ML-DSA Private key sizes 32bytes or expanded?

[johngray-dev]

I think more discussion is needed about whether the private key format should allow the expanded format as well as the seed. If an implementation only had access to the expanded format, and needed to export the key, then it may not have access to the seed. If there is no way to support this in a reasonable way, then there WILL be operational issues down the road.

• Max suggests we could have a separate section for the private key. For the traditional component, if we know the keysize, we can look for 32+trad or expanded mldsa+ trad and know which one to use. That would be more efficient than using the first 32 bytes, expanding them (which will work even if the key is already expanded).