eprint.iacr.orgpaper

On the Expected Number of Iterations in ML-DSA Signing: A Complete Accounting of the Rejection Conditions

ePrint paper showing that FIPS 204 Table 1's expected iteration counts for the ML-DSA signing loop cover only the line-23 validity checks (z and r0 norms). They omit the two line-28 encoding-correctness checks (‖c·t0‖∞ and hint weight). It accounts for all four conditions: z by exact counting, c·t0 by an Irwin-Hall tail, and hint weight by a closed-form conditioned per-coefficient probability with a Monte Carlo tail estimate. Corrected expected iterations are 4.36, 5.14 and 3.91 for ML-DSA-44, -65 and -87, within 0.14% of an end-to-end measurement and consistent with NIST's FIPS 204 errata.