R+9 · Quantum trust

Signed today. Valid in 2040.

A quantum computer large enough to break RSA and elliptic curves does not need to exist yet to cause harm. Anything recorded or signed today with classical cryptography alone is already on a clock.

Plan a migrationSee both legs checked
Classical legEd25519 · RFC 8032
Post-quantum legML-DSA-65 or -87 · FIPS 204
Key encapsulationML-KEM-768 · FIPS 203
StateIn development
00 Two hybrid strengths

ML-DSA-65 or ML-DSA-87. You choose.

DEFAULT

Ed25519 + ML-DSA-65

The balance of size and strength for most records: enterprise, finance, government.

In development

DEFENCE PROFILE

Ed25519 + ML-DSA-87

The highest ML-DSA security level, the one CNSA 2.0 names for national-security systems. For defence and strategic programmes.

In development

Both are hybrid: a forger must break the classical and the post-quantum signature at once. Choose one per system, run both side by side, or move from one to the other with signed migration evidence.

01 Why now

The deadline is set by your data, not by the machine.

A cryptographically relevant quantum computer (CRQC) running Shor's algorithm would recover private keys for RSA and elliptic-curve cryptography. Nobody can tell you the year it arrives. What you can work out is how long your records must stay secret and how long your signatures must stay trustworthy.

If a contract, a medical file or an AI audit trail has to remain valid for fifteen years, and a migration takes five, the work had to start before the machine exists. That gap is why standards bodies finalised post-quantum algorithms in 2024 and why national programmes now publish migration timelines (for example the UK NCSC, the EU roadmap and NIST's draft IR 8547).

For R-Series the question is sharper still. A receipt is evidence. If its signature can be forged in 2035, every decision it proves becomes deniable. So R-Series receipts are designed to carry a lattice-based ML-DSA-65 signature from the day they are issued. The hybrid issuer is in development.

02 The threat, in four acts

Harvest now. Decrypt later.

Threat timeline01 / 04
01 · CAPTURE

Traffic and records are copied today.

An adversary does not need to read them yet. Storage is cheap and patience is free. Encrypted backups, VPN sessions and signed archives are all worth keeping.

02 · WAIT

Years pass.

Medical files, contracts, state records and audit trails stay sensitive for decades, far longer than most migration plans assume.

03 · BREAK

A CRQC arrives.

Shor's algorithm recovers RSA and elliptic-curve private keys. Everything sealed only with them opens, and their signatures can be forged after the fact.

04 · HOLD

Lattice-based records stay sealed.

Receipts carrying an ML-DSA-65 leg, and secrets wrapped with ML-KEM-768, rest on module-lattice problems a quantum computer is not known to solve efficiently.

The same attack, packet by packet: traffic is copied into storage today; years later a quantum computer opens what was sealed only with RSA or elliptic curves. Packets sealed with the hybrid post-quantum suite stay closed.

03 The suite

Every algorithm in the R-Series suite, and what it is for.

Algorithm suite01 / 06
CLASSICAL SIGNATURE

Ed25519

Fast, small, deterministic and well studied. It keeps receipts verifiable by every existing tool today. Specified in RFC 8032.

Staging · release candidate 4

POST-QUANTUM SIGNATURE

ML-DSA-65

The module-lattice digital signature standardised in FIPS 204, at the security level NIST maps to category 3. Signatures are larger (about 3.3 KB), which is why R-Series hashes content and signs the canonical receipt, not the payload.

Staging · release candidate 4

POST-QUANTUM KEM

ML-KEM-768

Key encapsulation from FIPS 203, used to wrap the keys that seal agent memory and in hybrid key exchange for transport.

In development

HASH-BASED SIGNATURE

SLH-DSA

Stateless hash-based signatures from FIPS 205. Slower and larger, but resting only on hash functions: a conservative choice for records that must outlive every other assumption.

Planned

DIGEST

SHA-256

Content digests, Merkle leaves and roots. Grover's algorithm halves its effective strength, which still leaves a comfortable margin at 256 bits.

Staging · release candidate 4

AGILITY

Suite registry

Every receipt names its suite. The registry records when each suite was introduced and deprecated, so receipts are checked under the rules they were issued with and never re-signed.

In development

04 Why hybrid

Two locks, not a swap.

Post-quantum algorithms are young. Classical ones are well understood but mortal. A hybrid signature stays safe as long as either one holds.

HYBRID SUITE

Ed25519 AND ML-DSA-65

Missing, invalid or stripped legs fail verification. The old "verifiers accept either" rule does not apply to the hybrid suite.

In development

DOWNGRADE DEFENCE

No silent fallback

Every strip, swap and reorder of the two signatures is in the negative test vectors and must be rejected.

In development

RESEARCH PROFILE

Pure post-quantum

A separate, versioned profile kept dark while implementations and side-channel guidance mature.

Planned

05 Tested against

Known answers and known attacks.

Test familyWhat it checksState
FIPS 204 known answersML-DSA outputs match the official known-answer vectors.In development
RFC 8032 vectorsEd25519 matches the standard's test vectors.In development
Downgrade suiteEvery strip, swap or reorder of a hybrid signature is rejected.In development
Public test corporaEdge cases and malformed inputs from public corpora.In development
In-browser verificationML-DSA-65 checked client-side in the browser demo on the verify page.In development
Independent reviewThird-party cryptographic assessment of the release candidate.Planned
06 Questions

What people ask us.

Is a quantum computer able to break RSA today?

No public machine can. The risk today is data and signatures created now that must stay trustworthy after one exists. That is why the migration starts before the threat is real.

Why not switch to post-quantum only?

Post-quantum implementations are newer and less battle-tested. A hybrid signature keeps the classical guarantee while adding the post-quantum one, and fails closed if either is missing.

Are ML-DSA signatures too large?

They are larger than Ed25519, but R-Series signs a compact canonical receipt that contains only hashes of the content, so the overhead stays bounded per action.

Will old receipts need to be re-signed?

No. Receipts are checked under the suite they were issued with. History is never re-signed to look current.

Your estate still runs RSA. That is normal.

The work is finding it, ranking it and moving it without breaking anything.

See the migration path

Want the details for your sector? Book a briefing — we share the full design and a live demo in a private session.