4. ML-DSA Private Keys

FIPS 204 defines two private-key expressions: a seed and a private key expanded from the seed. RFC 9964 uses only the seed format for JOSE and COSE, unlike RFC 9881, so implementations get one compact and interoperable representation.

For ML-DSA private keys in this document, the priv parameter MUST be the seed and MUST have length 32 bytes. The expanded private key representation from FIPS 204 is intentionally not defined for these JOSE/COSE serializations.