mldsa65
mldsa65 is the ML-DSA-65 post-quantum signature scheme for TLS 1.3, offered first by recent OpenSSL clients.
What it is
mldsa65 (code 0x0905) is the TLS 1.3 signature scheme for ML-DSA-65, the middle parameter set of FIPS 204, NIST's Module-Lattice-Based Digital Signature Algorithm. The draft-ietf-tls-mldsa Internet-Draft defines it alongside mldsa44 and mldsa87.
ML-DSA-65 targets a higher security category than ML-DSA-44, with 1,952-byte public keys and 3,309-byte signatures. Like the other post-quantum schemes, it is designed to stay secure against quantum computers.
Post-quantum signatures are less urgent than post-quantum key exchange: recorded traffic can be decrypted later, but a signature only has to resist forgery at the time of the handshake. That is why post-quantum key exchange, such as X25519MLKEM768, was deployed first.
The largest set, mldsa87, follows it in the same lists. ML-DSA-65 keys and signatures are larger than those of ML-DSA-44 and smaller than those of ML-DSA-87.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 6 of 11 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
Python requests, httpx, Node.js fetch and Guzzle send it first, ahead of every classic scheme, which is the order of recent OpenSSL defaults. curl_cffi sends it 2nd. Debian curl, macOS curl, both curl-impersonate profiles and Go net/http do not send it. Our Chrome capture did not record signature algorithms.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for mldsa65 in the TLS details.
Run the TLS fingerprint test