Shor's algorithm solves integer factoring and discrete logarithm problems in polynomial time on a cryptographically relevant quantum computer (CRQC) — breaking RSA, ECDSA, ECDH, and DH entirely.
Post-quantum algorithms rely on problems believed hard for both classical and quantum computers: lattice problems (MLWE/MSIS) and hash-function security. Standardised August 2024.
Security Under Quantum Attack
ML-KEM
Module Lattice KEM — replaces ECDH/RSA for key exchange. Three parameter sets: 512, 768, 1024.
ML-DSA
Module Lattice DSA — replaces ECDSA/RSA-PSS. Fiat-Shamir with aborts construction. Variants 44, 65, 87.
SLH-DSA
Stateless hash-based signatures — relies only on SHA-256/SHAKE. Conservative backup. 12 parameter sets.
selfdriven KERI/ACDC + PQC Migration Path
selfdriven's identity layer uses KERI Autonomous Identifiers (AIDs) — self-certifying, rotation-capable, and witness-anchored. Because AIDs support pre-rotation and key rotation via the Key Event Log (KEL), migrating to PQC signing keys (ML-DSA-65 for everyday events, SLH-DSA-256s for root AIDs) requires only a rot event — no re-issuance, no downtime. ACDC credentials issued under the new keys are immediately valid. The selfdriven ecosystem is structurally PQC-ready today.
ML-KEM
Module Lattice-based Key Encapsulation Mechanism (CRYSTALS-Kyber)
Hard Problem — Module Learning With Errors (MLWE)
Given public matrix A and vector b = As + e (mod q), find secret s — where e is a small-magnitude "error" sampled from a binomial distribution. With the right parameters, this is computationally indistinguishable from random for both classical and quantum adversaries.
// Interactive Lattice — Move Mouse Over Canvas
Protocol Walkthrough — Key Exchange
// Simulate Key Generation
Parameter Sets
| Variant | Security | pk | ct |
|---|---|---|---|
| ML-KEM-512 | Level 1 | 800 B | 768 B |
| ML-KEM-768 | Level 3 | 1184 B | 1088 B |
| ML-KEM-1024 | Level 5 | 1568 B | 1568 B |
Key Properties
- IND-CCA2 secure under MLWE assumption
- NTT for efficient polynomial multiplication
- Fujisaki-Okamoto transform for CCA security
- Deterministic using SHAKE-256 PRF
- No passwords — ephemeral or static use
ML-DSA
Module Lattice-based Digital Signature Algorithm (CRYSTALS-Dilithium)
Hard Problem — MSIS
Module Short Integer Solution: find a short non-zero vector z such that Az = 0 (mod q) in a lattice module. Combined with MLWE to construct a signature scheme where forgery requires solving an exponentially hard lattice problem.
Fiat-Shamir with Aborts
The response vector z = y + cs₁ might leak the secret s₁ if its coefficients are too large. ML-DSA uses rejection sampling: if z exceeds bound γ₁ − β, signing aborts and restarts. This ensures z's distribution is independent of the secret key.
Signing Protocol — Step by Step
Signature Size Comparison
Parameter Sets
| Variant | Security | pk | sig |
|---|---|---|---|
| ML-DSA-44 | Level 2 | 1312 B | 2420 B |
| ML-DSA-65 | Level 3 | 1952 B | 3309 B |
| ML-DSA-87 | Level 5 | 2592 B | 4627 B |
Security Properties
- EUF-CMA — existentially unforgeable under chosen message attack
- Deterministic or randomised signing mode
- SHAKE-128/256 for all hashing
- ~4.25 expected aborts per signature (ML-DSA-65)
- Power analysis resistant by design
KERI Key Events with ML-DSA
Every KERI event (icp, rot, ixn, dip) is signed by the controlling AID's current key pair. Replacing the signing key with ML-DSA-65 requires only adding it to the next key commitment in a rot event. All existing ACDC credentials anchored to the AID remain valid — the KEL provides cryptographic continuity across the key rotation.
SLH-DSA
Stateless Hash-Based Digital Signature Algorithm (SPHINCS+)
Why Hash-Based?
SLH-DSA's security rests only on the collision resistance and one-wayness of SHA-256 or SHAKE — properties studied for decades with no known quantum speedup beyond Grover's quadratic reduction. It is the portfolio's conservative "insurance policy": if lattice assumptions fail, SLH-DSA remains secure.
// SHA-256 Avalanche Effect — Try One Character Change
// Merkle Tree — SLH-DSA Root of Trust (Simplified)
Public key = 32-byte top root. Signature proves a leaf is authentic via highlighted auth path.
Signing Components — Step by Step
Variants (SHA-2 family)
| Variant | Sig Size | Speed |
|---|---|---|
| sha2-128s | 7856 B | Slow/Small |
| sha2-128f | 17088 B | Fast/Large |
| sha2-256s | 29792 B | Slow/Small |
| sha2-256f | 49856 B | Fast/Large |
Construction Layers
- WOTS+ — one-time sig at each leaf
- FORS — few-time sig over message digest chunks
- XMSS — eXtended Merkle tree per layer
- HT — Hypertree chains d=8 XMSS layers
- Stateless — no counter state needed
Classical vs Post-Quantum
⚠ Classical — Broken by Quantum
✓ Post-Quantum — NIST Selected
Use Case Decision Matrix
| Use Case | Algorithm | Reason | Level |
|---|---|---|---|
| TLS Key Exchange | ML-KEM-768 | Small keys, fast ops | Level 3 |
| Code Signing | ML-DSA-65 | Balanced size/speed | Level 3 |
| Root CA Certificate | SLH-DSA-256s | Conservative, long-lived | Level 5 |
| IoT / Constrained | ML-KEM-512 | Smallest footprint | Level 1 |
| KERI Event Signing | ML-DSA-65 | rot event, KEL continuity | Level 3 |
| KERI Root AID | SLH-DSA-256s | Max conservatism for root | Level 5 |
| ACDC Credentials | ML-DSA-65 | Issuer sig on credential | Level 3 |
Migration Strategy
- Hybrid mode — classical + PQC during transition
- Harvest now, decrypt later — encrypt today's data
- TLS 1.3 + ML-KEM already in Chrome/Firefox (X25519MLKEM768)
- PKI: leaf certs → intermediates → root
- KERI rot event — migrate AID signing key with no downtime
NIST Security Levels
- Level 1 — AES-128 equivalent (Grover)
- Level 2 — SHA-256 collision equivalent
- Level 3 — AES-192 equivalent
- Level 4 — SHA-384 collision equivalent
- Level 5 — AES-256 equivalent (highest)
selfdriven PQC Readiness — Protocols Area of Focus
Under the selfdriven 8 Areas of Focus, PQC migration falls within 04 · Protocols — identity infrastructure and technical standards. The selfdriven Human Conductor for Protocols leads the migration roadmap: auditing all signing surfaces, scheduling KERI rot events for AID key upgrades, and updating ACDC schema to accept ML-DSA or SLH-DSA proof types. AI agents handle monitoring, reporting on KEL consistency, and flagging credentials signed with deprecated algorithms.