Cryptographic agility and post-quantum status

1. Status at a glance#

In plain language: today's receipts are safe against every computer that exists. A future, large quantum computer could forge Ed25519 signatures, so receipts are designed to let us add a new kind of signature without changing the old ones.

2. Why this matters for receipts#

Encryption protects data for as long as it is secret. A signature has to stay trustworthy for as long as anyone relies on it, and receipts can be relied on for many years: in an audit, a contract dispute or a court case long after the event.

Ed25519, like every signature algorithm in wide use today, rests on mathematical problems that a sufficiently large quantum computer could solve with Shor's algorithm. No such computer exists, and published estimates of when one might exist vary widely. If one is ever built, an attacker could compute a private key from its public key and sign receipts with any date in them.

3. What protects old receipts if Ed25519 falls#

A forger with a quantum computer could produce a new signature, but could not change what already exists outside our systems. Three things limit the damage:

• Copies held by others. A receipt you exported, or handed to a counterparty or a court, is a fixed record of what it said on the day it was handed over. A forgery made later does not change that copy.
• Our stored copy. While a receipt is inside its plan's retention window we hold it, and we can say whether a receipt someone presents matches what we issued, as the Verifier Terms describe.
• Re-signing before the break. Before Ed25519 becomes unsafe, receipts that still matter can be countersigned with a post-quantum algorithm. A countersignature made while Ed25519 is still sound shows that the original receipt existed and was valid at that time.

4. How receipts are built to change algorithms#

Every receipt names the key that signed it, inside the signed bytes, and every published key states its algorithm. A verifier picks the algorithm from the key, not from an assumption. That means:

• a new algorithm can be introduced under new key ids, and receipts signed with older keys keep verifying with the keys they name;
• a new format version can add a second signature for a transition, so verifiers that only know Ed25519 keep working while newer verifiers check both; and
• retiring an algorithm means we stop signing with it, never that we withdraw the public keys older receipts need. See Key management and Format versions and long-term verification.

5. The path to post-quantum signatures#

NIST published ML-DSA, a post-quantum signature standard, as FIPS 204 in August 2024.

The move will happen in this order, and each step will be announced on this page and in the changelog before it reaches production receipts:

1. publish ML-DSA public keys alongside the Ed25519 keys, so verifiers can prepare;
2. add ML-DSA verification to our verification libraries and the /verify page;
3. sign new receipts with both Ed25519 and ML-DSA; and
4. offer post-quantum countersignatures for receipts issued before step 3.

We have not set dates for these steps. We will not drop Ed25519 from new receipts while verifiers commonly depend on it.

6. Changes and contact#

We update this page whenever the status changes. Questions: security@agined.com.