Security · 2026-03-08

Post-Quantum Identity: NIST FIPS 204 and Your Auth Stack

By J. W. Bouckaert

The standard is final. The clock is running.

On August 13, 2024, NIST published FIPS 204: the Module-Lattice-Based Digital Signature Standard, formally standardizing ML-DSA (formerly CRYSTALS-Dilithium) as the primary post-quantum signature algorithm for federal systems. FIPS 203 (ML-KEM for key encapsulation) followed the same day.

FIPS 204 is a binding federal standard, no longer a draft, a candidate, or a recommendation, and every system that touches US government data, or that enterprise customers expect to remain compliant, now operates under a countdown.

The question is no longer "should we prepare for post-quantum cryptography?" The question is: how much of your identity infrastructure needs to be rebuilt, and how quickly can you do it?

ML-DSA-65

ML-DSA is a lattice-based digital signature scheme. "Lattice-based" means the mathematical hardness assumption is the Module Learning With Errors (MLWE) problem, not integer factorization (RSA) or discrete logarithms (ECC). No known quantum algorithm solves MLWE efficiently.

FIPS 204 defines three security levels:

• ML-DSA-44: NIST Security Level 2 (comparable to AES-128)
• ML-DSA-65: NIST Security Level 3 (comparable to AES-192)
• ML-DSA-87: NIST Security Level 5 (comparable to AES-256)

ML-DSA-65 is the sweet spot for identity systems. The following table illustrates why—and what the migration from classical to post-quantum signatures looks like in practice:

Latency figures are PQClean reference-implementation benchmarks on x86_64 (single-threaded, AVX2 disabled); WebAssembly builds typically run 3 to 5 times slower. ML-DSA-65 provides 192-bit equivalent quantum security with signature sizes of approximately 3,309 bytes and public keys of approximately 1,952 bytes. These are larger than Ed25519, but manageable for identity attestation where signatures are verified server-side and never embedded in QR codes.

For context on why identity specifically needs this level of protection, see Identity is a Physics Problem, Not a Math Problem.

Assumptions your auth stack makes

Most authentication platforms were designed around two assumptions:

1. RSA-2048 or ECC P-256 will remain secure for the foreseeable future
2. Key and signature sizes will remain small

Both assumptions are now wrong.

The CRQC timeline

A Cryptographically Relevant Quantum Computer (CRQC) capable of breaking RSA-2048 is estimated to arrive between 2029 and 2035, depending on the analysis. But "harvest now, decrypt later" attacks are already happening: adversaries collect encrypted traffic today, intending to decrypt it once quantum hardware matures.

For identity systems, this means:

• Signed credentials issued today can be forged retroactively once classical signatures are broken
• Session tokens signed with ECDSA or EdDSA lose their non-repudiation guarantees
• Audit trail integrity depends on signatures that a CRQC could forge

This is a 2026 procurement decision.

Migration

Swapping RSA or ECC for ML-DSA is not a library upgrade. It requires:

1. New key management: ML-DSA keys are 10x to 40x larger than ECC keys. Key storage, rotation, and distribution infrastructure must be redesigned.
2. Signature format changes: Every system that parses, stores, or transmits signatures must handle 3KB+ payloads instead of 64 bytes.
3. Protocol updates: JWT headers, VC proof formats, and WebAuthn attestation structures all assume compact signatures.
4. Performance revalidation: ML-DSA signing is roughly an order of magnitude slower than Ed25519 in pure CPU terms (PQClean reference: ~470 µs vs. ~50 µs for ML-DSA-65 vs. Ed25519), and key generation is meaningfully slower still. The cost is small in absolute terms, but it shifts the tail-latency profile of any service that signs on the request path.

Most identity platforms have not started this work. The ones that have are targeting 2028 for production readiness.

The hybrid signature architecture

PasskeyBridge does not wait for a full PQC migration. We deploy a hybrid dual-signature architecture today: every cryptographic attestation carries both a classical signature and a post-quantum signature.

┌─────────────────────────────────────────────┐
│            Hybrid Signature Envelope        │
├─────────────────────────────────────────────┤
│  Classical Layer:  ES256 / ES384 (ECDSA)    │
│  PQC Layer:        ML-DSA-65 (FIPS 204)     │
│  Nonce:            QRNG-seeded (256-bit)    │
│  Fingerprint:      SHA-256(domain)          │
└─────────────────────────────────────────────┘

Reasons for hybrid

The hybrid approach provides defense-in-depth against two failure modes:

1. If PQC is broken (a new attack on MLWE is discovered): the classical signature still holds. The attestation remains valid.
2. If a CRQC breaks classical crypto (Shor's algorithm on a production quantum computer): the PQC signature still holds.

Neither failure mode alone compromises the system. Both must fail simultaneously for an attestation to be forgeable.

This is the same philosophy NIST recommends in SP 800-227 (Recommendations for Post-Quantum Transition): deploy hybrid schemes during the transition period, then deprecate the classical layer once PQC confidence matures.

For how this integrates with the broader trust chain, see Why SIM-Swap Detection Is Not Enough and our three-pillar architecture overview.

PQC signature points

PasskeyBridge applies hybrid PQC signatures at four critical points in the identity lifecycle:

1. Verifiable credential issuance

Every W3C VC 2.0 credential issued through the native VC engine is co-signed with ML-DSA-65. The VC JWT carries both a classical proof and a pqcProof field, enabling verifiers to validate either or both signatures.

2. Cross-reference binding

When a deterministic cross-reference binds a carrier signal hash to a VC subject hash, the binding record is signed with the hybrid scheme. This ensures the cross-reference cannot be forged even with quantum capabilities.

3. Cached Trust Proofs

Offline trust tokens (Cached Proofs) that allow devices to verify identity without network connectivity carry hybrid signatures. This is critical for the hardware attestation scenarios where NF-08 Atomic Fingerprints require PQC-grade integrity.

4. Spatial Binding attestation

NF-08 Spatial Bindings that tie credentials to physical device characteristics include PQC signatures, ensuring that even quantum-capable adversaries cannot forge device attestations.

Entropy

A signature algorithm is only as strong as the randomness feeding it. ML-DSA-65 requires a 256-bit seed for key generation and a per-signature nonce. If that randomness is predictable, even a quantum-resistant algorithm produces forgeable signatures.

This is where most "PQC-ready" claims fall apart. Swapping the signature algorithm but keeping Math.random() or a CSPRNG seeded from /dev/urandom leaves a critical gap: the entropy source is deterministic in the classical sense.

PasskeyBridge addresses this with a Seed-and-Stretch architecture (patent-pending, NF-07):

The entropy pipeline

Outshift QRNG ──┐
                 ├── XOR Hybridize ──▶ AES-256-CTR-DRBG ──▶ Nonces
ANU QRNG ───────┘        │
    (failover)            │
                    Local CSPRNG
                    (tertiary fallback)

1. Quantum seed acquisition: 256-bit seeds sourced from photonic or vacuum-fluctuation quantum random number generators (Outshift primary, ANU failover)
2. XOR hybridization: The quantum seed is XOR'd with local CSPRNG output, ensuring that even if the QRNG source is compromised, the combined entropy exceeds the quantum seed alone
3. DRBG stretching: The hybridized seed feeds a NIST SP 800-90A compliant AES-256-CTR-DRBG that generates the actual nonces consumed by ML-DSA-65
4. Quality enforcement: Every seed is validated against a 7.5 bits/byte Shannon entropy threshold before acceptance

The result: every PQC signature in PasskeyBridge is backed by entropy that is physically non-deterministic at the quantum level, not merely computationally unpredictable.

For the full QRNG architecture, see the technical whitepaper.

A decision matrix for identity teams

If you are evaluating identity infrastructure for 2026 deployment, the decision matrix is straightforward:

The gap is not incremental. Platforms that lack QRNG-seeded entropy are deploying PQC signatures with classical randomness, a contradiction that undermines the entire quantum resilience guarantee.

For the compliance perspective, see Reg S-ID Compliance Without Storing a Single Phone Number and SOC 2 Readiness for Identity Startups.

The transition path

NIST SP 800-227 outlines a three-phase transition:

1. Inventory (now): Catalog all cryptographic dependencies in your identity stack
2. Hybrid deployment (2025-2027): Deploy hybrid classical + PQC schemes alongside existing infrastructure
3. PQC-only (2028+): Deprecate classical algorithms once PQC confidence and tooling mature

PasskeyBridge is in Phase 2 today. Enterprise tenants can enable PQC co-signing per-tenant via the pqc_enabled flag, allowing gradual rollout without disrupting existing integrations.

The hybrid architecture means there is no "big bang" migration. You enable PQC, your credentials get stronger, and your existing verification flows continue to work unchanged. When Phase 3 arrives, you deprecate the classical layer with a configuration change, well short of a re-architecture.

Summary

FIPS 204 is a current standard, and its procurement implications are immediate. The identity platforms that will survive the quantum transition are the ones deploying hybrid architectures today. Promising PQC readiness in a future release will not do it.

PasskeyBridge is the only identity threat response platform shipping production hybrid PQC signatures (ML-DSA-65) with QRNG-seeded entropy (NIST SP 800-90A) across verifiable credentials, cross-references, cached proofs, and spatial bindings. The architecture is live. The standard is final. The transition has started.

Read the technical whitepaper → | Explore the patent portfolio → | Start building →

Start free · Test the API