Skip to main content

Post-Quantum Hybrid Signatures

A signature that is safe today can be forged tomorrow if the algorithm behind it falls. System9 signs with a hybrid construction that pairs a classical algorithm with a post-quantum one, so a signature survives the failure of either family. Both halves must verify; the post-quantum half is pinned independently of the classical half; and a verifier configured for hybrid refuses a downgrade to classical-only.

The construction​

The hybrid signature envelope declares an algorithm of either ed25519 (classical only) or hybrid-ed25519-mldsa65:

AlgorithmClassical halfPost-quantum halfWhen it is used
ed25519Ed25519(none: must be null)A deployment without a post-quantum provider signs this way. It remains a first-class mode.
hybrid-ed25519-mldsa65Ed25519ML-DSA-65 (FIPS 204)Both halves must verify over the same message for the signature to be accepted.

The two halves are not a formality. A classical-only envelope that carries populated post-quantum fields is rejected as a downgrade attempt, not quietly accepted. A hybrid envelope requires both signatures to check.

Why "hybrid" here means real post-quantum trust​

Pairing two algorithms only defends against a future attacker if the post-quantum half cannot be swapped out by a present one. System9 closes that path with three cross-checks:

  • The classical half is bound to the pinned key. The envelope carries its own Ed25519 public key, but verification checks the signature against the key the verifier pinned out-of-band. The two must match, so an attacker cannot sign with their own key and carry it beside the signature.
  • The post-quantum half is bound to an independent pin. A hybrid signature's ML-DSA-65 public key is cross-checked against the peer's separately pinned ML-DSA-65 key. An adversary who breaks Ed25519, the exact quantum threat the hybrid defends against, still cannot substitute their own post-quantum key, because that key is trusted independently of the classical signature.
  • Downgrade-by-omission is refused. When a peer is pinned as hybrid, a bare classical listing is rejected. An adversary who forged the breakable classical half cannot neutralize the post-quantum pin by simply dropping the post-quantum half. A hybrid claim against a peer with no pinned post-quantum key is likewise refused as unpinned, never silently degraded to classical trust.

Independent pinning and validity windows​

Trust anchors are pinned out-of-band, not discovered over a network. A peer's public key is provisioned by an operator and identified by a content-addressed fingerprint (sha256 over the raw public key bytes) recomputed from the key's own bytes at load, never trusted from the wire. A corrupt or wrong-length key is rejected at load rather than pinned under the wrong identity.

Each pin carries a validity window, an optional not-before and not-after, enforced against the caller's clock before any cryptography runs. The window matters most exactly where revocation is hardest to deliver: on a disconnected, sovereign cell, status = active alone cannot bound a compromised key, because a courier-delivered revocation might never physically arrive. A validity window time-boxes the key against the cell's own clock, so a key expires with no connectivity and no courier. A pin whose classical and post-quantum algorithms disagree with the keys it carries is rejected at load, mirroring the same invariant the cell enforces.

Verified offline, everywhere​

The hybrid signature is what lets trust cross an organizational boundary without a vendor in the path. A cross-org listing is a signed attestation, hybrid, domain-separated, scope-attenuating, with its own validity window, that a recipient verifies offline, holding only the publisher's public key. The data itself never crosses the boundary; only the signed listing does.

Verification is stateless, pure, offline, and fail-closed. It reaches no coordinator, no network, and no database; it reads no wall clock (the caller supplies the current time and the pinned keys); and it touches no shared state. It therefore behaves identically across the whole deployment matrix, single-cell and multi-cell, sovereign and cloud, on both runtimes: a listing minted on one org's cell verifies on any cell of any org that has pinned the signer's public key.

The verifier runs an ordered set of gates and returns a verdict naming the first failure:

  1. Bounds on the attenuation scope, refused before any cryptography.
  2. Content hash equals the SHA-256 of the canonical bytes.
  3. Signer fingerprint equals sha256 of the public key being checked.
  4. Signature(s) verify over the domain-separated message.
  5. Reach matches the declared cross-org value.
  6. Validity window: the caller's clock falls within [issued_at, expires_at).
  7. Attenuation: the listing's scope is a subset of the importer's pinned ceiling (an absent ceiling is the empty, deny-closed ceiling).

Two-runtime parity​

Signing is core-side; verification runs on both runtimes, so the two can drift on the canonical bytes, the fingerprint scheme, or a single accept/reject verdict, and a drift means a listing an org minted on a cell is rejected on the device it was couriered to. The contract is pinned with cross-language fixtures: a projection generated from the core's production encoder is re-derived by the edge's own production functions and compared field-for-field, and a real Ed25519 + ML-DSA-65 listing is vendored and kept honest by verification, the edge must accept it when both pinned keys match and reject every forgery, including a tampered body, a wrong classical pin, post-quantum fields under a classical algorithm, a bad post-quantum half, and a hybrid claim against a peer with no pinned post-quantum key.

Design status

Post-quantum material is used for signatures, key exchange, and X.509 issuance. Hybrid X.509 issuance is built and opt-in: the issuance path dispatches on the crypto policy's algorithm_family, and hybrid or pq_only mint a certificate that carries a classical key alongside an ML-DSA-65 (FIPS 204) signature. classical is the default and is unchanged. The hybrid path fails closed, if the post-quantum half cannot complete it refuses issuance rather than downgrading to a classical-only certificate. The post-quantum readiness tooling, a cryptographic inventory, an algorithm registry, and a migration planner, exists to plan the wider transition, not to assert it is complete.

Deployment caveat: set your PEN before hybrid certs leave the fabric

The default post-quantum OID arc is a reserved placeholder (PEN 99999, unregistered) and is runtime-warned. A deployment must set its own registered Private Enterprise Number arc before any hybrid certificate leaves the fabric. The classical half stays valid regardless.