# TALUS: FIPS-204-Exact Threshold ML-DSA via Boundary Clearance Source: [TALUS: FIPS-204-Exact Threshold ML-DSA via Boundary Clearance]() Collection index: [llms.txt]() Data updated: 2026-08-12T05:00:13.408Z Authors: Leo Kao, Raymond Chang Published: 2026-03-23T15:37:37.000Z ## Abstract We present TALUS, a threshold signing protocol for ML-DSA (FIPS 204) that supports an arbitrary number of parties, emits signatures accepted by any unmodified ML-DSA verifier, and reduces, for a bounded number of signatures per key, to ML-DSA's own assumptions (Module-LWE and SelfTargetMSIS). Its core is the Boundary Clearance Condition (BCC): for a constant fraction of nonces (31.7% at ML-DSA-65), the secret vector s2 provably cannot cross a rounding boundary, so the s2-dependent rejection check can be enforced offline on preprocessed nonces. This removes the interaction that forces multi-round signing in prior schemes, yielding a TEE-assisted one-round profile and a fully distributed honest-majority MPC profile with two online rounds, both built on a Carry Elimination Framework that computes the shared commitment w1 = HighBits(Ay) on secret shares, a step we show is unavoidable. We prove a lower bound: any FIPS-204-exact threshold scheme revealing a summed (Irwin-Hall) nonce admits an efficient key-recovery attack after about 2^30 signatures under one key (at ML-DSA-65), so no q\_s-independent unforgeability is possible for this class. Complementing it, a q\_s-bounded analysis certifies over 105 bits at the operational signing cap for the external view, with insider ceilings disclosed per view and a mandatory key rotation capping each key's signing lifetime. A Rust implementation across all three FIPS 204 levels demonstrates practicality. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Threshold Digital Signature on ML-DSA-44 FIPS 204](): Threshold Digital Signature; ML-DSA-44 FIPS 204; Amortised Signing Latency (ms): 0.62. - [Threshold Digital Signature on ML-DSA-65 FIPS 204](): Threshold Digital Signature; ML-DSA-65 FIPS 204; Amortised Signing Latency (ms): 1.52. - [Threshold Digital Signature Signing on ML-DSA-44](): Threshold Digital Signature Signing; ML-DSA-44; Online Latency (ms): 0.16. - [Threshold Digital Signature Signing on ML-DSA-65](): Threshold Digital Signature Signing; ML-DSA-65; Online Time (ms): 0.29. - [Threshold Digital Signature Signing on ML-DSA-87](): Threshold Digital Signature Signing; ML-DSA-87; Online Latency (ms): 0.41. - [Threshold Digital Signature on ML-DSA FIPS 204](): Threshold Digital Signature; ML-DSA FIPS 204; Rnd: not recorded. ## Original sources and implementation [Original paper]() [PDF]()