Post-Quantum Cryptography for Identity

The National Institute of Standards and Technology selected CRYSTALS-Dilithium (ML-DSA), FALCON, and SPHINCS+ as standardized post-quantum digital signature algorithms. These lattice-based and hash-based schemes replace RSA and ECDSA in identity protocols. Dilithium is optimized for signing speed and verification efficiency, making it the primary candidate for Verifiable Credential and DID document signatures. The transition mandates hybrid certificates during migration phases, combining classical and post-quantum algorithms to maintain backward compatibility while ensuring forward secrecy against harvest-now-decrypt-later attacks.

Hybrid authentication combines classical ECDSA with post-quantum Dilithium signatures within a single X.509 certificate or DID document verification method. This dual-signature approach ensures that if a quantum computer breaks the elliptic curve component, the lattice-based component remains secure. Identity wallets and verifiers must support parallel validation of both signatures during the transition period. The technique is critical for Verifiable Data Registries and Trust Registries that anchor DID documents, preventing downgrade attacks where an adversary strips the PQC signature to force reliance on vulnerable classical algorithms.

Post-quantum signature schemes divide into two categories with profound identity system implications. Stateless schemes like Dilithium and FALCON require no memory of previous signatures, making them suitable for stateless identity wallets and ephemeral DIDComm sessions. Stateful hash-based schemes like LMS and XMSS require maintaining a monotonically increasing counter to prevent private key reuse; a single counter mismanagement destroys security. Stateful signatures are ideal for firmware signing and Hardware Roots of Trust but dangerous for general-purpose identity wallets where key state synchronization across devices is complex.

DIDComm v2 messaging protocol must be upgraded to support post-quantum key agreement for establishing encrypted peer-to-peer channels. The standard X25519 elliptic curve Diffie-Hellman is replaced with CRYSTALS-Kyber (ML-KEM), a lattice-based key encapsulation mechanism standardized by NIST. Identity Hubs and Decentralized Web Nodes that store encrypted Verifiable Credentials must re-encrypt stored data with Kyber-derived keys to prevent retrospective decryption. The transition requires updating DID Document keyAgreement verification relationships to include post-quantum public keys alongside legacy keys during migration.

Privacy-preserving credential schemes face unique challenges. BBS+ signatures rely on pairing-based cryptography (BLS12-381 curve), which is vulnerable to quantum attacks via Shor's algorithm. Research into post-quantum anonymous credentials explores lattice-based group signatures and zero-knowledge proofs that preserve selective disclosure and unlinkability. The migration path involves transitioning to zk-STARK or lattice-based accumulator constructions that enable holders to prove possession of attributes without revealing correlatable identifiers. This is critical for eIDAS 2.0 digital identity wallets requiring both quantum resistance and privacy.

Generating lattice-based private keys requires high-quality entropy and resistance to side-channel attacks. Trusted Platform Modules (TPM 2.0) and Secure Enclaves are being updated to support Dilithium and Kyber key generation within tamper-resistant silicon. The hardware root of trust must perform constant-time matrix sampling to prevent timing attacks that leak polynomial coefficients. For sovereign identity systems, this ensures that post-quantum keys for Legal Entity Identifiers and national digital identity wallets are generated in certified hardware, providing cryptographic attestation that the key material never left the secure boundary.

A transitional cryptographic architecture that combines classical and post-quantum algorithms within a single X.509 certificate or DID Document verification method. This approach provides defense-in-depth during the migration period:

• A certificate contains both an ECDSA signature and a Dilithium signature
• Validation requires both signatures to verify successfully
• Protects against harvest-now-decrypt-later attacks where adversaries store encrypted traffic today for quantum decryption later
• Enables gradual infrastructure migration without flag-day transitions

Hybrid schemes are specified in IETF drafts for TLS and are being adopted by national identity frameworks like eIDAS 2.0.

An attack strategy where adversaries collect and store encrypted communications today with the expectation of decrypting them once cryptographically relevant quantum computers become available. This threat is particularly acute for identity systems:

• Long-lived identity credentials issued today may remain valid for 10+ years
• Biometric templates and identity attributes have permanent sensitivity
• Adversaries can retroactively deanonymize zero-knowledge proofs if the underlying cryptography is broken
• Migration to post-quantum algorithms must begin before quantum threats materialize

The threat model drives urgent adoption of quantum-resistant signatures for Verifiable Credentials with extended validity periods.

Decentralized Identifier methods that natively support post-quantum cryptographic key types in their DID Document verification relationships. Key implementation considerations:

• did:key must encode Dilithium and Kyber public keys using multicodec prefixes
• did:web requires hybrid certificate chains in TLS endpoints
• did:indy and AnonCreds need updated CL-signature equivalents resistant to quantum attacks
• KERI-based identifiers (AIDs) must support post-quantum pre-rotation schemes

Method specifications are being updated through the W3C DID Working Group and DIF working groups to define quantum-safe key representations and verification method types.