards this goal.

Goals

Allow users to select ML-DSA-* as "Default Signature Algorithm" under Realm Settings → Tokens

Non-Goals

Exposing the public key in ./well-known/jwks is out of scope, as from previous discussions it is my understanding this can not easily be achieved.

Discussion

#40496

Notes

This feature should be considered experimental until the final RFC is published.