Introducing Pebble: Normal Threshold ML-DSA
Pebble is a post-quantum threshold signature protocol for ML-DSA that uses discrete-Gaussian partial nonces for stronger security analysis and verifier compatibility. Its Pebble-ADA extension also binds quorum identity, audit metadata, and policy data to standard ML-DSA signatures without changing their published format.
Written by
Oleksandra (Sasha) Lapiha
Insights
Jul 28, 2026
Threshold signatures are the backbone of digital-asset custody and any setting where a small online quorum co-signs transactions. But the migration to post-quantum cryptography throws up a subtle obstacle. Standardized lattice signatures like ML-DSA do not behave like threshold ECDSA or Schnorr: their responses are short integer vectors produced by rejection sampling. That means a threshold protocol has to do more than combine partial signatures—it has to target ideal distributions for each partial signature and yet still clear the standard ML-DSA verifier.
Pebble solves this with discrete-Gaussian partial nonces. Because discrete Gaussians support fine-grained entropy analysis over rings and behave well under linear transformations, Pebble yields a cleaner and more conservative security analysis than previous approaches in the literature.
It also enables the integration of an extra feature: Pebble-ADA, a threshold extension for associated-data authentication (ADA). In a typical custody deployment the published signature must remain a standard ML-DSA object—yet operators still need to prove which quorum produced it, whether to attribute signing rewards, satisfy audit requirements, or bind off-chain policy metadata. ADA delivers this without changing the signature format: the standard signature now also commits to associated data, a short proof opens that commitment, and a verifier checks the proof against the associated data.
SHARE
