Quantum Resistant Digital Signatures — Complete Documentation & Simulation

Overview & System Context

Quantum Resistant Digital Signatures: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9525 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Post-quantum cryptography (PQC), sometimes referred to as quantum-proof, quantum-safe, or quantum-resistant, is the development of cryptographic algorithms (usually public-key algorithms) that are currently thought, but not proven, to be secure against a cryptanalytic attack by a quantum computer. Most widely used public-key algorithms rely on the difficulty of one of three mathematical problems: the integer factorization problem, the discrete logarithm problem, or the elliptic-curve discrete logarithm problem. All of these problems could be easily solved on a sufficiently powerful quantum computer running Shor's algorithm or possibly alternatives. As of 2026, quantum computers lack the processing power to break widely used cryptographic algorithms; however, because of the length of time required for migration to quantum-safe cryptography, cryptographers are already designing new algorithms to prepare for Y2Q or "Q-Day", the day when current algorithms will be vulnerable to quantum computing attacks. Mosca's theorem provides the risk analysis framework that helps organizations identify how quickly they need to start migrating. Their work has gained attention from academics and industry through the PQCrypto conference series hosted since 2006, several workshops on Quantum Safe Cryptography hosted by the European Telecommunications Standards Institute (ETSI), and the Institute for Quantum Computing. The rumoured existence of widespread harvest now, decrypt later programs has also been seen as a motivation for the early introduction of post-quantum algorithms, as data recorded now may still remain sensitive many years into the future. In contrast to the threat quantum computing poses to current public-key algorithms, most current symmetric cryptographic algorithms and hash functions are considered to be relatively secure against attacks by quantum computers. While the quantum Grover's algorithm does speed up attacks against symmetric ciphers, doubling the key size can effectively counteract these attacks. Thus post-quantum symmetric cryptography does not need to differ significantly from current symmetric cryptography. In 2024, the U.S. National Institute of Standards and Technology (NIST) released final versions of its first three Post-Quantum Cryptography Standards.

This approach includes cryptographic systems such as learning with errors, ring learning with errors (ring-LWE), the ring learning with errors key exchange and the ring learning with errors signature, the older NTRU or GGH encryption schemes, and the newer NTRU signature and BLISS signatures. Some of these schemes like NTRU encryption have been studied for many years without anyone finding a feasible attack. Others like the ring-LWE algorithms have proofs that their security reduces to a worst-case problem. The Post-Quantum Cryptography Study Group sponsored by the European Commission suggested that the Stehle–Steinfeld variant of NTRU be studied for standardization rather than the NTRU algorithm. At that time, NTRU was still patented. Studies have indicated that NTRU may have more secure properties than other lattice based algorithms. Two lattice-based algorithms, ML-KEM (commonly known as Kyber) and ML-DSA (commonly known as Dilithium) were among the first post-quantum algorithms standardised by NIST.

This includes cryptographic systems such as the Unbalanced Oil and Vinegar signature scheme which is based on the difficulty of solving systems of multivariate equations. Various attempts to build secure multivariate equation encryption schemes have been broken, notably the Rainbow signature. This includes cryptographic systems such as Lamport signatures, the Merkle signature scheme, the XMSS, the SPHINCS, the WOTS and the SPHINCS+ schemes. Hash based digital signatures were invented in the late 1970s by Ralph Merkle and have been studied ever since as an interesting alternative to number-theoretic digital signatures like RSA and DSA. Their primary drawback is that for any hash-based public key, there is a limit on the number of signatures that can be signed using the corresponding set of private keys. This fact reduced interest in these signatures until interest was revived due to the desire for cryptography that was resistant to attack by quantum computers. There appear to be no patents on the Merkle signature scheme and there exist many non-patented hash functions that could be used with these schemes. The stateful hash-based signature scheme XMSS developed by a team of researchers under the direction of Johannes Buchmann is described in RFC 8391. Note that all the above schemes are one-time or bounded-time signatures. Moni Naor and Moti Yung invented UOWHF hashing in 1989 and designed a signature based on hashing (the Naor-Yung scheme) which can be unlimited-time in use (the first such signature that does not require trapdoor properties).

Figure 1: Advanced Digital Interface Screen Showing Space Research Data ... In some versions of Ring-LWE there is a security reduction to the shortest-vector problem (SVP) in a lattice as a lower bound on the security. The SVP is known to be NP-hard. Specific ring-LWE systems that have provable security reductions include a variant of Lyubashevsky's ring-LWE signatures defined in a paper by Güneysu, Lyubashevsky, and Pöppelmann. The GLYPH signature scheme is a variant of the Güneysu, Lyubashevsky, and Pöppelmann (GLP) signature which takes into account research results that have come after the publication of the GLP signature in 2012. Another Ring-LWE signature is Ring-TESLA. There also exists a "derandomized variant" of LWE, called Learning with Rounding (LWR), which yields "improved speedup (by eliminating sampling small errors from a Gaussian-like distribution with deterministic errors) and bandwidth". While LWE uses the addition of a small error to conceal the lower bits, LWR uses rounding for the same purpose.

Unbalanced Oil and Vinegar signature schemes are asymmetric cryptographic primitives based on multivariate polynomials over a finite field I F {\displaystyle \mathbb {F} } I. Bulygin, Petzoldt, and Buchmann have shown a reduction of generic multivariate quadratic UOV systems to the NP-Hard multivariate quadratic equation solving problem. In 2005, Luis Garcia proved that there was a security reduction of Merkle Hash Tree signatures to the security of the underlying hash function. Garcia showed in his paper that if computationally one-way hash functions exist then the Merkle Hash Tree signature is provably secure. Therefore, use of a hash function with a provable reduction of security to a known hard problem would have a provable security reduction of the Merkle tree signature to that known hard problem. The Post-Quantum Cryptography Study Group sponsored by the European Commission has recommended use of the Merkle signature scheme for long term security protection against quantum computers.

The McEliece Encryption System has a security reduction to the syndrome decoding problem (SDP). The SDP is known to be NP-hard. The Post-Quantum Cryptography Study Group sponsored by the European Commission has recommended the use of this cryptography for long term protection against attack by a quantum computer. Figure 2: 6. XLINK quantum-resistant signatures review | by QANX Developers ...

Security is related to the problem of constructing an isogeny between two supersingular curves with the same number of points. The most recent published investigation of the difficulty of this problem, by Delfs and Galbraith, indicates that this problem is as hard as the inventors of the key exchange suggest that it is. There is no security reduction to a known NP-hard problem.

A practical consideration on a choice among post-quantum cryptographic algorithms is the effort required to send public keys over the internet. From this point of view, the Ring-LWE, NTRU, and SIDH algorithms provide key sizes conveniently under 1 kB, hash-signature public keys come in under 5 kB, and MDPC-based McEliece takes about 1 kB. On the other hand, Goppa-based McEliece requires a nearly 1 MB key.

The fundamental idea of using LWE and Ring LWE for key exchange was proposed and filed at the University of Cincinnati in 2011 by Jintai Ding. The basic idea comes from the associativity of matrix multiplications, and the errors are used to provide the security. The paper appeared in 2012 after a provisional patent application was filed in 2012. In 2014, Peikert presented a key transport scheme following the same basic idea of Ding's, where the new idea of sending an additional 1 bit signal for rounding in Ding's construction is also used. For somewhat greater than 128 bits of security, Singh presents a set of parameters which have 6956-bit public keys for the Peikert's scheme. The corresponding private key would be roughly 14,000 bits. In 2015, an authenticated key exchange with provable forward security following the same basic idea of Ding's was presented at Eurocrypt 2015, which is an extension of the HMQV construction in Crypto2005. The parameters for different security levels from 80 bits to 350 bits, along with the corresponding key sizes are provided in the paper.

For 128 bits of security in NTRU, ntruhps2048509 with n = 509 and q = 2048 was selected in the NIST submission in September 2020. This results in a public key of 699 bytes and a corresponding private key of 935 bytes. Figure 3: How to Build a Quantum-Resistant Digital Identity System | ChainScore ... In order to get 128 bits of security for hash based signatures to sign 1 million messages using the fractal Merkle tree method of Naor Shenhav and Wool the public and private key sizes are roughly 36,000 bits in length.

For 128 bits of security in a McEliece scheme, The European Commission's Post-Quantum Cryptography Study group recommends using a binary Goppa code of length at least n = 6960 and dimension at least k = 5413, and capable of correcting t = 119 errors. With these parameters the public key for the McEliece system will be a systematic generator matrix whose non-identity part takes k × (n − k) = 8373911 bits. The corresponding private key, which consists of the code support with n = 6960 elements from GF(213) and a generator polynomial of with t = 119 coefficients from GF(213), will be 92,027 bits in length. The group is also investigating the use of Quasi-cyclic MDPC codes of length at least n = 216 + 6 = 65542 and dimension at least k = 215 + 3 = 32771, and capable of correcting t = 264 errors. With these parameters the public key for the McEliece system will be the first row of a systematic generator matrix whose non-identity part takes k = 32771 bits. The private key, a quasi-cyclic parity-check matrix with d = 274 nonzero entries on a column (or twice as much on a row), takes no more than d × 16 = 4384 bits when represented as the coordinates of the nonzero entries on the first row. Barreto et al.

recommend using a binary Goppa code of length at least n = 3307 and dimension at least k = 2515, and capable of correcting t = 66 errors. With these parameters the public key for the McEliece system will be a systematic generator matrix whose non-identity part takes k × (n − k) = 1991880 bits. The corresponding private key, which consists of the code support with n = 3307 elements from GF(212) and a generator polynomial of t = 66 coefficients from GF(212), will be 40,476 bits in length.

For 128 bits of security in the supersingular isogeny Diffie–Hellman (SIDH) method, De Feo, Jao and Plut recommend using a supersingular curve modulo of a 768-bit prime. If one uses elliptic curve point compression, the public key will need to be no more than 8x768 or 6144 bits in length. A March 2016 paper by authors Azarderakhsh, Jao, Kalach, Koziel, and Leonardi showed how to cut the number of bits transmitted in half, which was further improved by authors Costello, Jao, Longa, Naehrig, Renes and Urbanik resulting in a compressed-key version of the SIDH protocol with public keys only 2640 bits in size. This makes the number of bits transmitted roughly equivalent to the non-quantum secure RSA and Diffie–Hellman at the same classical security level.

Older supported versions that have been removed because of the progression of the NIST Post-Quantum Cryptography Standardization Project are: Google has maintained the use of "hybrid encryption" in its use of post-quantum cryptography: whenever a relatively new post-quantum scheme is used, it is combined with a more proven, non-PQ scheme. This is to ensure that the data are not compromised even if the relatively new PQ algorithm turns out to be vulnerable to non-quantum attacks before Y2Q. This type of scheme is used in its 2016 and 2019 tests for post-quantum TLS, and in its 2023 FIDO2 key. One of the algorithms used in the 2019 test, SIKE, was broken in 2022, but the non-PQ X25519 layer (already used widely in TLS) still protected the data.

Apple's PQ3 and Signal's PQXDH are also hybrid. The NSA and GCHQ argue against hybrid encryption, claiming that it adds complexity to implementation and transition. Daniel J. Bernstein, who supports hybrid encryption, argues that the claims are bogus. Lattice-based cryptography is the generic term for constructions of cryptographic primitives that involve lattices, either in the construction itself or in the security proof. Lattice-based constructions support important standards of post-quantum cryptography. Unlike more widely used and known public-key schemes such as the RSA, Diffie-Hellman or elliptic-curve cryptosystems—which could, theoretically, be defeated using Shor's algorithm on a quantum computer—some lattice-based constructions appear to be resistant to attack by both classical and quantum computers. Furthermore, many lattice-based constructions are considered to be secure under the assumption that certain well-studied computational lattice problems cannot be solved efficiently. In 2024 NIST announced the Module-Lattice-Based Digital Signature Standard for post-quantum cryptography.

L = { ∑ a i b i : a i ∈ Z } . {\displaystyle L={\Big \{}\sum a_{i}\mathbf {b} _{i}:a_{i}\in \mathbb {Z} {\Big \}}.} For example, Z n {\displaystyle \mathbb {Z} ^{n}} is a lattice, generated by the standard basis for R n {\displaystyle \mathbb {R} ^{n}} . Crucially, the basis for a lattice is not unique. For example, the vectors ( 3 , 1 , 4 ) {\displaystyle (3,1,4)} , ( 1 , 5 , 9 ) {\displaystyle (1,5,9)} , and ( 2 , − 1 , 0 ) {\displaystyle (2,-1,0)} form an alternative basis for Z 3 {\displaystyle \mathbb {Z} ^{3}} . The most important lattice-based computational problem is the shortest vector problem (SVP or sometimes GapSVP), which asks for an approximate minimal Euclidean length of a non-zero lattice vector. This problem is thought to be hard to solve efficiently, even with approximation factors that are polynomial in n {\displaystyle n} , and even with a quantum computer.

Many (though not all) lattice-based cryptographic constructions are known to be secure if SVP is in fact hard in this regime. GGH encryption scheme, which is based in the closest vector problem (CVP). In 1999, Nguyen published a critical flaw in the scheme's design. NTRUEncrypt. CRYSTALS-Kyber, which is built upon module learning with errors (module-LWE). Kyber was selected for standardization by the NIST in 2023. In August 2023, NIST published FIPS 203 (Initial Public Draft), and started referring to their Kyber version as Module-Lattice-based Key Encapsulation Mechanism (ML-KEM). FrodoKEM, a scheme based on the learning with errors (LWE) problem. FrodoKEM joined the standardization call conducted by the National Institute of Standards and Technology (NIST), and lived up to the 3rd round of the process. It was then discarded due to low performance reasons. In October, 2022, the Twitter account associated to cryptologist Daniel J. Bernstein posted security issues in frodokem640. NewHope is based on the ring learning with errors (RLWE) problem. NTRU Prime. Peikert's work, which is based on the ring learning with errors (RLWE) problem. Saber, which is based on the module learning with rounding (module-LWR) problem.

CRYSTALS-Dilithium, which is built upon module learning with errors (module-LWE) and module short integer solution (module-SIS). Dilithium was selected for standardization by the NIST. According to a message from Ray Perlner, writing on behalf of the NIST PQC team, the NIST module-LWE signing standard is to be based on version 3.1 of the Dilithium specification. Falcon, which is built upon short integer solution (SIS) over NTRU. Falcon was selected for standardization by the NIST. GGH signature scheme. Güneysu, Lyubashevsky, and Pöppelmann's work, which is based on ring learning with errors (RLWE). MITAKA, a variant of Falcon. NTRUSign. qTESLA, which is based on ring learning with errors (RLWE). The qTESLA scheme joined the standardization call conducted by the National Institute of Standards and Technology (NIST).

Post-Quantum Cryptography Standardization is a program and competition by NIST to update their standards to include post-quantum cryptography. It was announced at PQCrypto 2016. Twenty-three signature schemes and fifty-nine encryption/KEM schemes were submitted by the initial submission deadline at the end of 2017 of which sixty-nine total were deemed complete and proper and participated in the first round. Seven of these, of which three are signature schemes, advanced to the third round, which was announced in July 2020. On August 13, 2024, NIST released final versions of the first three Post Quantum Crypto Standards: FIPS 203, FIPS 204, and FIPS 205. On March 11, 2025 NIST released Hamming Quasi-Cyclic (HQC) as the fifth algorithm for post-quantum asymmetric encryption as used for key encapsulation / exchange.

CRYSTAL-Kyber and SABER may change the nested hashes used in their proposals in order for their security claims to hold. FALCON side channel attack using electromagnetic measurements to extract the secret signing keys. A masking may be added in order to resist the attack. This adaptation affects performance and should be considered whilst standardizing. While there have been no substantive changes made to the standards since the draft versions, NIST has changed the algorithms’ names to specify the versions that appear in the three finalized standards, which are: Federal Information Processing Standard (FIPS) 203, intended as the primary standard for general encryption. Among its advantages are comparatively small encryption keys that two parties can exchange easily, as well as its speed of operation.

The standard is based on the CRYSTALS-Kyber algorithm, which has been renamed ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism. FIPS 204, intended as the primary standard for protecting digital signatures. The standard uses the CRYSTALS-Dilithium algorithm, which has been renamed ML-DSA, short for Module-Lattice-Based Digital Signature Algorithm. FIPS 205, also designed for digital signatures. The standard employs the SPHINCS+ algorithm, which has been renamed SLH-DSA, short for Stateless Hash-Based Digital Signature Algorithm. The standard is based on a different math approach than ML-DSA, and it is intended as a backup method in case ML-DSA proves vulnerable. Similarly, when the draft FIPS 206 standard built around FALCON is released, the algorithm will be dubbed FN-DSA, short for FFT (fast-Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm.

On March 11, 2025 NIST released Hamming Quasi-Cyclic (HQC) as the fifth algorithm for post-quantum asymmetric encryption as used for key encapsulation / exchange. The new algorithm is as a backup for ML-KEM, the main algorithm for general encryption. HQC is a code-based scheme using different math than ML-KEM, thus mitigating possible weaknesses should any be found in the lattice-based ML-KEM. The draft standard incorporating the HQC algorithm is expected in early 2026 with the final in 2027. As of mid-2026, FIPS 206 (FN-DSA, based on FALCON) remained a draft standard. NIST submitted the draft for internal approval on August 28, 2025, and, as of April 2026, the Initial Public Draft had not yet been released pending final internal clearance; the final standard was expected in late 2026 or early 2027. Unlike ML-KEM, ML-DSA, and SLH-DSA, FN-DSA's signing process relies on floating-point Gaussian sampling, which is difficult to implement safely and in constant time; NIST has cited this complexity as the main reason for FN-DSA's longer standardization timeline compared with the other three algorithms.

NIST has indicated that at least the multivariate candidates will probably require a further round of evaluation. Anthropic weakened HAWK with Claude Mythos, so HAWK was withdrawn from the competition, as parameter adjustments would make it incompetitive. Quantum computers will eventually be able to break the cryptographic methods that secure Ethereum and most other digital systems today. This page explains what that means, how the network is proactively developing improvements to mitigate this risk, and what you need to know.

Ethereum relies on several forms of to keep the network secure and protect user funds. The most important are: All of these rely on mathematical structures, such as Abelian groups, that are hard for classical computers but can be solved efficiently by a quantum computer using Shor's algorithm (opens in a new tab) . 2. System Architecture & Core Working Principles In March 2026, Google Quantum AI published research estimating that breaking 256-bit elliptic curve cryptography (the type Ethereum uses for account signatures) could require roughly 1,200 logical qubits. Previous estimates put this number much higher. Google has set a 2029 internal deadline for migrating its own systems to post-quantum cryptography.

Current quantum hardware is far from this scale, operating with a few thousand noisy physical qubits. Logical qubits (which correct for errors and perform reliable computation) require many physical qubits each. The gap between current hardware and what is needed to break Ethereum's cryptography remains significant, but it is narrowing faster than many expected. Notably, the U.S. National Institute of Standards and Technology (NIST) anticipates deprecating ECDSA by 2030 and disallowing it by 2035.

This is not an imminent threat. But cryptographic transitions take years, and Ethereum's security model is designed to last centuries. Ethereum's response is the Lean Ethereum roadmap, a deliberate, multi-year mission to rebuild Ethereum around primitives that will survive any cryptographic threat. In February 2026, Vitalik Buterin published a roadmap (opens in a new tab) identifying four distinct areas of Ethereum's cryptography that need post-quantum upgrades. Each has different challenges and different solution paths.

What it does : Ethereum's protocol uses BLS signatures to aggregate votes from hundreds of thousands of validators. BLS allows many signatures to be combined into one, keeping the network efficient. Why it is vulnerable : BLS signatures rely on elliptic curve pairings, which a quantum computer could break. The approach : The Lean Consensus roadmap includes developing two complementary tools: What it does : KZG polynomial commitments ensure that data (particularly data from rollups) is available on the network without requiring every node to download all of it.

Why it is vulnerable : KZG commitments rely on elliptic curve pairings, the same mathematical structure that quantum computers can attack. Current mitigation : KZG commitments use a "trusted setup" where many participants contributed randomness. As long as at least one participant was honest and discarded their secret, the setup is secure, even against quantum computers attempting to reverse-engineer it after the fact.

Long-term solution : Replace KZG with a quantum-safe commitment scheme. The two leading candidates are: Both approaches are still being researched for efficiency and practicality at Ethereum's scale. What it does : Every standard Ethereum account (externally owned account, or ) uses ECDSA on the secp256k1 curve to sign transactions. This is what protects your funds.

Why it is vulnerable : For any account that has sent a transaction, the public key is exposed onchain. A quantum computer could derive the private key from this exposed public key data. Important nuance : Accounts that have only received ether and never sent a transaction have not exposed their public key. Only the address (a hash of the public key) is visible, which provides some additional protection.

The approach : Rather than a single protocol-wide migration, Ethereum plans to use account abstraction (specifically EIP-8141, being considered for Hegotá in second half of 2026) to give users signature agility . Individual accounts could switch to a post-quantum signature scheme without waiting for the entire protocol to change. This is a pragmatic approach. Users and wallets that want post-quantum protection early can adopt it voluntarily, while the broader migration happens over time.

What it does : Proof systems are used by L2 rollups to verify computations without re-executing them, and, where an application implements the zero-knowledge property, to prove statements without revealing the private inputs behind them. Why it is vulnerable : Many popular ZK-proof systems (SNARKs using elliptic curve pairings) rely on quantum-vulnerable assumptions.

The approach : STARKs, which rely on hash functions rather than elliptic curves, are already quantum-resistant and are used by several rollups. Natural ecosystem adoption of STARK-based systems is already providing post-quantum security at the application layer. In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized three post-quantum cryptography standards (opens in a new tab) . These matter because they give the entire technology industry, including Ethereum, a shared set of vetted algorithms to build on rather than each project inventing its own.

These standards provide a foundation for the broader industry's post-quantum transition. Ethereum's work builds on and extends these, with particular focus on the unique challenges of a decentralized network where efficiency and aggregation matter. The Ethereum Foundation formed a dedicated Post-Quantum Security team in January 2026, led by Thomas Coratger. The team's work is tracked publicly at pq.ethereum.org (opens in a new tab) .

The team has outlined a series of protocol upgrades to incrementally introduce post-quantum cryptography into Ethereum. These are planning milestones, not guaranteed commitments. Names and ordering may change. Target : The structured fork milestones target the completion of core post-quantum infrastructure by approximately 2029. Full execution-layer and ecosystem migration extends beyond that.

Right now: nothing. Your funds are safe. No quantum computer today can threaten Ethereum's cryptography. In the future : Once post-quantum signature schemes are widely supported on Ethereum (expected following the Hegotá hard fork and implementation of EIP-8141), you will want to migrate your account to quantum-safe signatures. Wallet software will guide you through this transition.

If your account has never sent a transaction (meaning your public key has not been exposed onchain), it has an additional layer of protection. But all accounts should eventually migrate. The question of how to handle dormant wallets (accounts whose owners may not be aware of the need to migrate) is an open governance topic. The Ethereum community has not yet reached consensus on this.

The architecture of quantum safe signatures systems in post-quantum cryptographic research and implementation must balance performance, security, and scalability. Researching, implementing, and deploying quantum-resistant cryptographic schemes across all layers of payment-integrity and settlement infrastructure from signatures to key exchange. Modern architectures employ microservice patterns, event-driven communication, horizontal scaling, and layered security to deliver institutional-grade capabilities.

Architecture decisions for quantum safe signatures have long-lasting implications. The quantum computing threat timeline is accelerating, requiring immediate action to protect long-lived cryptographic assets and infrastructure. Choosing the wrong architecture leads to scalability bottlenecks, security vulnerabilities, and mounting technical debt that becomes increasingly expensive to address as the system grows.

JIL Sovereign Technologies, Inc. checks paid claims and seals an evidence file. This generated page is a glossary note. It is not a claim that a check by this name is one of the 332 active checks. A court decides what it admits. The wallet is getjil.com. The Layer-1 is jilsovereign.net. 3. Software Implementation, Frameworks & Protocols Quantum Safe Signatures is a key aspect of post-quantum cryptographic research and implementation. Researching, implementing, and deploying quantum-resistant cryptographic schemes across all layers of payment-integrity and settlement infrastructure from signatures to key exchange. It matters because the quantum computing threat timeline is accelerating, requiring immediate action to protect long-lived cryptographic assets and infrastructure.

No. This page is a glossary note. JIL Sovereign Technologies, Inc. checks paid claims and seals an evidence file. A check by this name is not claimed as one of the 332 active checks. A court decides what it admits. This guide provides a technical blueprint for implementing a transitional cryptographic architecture that combines classical signatures (ECDSA/EdDSA) with post-quantum cryptography (PQC). It covers serialization formats, fallback verification logic, and strategies for managing the transition's overhead.

A practical guide to building cryptographic systems that combine classical and quantum-resistant algorithms for secure, future-proof digital signatures. A hybrid signature architecture combines a classical digital signature scheme, like ECDSA or EdDSA , with a post-quantum cryptography (PQC) algorithm. The primary goal is cryptographic agility : maintaining security against current classical attacks while preparing for the future threat of quantum computers capable of breaking today's widely-used public-key cryptography.

In this design, a single message is signed by both algorithms independently, and the verifier must validate both signatures. This approach, often called a dual-signature or composite signature , ensures that the system remains secure if either algorithm is compromised. The core design involves generating and managing two separate key pairs. For example, you might pair an Ed25519 key (classical) with a Dilithium key (post-quantum). The signing process is straightforward: signature = sign_ed25519(message) || sign_dilithium(message) . The resulting signature is a concatenation of both components. Verification requires parsing this concatenated signature and running both verification algorithms. If either verification fails, the entire signature is considered invalid. This provides a strong security guarantee but increases signature size and verification time.

Implementation requires careful serialization and protocol design . You must define a standard format for the composite public key and the concatenated signature. For interoperability, consider adopting emerging standards like the IETF's Composite Signatures draft. A critical decision is whether to use a nested or parallel structure. In a parallel structure, both signatures are computed directly on the original message. In a nested structure, the PQC signature might sign a bundle containing the message and the classical signature, creating a cryptographic dependency.

For developers, integrating hybrid signatures into existing systems like blockchain transactions or TLS handshakes presents challenges. Signature and key sizes can be 5-10x larger than classical ones, impacting bandwidth and storage. Libraries such as Open Quantum Safe (OQS) provide prototypes for PQC algorithms. Here's a conceptual code snippet for a hybrid signing function in a pseudo-API: The transition to hybrid signatures is a strategic risk mitigation step. While large-scale quantum computers that break ECC or RSA may be years away, the threat of "harvest now, decrypt later" attacks is real, where adversaries collect encrypted data today to decrypt it later with a quantum computer. By deploying hybrid signatures now, organizations protect long-lived data and systems. Current adoption drivers include NIST's PQC standardization process , with algorithms like CRYSTALS-Dilithium (for signatures) and Kyber (for KEM) leading the way, and mandates from agencies like the NSA (CNSA 2.0) for national security systems.

When designing your architecture, prioritize algorithm selection from NIST's finalized PQC standards, plan for key lifecycle management (generation, storage, rotation), and ensure your system can gracefully algorithm rollover in the future. Testing with hybrid modes in protocols like X.509 certificates and Blockchain transaction formats is essential. The ultimate goal is to create a system that is not only secure against an uncertain future but also practical and performant enough to deploy in production environments today.

Before building a hybrid classical-quantum signature system, you must understand the core cryptographic primitives and the specific threat model it addresses. A hybrid signature architecture combines a classical digital signature (like ECDSA or EdDSA) with a post-quantum cryptography (PQC) signature. The primary goal is cryptographic agility , ensuring security against both current classical computers and future quantum adversaries. This is not about quantum algorithms for signing, but about using quantum-resistant algorithms as a safety net. The immediate driver is the store-now, decrypt-later threat, where an adversary records classical signatures today to forge them later with a quantum computer.

Key design goals must be established upfront. Backwards compatibility is often critical; the system should interoperate with existing blockchain infrastructure and wallets that only understand classical signatures. Performance must be considered, as PQC algorithms often have larger key and signature sizes, impacting gas costs and block space. The architecture must also define a clear failure mode : what happens if the PQC algorithm is later broken? A robust design might allow for algorithm upgrades without losing control of assets.

From a developer's perspective, prerequisites include familiarity with digital signature schemes and their typical API: KeyGen() , Sign(sk, msg) , and Verify(pk, msg, sig) . You should understand the transaction serialization format of your target blockchain (e.g., RLP for Ethereum, Protocol Buffers for Cosmos). Knowledge of multi-signature or threshold signature patterns is beneficial, as a hybrid signature can be conceptually similar, combining two independent cryptographic proofs.

The core technical challenge is signature aggregation . A naive approach is concatenation: sig_hybrid = sig_classical || sig_pqc . A more advanced design uses signature of signatures , where one scheme signs the output of the other, or a custom cryptographic commitment that binds both proofs. The choice impacts verification logic, gas efficiency, and the ability for partial verification (e.g., a light client checking only the classical part).

Finally, you must select concrete algorithms. For the classical component, secp256k1 (ECDSA) is standard for Ethereum and Bitcoin, while Ed25519 is common in other chains. For the PQC component, the NIST Post-Quantum Cryptography Standardization Project winners are the reference. CRYSTALS-Dilithium is the primary standard for general digital signatures, offering a balance of size and speed. SPHINCS+ is a conservative, hash-based alternative. Your design must account for their specific parameters and implementation libraries, such as those from Open Quantum Safe .

A hybrid classical-quantum signature system uses a dual-signature scheme where a quantum-resistant algorithm acts as a fallback, ensuring long-term security against cryptographically-relevant quantum computers. A dual-signature architecture combines a classical digital signature algorithm, like ECDSA or EdDSA, with a post-quantum cryptography (PQC) algorithm. The primary goal is to maintain compatibility with existing blockchain infrastructure while preparing for a future quantum threat. In this model, a single transaction is signed with both algorithms, creating two independent signatures. The network's validation logic is then upgraded to require verification of both signatures, establishing a hybrid verification state . This approach is endorsed by organizations like NIST, which recommends hybrid modes during the transition to PQC standards.

The core innovation lies in the fallback logic . This is a smart contract or protocol-level rule that dictates which signature is considered authoritative under different conditions. Initially, the classical signature is the primary key for transaction validity, ensuring seamless operation. The fallback logic is programmed to activate the PQC signature's authority only upon the detection of a specific trigger condition . This condition could be a pre-agreed-upon block height, a governance vote, or, more dynamically, cryptographic proof that a quantum computer has broken the classical algorithm, rendering it insecure.

Designing the trigger mechanism is critical. A time-based activation (e.g., at block height 20,000,000) is simple but may be premature or too late. A more robust method involves a cryptographic proof-of-break . A user could submit a transaction signed with a forged classical signature, providing evidence of the algorithm's compromise. The network's fallback logic would verify this proof and, if valid, immediately shift authority to the PQC signature for all subsequent blocks. This creates a self-healing security model that responds autonomously to a realized threat.

Implementation requires careful smart contract design. Below is a simplified Solidity interface outlining the core verification and fallback logic: The verifyHybrid function would check the classical signature first. If isFallbackActive() returns false , a valid classical signature is sufficient. If the fallback is active, the function must also validate the PQC signature, enforcing the dual-signature requirement.

Key challenges include increased transaction size from carrying two signatures and higher computational overhead for verification. Projects like Ethereum have explored this through EIPs, considering the integration of PQC algorithms like Falcon or Dilithium. The architecture is not just theoretical; it's a necessary roadmap for any blockchain or smart contract system managing high-value, long-lived assets that must remain secure for decades, bridging the gap between today's infrastructure and tomorrow's cryptographic reality.

Selecting and integrating quantum-resistant algorithms with classical cryptography for a secure, future-proof signature scheme. The NIST Post-Quantum Cryptography (PQC) Standardization Project has selected four primary algorithms for standardization. Use these for robust, vetted security.

A hybrid signature combines a classical algorithm (like ECDSA or EdDSA) with a post-quantum algorithm, signing the same message with both. This provides cryptographic agility and maintains security even if one algorithm is broken. This approach ensures backward compatibility with existing systems while deploying quantum resistance. For long-term key storage and high-assurance scenarios, stateful hash-based signatures like LMS (Leighton-Micali Signature) and XMSS (eXtended Merkle Signature Scheme) are standardized by NIST (SP 800-208).

Ideal for firmware signing, code signing, and root CA certificates where key usage is controlled and infrequent. Choosing an algorithm involves balancing signature size, key size, and computational speed , which impact gas costs on-chain and user experience. Test in your target environment (e.g., EVM, Solana, Cosmos SDK) to measure real-world overhead for signature verification , which is the critical on-chain operation.

Adoption requires support from wallets and interoperability standards. Monitor and contribute to these evolving specifications. 4. Practical Deployment, Analysis & Case Studies Action: Implement using libraries like liboqs (Open Quantum Safe) or PQClean for reference, and engage with standard bodies like the IETF and W3C .

A hybrid architecture introduces new attack vectors. Conduct formal security audits and cryptographic threat modeling before mainnet deployment. Engage specialized firms with expertise in both classical and post-quantum cryptography. Key technical and operational differences between established classical digital signatures and emerging Post-Quantum Cryptography (PQC) alternatives.

The serialization format defines how classical and quantum data are structured and encoded for signing and verification, forming the backbone of the hybrid protocol. A hybrid classical-quantum signature architecture requires a deterministic data structure that can be processed by both classical algorithms and quantum circuits. The primary goal is to create a canonical byte representation of the message to be signed, ensuring that both the classical ECDSA component and the quantum Lamport component sign the exact same data.

This prevents signature forgery attacks where discrepancies between the two signed payloads could be exploited. Common approaches involve using a cryptographic hash function like SHA-256 to create a fixed-size digest, which then serves as the input for subsequent signing steps. The serialization must account for the different key structures. For the classical part, you serialize the message for ECDSA.

For the quantum-resistant part, you typically serialize the SHA-256 hash of the message for use with a stateful hash-based signature scheme like SPHINCS+ or a one-time signature like Lamport. A practical design is a two-layer hash: H_msg = SHA-256(message) , where H_msg is signed by ECDSA, and H_q = SHA-256(H_msg || "quantum_context") is signed by the quantum-safe algorithm. This chaining ensures binding and domain separation. The "quantum_context" string is a domain separation tag to prevent cross-protocol attacks.

Implementation requires careful byte-order specification (typically big-endian) and the exclusion of mutable metadata. For example, when serializing a transaction for a blockchain, you must define a canonical order for fields (nonce, to, value, data, etc.) and RLP or SSZ encoding before hashing. In code, this often looks like: The format must also define how the combined signature is serialized for transmission and verification. A simple concatenation is sig_combined = sig_ecdsa || sig_quantum , where sig_ecdsa is the standard 64-byte (r,s) ECDSA signature and sig_quantum is the potentially larger hash-based signature (e.g., ~41KB for SPHINCS+-SHA256-128f-simple). A verifier must know how to split this byte array. Including a short header with version and algorithm identifiers makes the system future-proof and interoperable, allowing for upgrades to the quantum component without breaking existing verifiers.

Finally, consider state management for stateful hash-based signatures. If using a one-time key like in the Lamport scheme, the serialized public key must include or be linked to a key index or nonce to track usage and prevent reuse. This state must be synchronized between the signer and verifier, often requiring a distributed keystore or blockchain to record used key indices. The serialization format is not just about data encoding; it's the protocol specification that ensures all parties have a shared, unambiguous understanding of the data being cryptographically committed.

This section details the core verification logic for a hybrid signature, outlining the specific checks and cryptographic operations required to validate a signature that combines classical and quantum-resistant components. The verification logic for a hybrid signature must sequentially validate both the classical and post-quantum components. A successful verification requires both parts to be independently valid. The process begins by parsing the composite signature sig_hybrid = sig_classical || sig_pqc , where || denotes concatenation. The verifier extracts the corresponding public keys pk_classical (e.g., a secp256k1 point) and pk_pqc (e.g., a Dilithium or Falcon public matrix) from the signer's credentials. The message m that was signed must be identical for both algorithms; any discrepancy constitutes a forgery attempt.

First, verify the classical component (e.g., ECDSA or EdDSA) using its standard algorithm. For ECDSA on Ethereum, this involves recovering the signer's address from (v, r, s) and the message hash, and checking it matches the expected pk_classical . This step ensures backward compatibility with existing wallets and smart contracts. If this check fails, verification halts immediately—the signature is invalid. This design prioritizes security and efficiency, as the classical verification is typically faster than PQC verification.

Next, verify the post-quantum component using its specific algorithm. For a lattice-based scheme like Dilithium , this involves using pk_pqc to verify that sig_pqc is a valid signature on the same message hash H(m) . This step is computationally more intensive but provides the quantum resistance. The choice of PQC algorithm (ML-DSA, SLH-DSA, etc.) dictates the exact verification routine, which should be implemented using audited libraries like liboqs or PQClean .

A critical implementation detail is strong domain separation between the two signature schemes. The same raw message m must be prepared (hashed) independently for each algorithm according to its own specification. Relying on a single hash output for both can introduce vulnerabilities. Furthermore, the verification logic should enforce strict bounds on signature sizes and public key formats to prevent parsing attacks or malleability issues that could bypass one of the checks.

For on-chain verification in a smart contract, the PQC component presents a challenge due to gas costs. A practical architecture might use a verification abstraction layer : the classical part is verified on-chain (e.g., via ecrecover ), while the PQC part's validity is attested to by a trusted off-chain verifier or a zk-SNARK proof. Alternatively, specialized precompiles or layer-2 solutions may be required for direct, gas-efficient PQC verification in the future.

Finally, the system must have a clear failure mode. If either component is invalid, the entire hybrid signature is rejected. Audit logs should record which component failed to aid in debugging and threat analysis. This strict, sequential logic ensures the hybrid signature inherits the security guarantees of both constituent algorithms, creating a robust defense against both classical and quantum adversaries.

This section details the cryptographic key lifecycle for a hybrid classical-quantum signature scheme, focusing on the generation, storage, and distribution of both classical and quantum-resistant keys. The foundation of a hybrid signature architecture is the secure generation of two independent key pairs: a classical key pair (e.g., ECDSA secp256k1) and a post-quantum cryptography (PQC) key pair (e.g., CRYSTALS-Dilithium). These keys are generated in parallel but must be cryptographically bound together. The public keys are often concatenated or hashed to form a single composite public key, while the private keys are stored separately. This dual-key approach ensures that the system remains secure against both current classical attacks and future quantum computer attacks.

Key management presents significant challenges, particularly for PQC keys which are often larger. A Dilithium3 private key can be ~2.5KB, compared to a 32-byte ECDSA key. Secure storage solutions like Hardware Security Modules (HSMs) or Trusted Execution Environments (TEEs) are critical. The architecture must define a clear key lifecycle: generation, activation, rotation, and revocation. For blockchain applications, key generation is typically performed off-chain by the user's client, with the composite public key then registered on-chain as an address or account identifier.

A practical implementation involves using a Key Derivation Function (KDF) from a single strong entropy source to seed both key generation algorithms, ensuring a cryptographically secure link. Below is a simplified conceptual outline in pseudocode: The architecture must also plan for key rotation and migration . Unlike classical keys which may remain static for years, PQC algorithms are newer and may require more frequent updates due to standardization tweaks or improved parameter sets. A hybrid design should allow for the PQC component to be re-generated and re-bound to the existing classical key without changing the user's on-chain composite address, if possible. This requires careful design of the key binding mechanism, often involving a deterministic commitment to the PQC public key within a smart contract or account record.

Finally, consider the operational trade-offs. Using two signatures increases transaction size and verification cost. Schemes like X3DH for key exchange or SPHINCS+ for stateless hash-based signatures offer different size/performance profiles than lattice-based Dilithium. The chosen PQC algorithm should align with the network's constraints. The management system must also handle edge cases, such as the loss of one private key, potentially through a multi-signature or social recovery scheme that uses the remaining secure key as a recovery mechanism.

Comparison of policy approaches for migrating from classical to quantum-resistant signatures in a hybrid architecture. A practical guide to building efficient, quantum-resistant digital signatures by combining classical and post-quantum cryptography to reduce computational load and signature size. A hybrid classical-quantum signature architecture combines a traditional algorithm like ECDSA or EdDSA with a post-quantum cryptography (PQC) algorithm, such as CRYSTALS-Dilithium or SPHINCS+. The primary goal is to hedge against the risk that one of the underlying algorithms is broken, either by a classical attack on the PQC scheme or by the advent of a large-scale quantum computer that can break the classical one. This dual-signature approach, however, introduces significant overhead: you must compute, transmit, and verify two signatures, and store two public keys. For blockchain applications where gas costs and on-chain storage are critical, this naive duplication is often prohibitive.

To mitigate this overhead, the architecture must be designed for efficiency from the ground up. A core strategy is to use a single, combined verification operation . Instead of running two independent verification routines, you design a logical construct where both signatures are verified in a single, optimized step. This can be achieved by having the signer produce a single, aggregated proof that validates both the classical and PQC components simultaneously. The verification logic then checks this combined proof, which is computationally cheaper than the sum of its parts. This requires careful cryptographic engineering to ensure the security properties of both algorithms are preserved in the combined structure.

Storage overhead is addressed by public key aggregation . Rather than storing two full public keys (e.g., a 32-byte Ed25519 key and a 1.3KB Dilithium2 key), you can derive them from a single master seed or use key encapsulation. One method is to generate the PQC key pair, then use a hash of the PQC public key as the randomness or seed for generating the classical key pair. The verifier can then recompute the classical public key on-demand, needing to store only the PQC public key. This technique can cut the combined public key size by nearly 50%, a critical saving for on-chain smart contracts and transaction formats.

For computational efficiency in signing, leverage precomputation and batch verification . Many PQC algorithms have a computationally expensive key generation phase. In a system where keys are long-lived (like a blockchain wallet), this one-time cost is acceptable. Furthermore, if your application verifies multiple signatures at once (e.g., a block validator), implement batch verification for the hybrid scheme. This allows verifying a batch of n hybrid signatures in significantly less time than n times the cost of a single verification. Libraries like liboqs provide integrations that can be adapted for such batched hybrid operations.

Implementing this requires a concrete protocol. Here is a conceptual outline for a hybrid EdDSA-Dilithium signature using key derivation: This design ensures quantum resistance while optimizing for the constraints of decentralized systems. Finally, continuously monitor the cryptographic landscape and plan for agility. The NIST PQC standardization process is ongoing, and algorithms may be updated or replaced. Your hybrid architecture should use modular, upgradeable components, allowing the PQC algorithm to be swapped without changing the classical layer or the overall system logic. This approach, focused on combined verification, key derivation, and modularity, provides a practical path to quantum-safe signatures without incurring unsustainable computational and storage costs in production environments.

5. Performance Evaluation & Extended Technical Observations Practical libraries and specifications for building hybrid classical-quantum signature architectures. These resources focus on combining post-quantum algorithms with existing ECDSA or RSA systems while maintaining backward compatibility and verifiable security assumptions.

liboqs is the reference C library for post-quantum cryptography used in most production-grade hybrid experiments. liboqs is the lowest-level building block for custom blockchain or protocol integrations. OQS-OpenSSL is a fork of OpenSSL that adds post-quantum and hybrid signature support at the TLS and certificate layer. Although not intended for direct on-chain use, OQS-OpenSSL provides a proven reference for how hybrid verification logic should be structured.

The NIST PQC standardization project defines the algorithms most hybrid systems are built around. NIST specifications are essential for parameter selection, threat modeling, and compliance-driven architectures. CIRCL is Cloudflare’s cryptographic library written in Go, with production-tested post-quantum implementations. CIRCL is one of the best options for hybrid designs in Go-based clients, relayers, or validator software.

Bouncy Castle provides mature post-quantum cryptography support for Java environments. Bouncy Castle is the most practical option for hybrid PQ integration in JVM-based wallets, custody platforms, and enterprise signing services. Answers to common technical questions about designing and implementing hybrid classical-quantum signature architectures for post-quantum security.

A hybrid signature scheme combines a classical digital signature (like ECDSA or EdDSA) with a post-quantum cryptography (PQC) algorithm (like Dilithium or Falcon) into a single signature. The primary goal is cryptographic agility and defense against quantum attacks. How it works : The signer generates two independent signatures for the same message: one classical and one PQC. The verifier must validate both signatures for the combined signature to be accepted. This provides a safety net: the system remains secure even if one of the underlying algorithms is broken, whether by a quantum computer (breaking the classical one) or by a classical cryptanalysis advance (breaking the PQC one). This approach is recommended by standards bodies like NIST and IETF during the transition to a post-quantum future.

Designing a hybrid signature verifier for Ethereum requires managing gas costs and data handling. A common pattern uses signature concatenation . Key Challenge : PQC algorithms often have large public keys and signatures (e.g., 2-10 KB), making direct storage and calldata expensive. Consider using commitment schemes or verifiable credentials to reduce on-chain footprint.

Adopting hybrid signatures introduces significant overhead that must be engineered around. Managing the lifecycle of two cryptographic key pairs is a critical security challenge. The private keys should be generated and stored independently to avoid creating a single point of failure. Tools like TSS (Threshold Signature Schemes) can be adapted to split each private key across multiple parties, further enhancing security.

Your choice depends on the trade-off between signature size, speed, and security confidence. Rely on NIST-standardized algorithms from their PQC project. Avoid experimental or non-standardized schemes . Monitor IETF drafts like draft-ounsworth-cfrg-hybrid-signatures for formalized combination methods. Libraries like Open Quantum Safe (liboqs) provide reference implementations for integration testing.

EIP-712 (Structured Data Signing) defines a standard for signing human-readable, typed data. To integrate hybrid signatures, you must extend the protocol. Approach : The domainSeparator and hashStruct process defined by EIP-712 remains unchanged. You create a single, unambiguous hash of the typed data. This hash becomes the message digest that both the classical and PQC signature algorithms sign.

Verification : The verifier recovers typedDataHash and checks it against both signatures. This ensures the signer's intent is cryptographically bound by both algorithms, maintaining the legal and semantic benefits of EIP-712 while adding quantum resistance. Production systems our engineers design, build and run, scoped to what you are working on.

Smart contracts, DeFi, wallets, tokenization and infrastructure across the ecosystems teams choose today, plus other networks on request. Digital signatures represent a crucial cryptographic asset that must be protected against quantum adversaries. Quantum Digital Signatures (QDS) can offer solutions that are information-theoretically (IT) secure and thus immune to quantum attacks. In this work, we analyze three existing practical QDS protocols based on preshared secure keys (e.g., established with quantum key distribution) and universal hashing families. For each protocol, we make amendments to close potential loopholes and prove their IT security while accounting for the failure of IT-secure authenticated communication. We then numerically optimize the protocol parameters to improve efficiency in terms of preshared bit consumption and signature length, allowing us to identify the most efficient protocol.

Popular public-key digital signature (DS) protocols, such as the digital signature algorithm (DSA) [ 1 ] and the elliptic curves DSA [ 2 ] , can be broken by large-scale fault-tolerant quantum computers. The new post-quantum DS standards FIPS 204 [ 3 ] and FIPS 205 [ 4 ] are not (yet) efficiently attackable by quantum computers, but their security is still based on computational assumptions. Conversely, the appeal of quantum digital signatures (QDS) lies in their information-theoretic (IT) security, i.e., security against computationally unbounded adversaries, analogously to quantum key distribution (QKD).

DSs based on a public-key infrastructure can be verified by any user by simply retrieving the public key of the sender, which requires a trusted third party (a certificate authority) certifying that the public key actually belongs to the sender. Conversely, QDS schemes aiming at IT security do not rely on a trusted authority and may require pairwise preshared keys between all users, which can limit the number of users able to verify a signature. For this reason, QDS schemes have been mostly analyzed in the simplest non-trivial scenario, i.e. a tripartite scenario with a sender, a receiver and an additional verifier.

The first QDS was proposed in 2001 by Gottesman and Chuang [ 5 ] , with challenging experimental requirements such as quantum memories, secure quantum channels and swap tests. Later protocols removed the requirement of quantum memories but were still based on authenticated -- hence secure 1 1 1 Note that an authenticated quantum channel must be also a private channel. Indeed, any attempt to learn about the quantum state traveling in the channel leads to a modification of the state, which implies the channel is no longer authentic. Hence, authenticity implies privacy for quantum channels. – quantum channels [ 6 ] . In 2016, more practical QDS schemes were proposed without the need of secure quantum channels [ 7 , 8 ] . However, the scheme in Ref. [ 7 ] is not proved secure under the more general type of attacks. Anyways, the main drawback of previous QDS schemes, including Refs. [ 7 , 8 ] , is that they can only sign single-bit messages, thus resulting inefficient for long messages.

To overcome the security and efficiency limitations of previous QDS proposals, three promising QDS schemes have been proposed, respectively by Yin et al. in Ref. [ 9 ] , by García Cid et al. in Ref. [ 10 ] and by Amiri et al. in Ref. [ 11 ] . These schemes can sign arbitrarily long documents with relatively short signatures, thereby improving on the efficiency of previous proposals by several orders of magnitude. The quantum nature of these schemes lies in leveraging preshared QKD keys (and universal hashing families) to achieve IT security –except for Ref. [ 10 ] , due to the use of computationally secure hash functions.

Recently, the protocol by Yin et al. was further developed to remove the need for privacy amplification [ 12 ] and also error correction [ 13 ] in the QKD protocols preceding the signature scheme. In parallel, the protocol by García Cid et al. was improved in Ref. [ 14 ] in terms of security bounds and signature length, though still lacking the IT security of the other two protocols. The protocol by Amiri et al. was modified in Ref. [ 15 ] , where the authors improve the scalability of the protocol for large networks of receivers by introducing a smaller and relatively trusted subnetwork that is tasked with verifying the signatures on the proxy of all other nodes. In the process, the authors also close a security loophole of the original protocol [ 11 ] and prevent dishonest coalitions of receivers from enforcing non-transferability by limiting the number of dishonest users compared to Ref. [ 11 ] .

Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Post-quantum%20cryptography • https://en.wikipedia.org/wiki/Lattice-based%20cryptography • https://en.wikipedia.org/wiki/NIST%20Post-Quantum%20Cryptography%20Standardization • https://ethereum.org/roadmap/security/quantum-resistance/ • https://jilsovereign.com/learn/quantum-safe-signatures-architecture • https://chainscorelabs.com/guides/quantum-resistance-and-future-cryptography/quantum-safe-signature-schemes/how-to-d esign-a-hybrid-classical-quantum-signature-architecture • https://arxiv.org/html/2508.05355v1