ML-KEM and ML-DSA key, ciphertext and signature sizes

Short answer: ML-KEM and ML-DSA keys, ciphertexts and signatures are measured in hundreds to thousands of bytes. For example, an ML-KEM-768 public key is 1,184 bytes and an ML-DSA-65 signature is 3,309 bytes. That is why post-quantum migration involves size and bandwidth planning, not just algorithm swaps. The figures below come from a 2026 arXiv paper and a third-party cheat sheet, and anyone implementing should check them against FIPS 203 and FIPS 204.

ML-KEM sizes

ML-KEM is a lattice-based key-encapsulation mechanism derived from CRYSTALS-Kyber, specified in FIPS 203. The arXiv paper says FIPS 203 defines three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, offering roughly 128, 192 and 256 bits of classical security. It says public keys range from 800 to 1,568 bytes, ciphertexts from 768 to 1,568 bytes, and every variant produces a 32-byte shared secret. The cheat sheet breaks this down:

The cheat sheet labels ML-KEM-768 as its recommended default for most use cases and ML-KEM-512 as the smallest and fastest. That is the cheat sheet's opinion, not a statement from the standard.

ML-DSA sizes

ML-DSA is the lattice-based signature scheme specified in FIPS 204. The same cheat sheet lists:

Signatures are larger than public keys in every row. The cheat sheet also lists a hash-based signature, SLH-DSA-SHA2-128s, with a 32-byte public key and a 7,856-byte signature, which shows the trade-off between key size and signature size differs by scheme.

Why the sizes matter

Larger keys and signatures mean more bytes on the wire and more storage wherever they are carried, such as in handshakes or certificates. The arXiv paper is about running ML-KEM and ML-DSA on a very constrained microcontroller, an ARM Cortex-M0+ on the RP2040 board, which shows that size and speed on small devices are an active research topic. We have not verified its performance numbers and do not quote them.

What this does not tell you

Neither source used here gives RSA or ECDSA byte counts, so this article does not make a numeric comparison with them. It also describes no deployment. Check current sizes in FIPS 203 and FIPS 204 before relying on any figure.

FAQ

How big is an ML-KEM-768 public key?

1,184 bytes according to the third-party cheat sheet, with a 1,088-byte ciphertext.

What range do ML-KEM public keys and ciphertexts cover?

Public keys range from 800 to 1,568 bytes and ciphertexts from 768 to 1,568 bytes, according to the arXiv paper.

How big is an ML-DSA-65 signature?

3,309 bytes, with a 1,952-byte public key, according to the cheat sheet.

How large is the shared secret from ML-KEM?

32 bytes for all variants, according to the arXiv paper.

Where should I confirm exact sizes?

In the standards themselves, FIPS 203 for ML-KEM and FIPS 204 for ML-DSA.