EngineeringID Staff
Updated August 12, 2026
Post-Quantum Cryptography: Hybrid Signatures Explained
Quantum computers will break RSA and ECDSA. Hybrid signatures — combining a classical algorithm with a post-quantum scheme like Dilithium — let you prepare now without abandoning today's infrastructure.
Substantially reviewed and expanded by the EngineeringID editorial team on August 12, 2026. Verify jurisdiction-specific requirements with the controlling authority.
Sufficiently large quantum computers running Shor's algorithm will be able to break RSA and elliptic-curve cryptography. Current estimates place cryptographically-relevant quantum computers 10–15 years away, but the threat of "harvest now, decrypt later" attacks — where adversaries store encrypted data today to decrypt it once quantum capability exists — means organizations that handle long-lived sensitive data need to act before quantum computers arrive.
2026 review: standards exist; migration engineering comes next
NIST's finalized FIPS 204 standard for ML-DSA, alongside FIPS 203 and 205, establishes ML-KEM, ML-DSA, and SLH-DSA. The 2026 transition work is about inventory, protocol integration, certificate and hardware support, larger keys and signatures, algorithm agility, and interoperability—not inventing a private post-quantum scheme.
Start by cataloging where RSA and elliptic-curve algorithms protect long-lived records. Define how a hybrid result will be encoded and what a verifier must require: both signatures, either signature during a compatibility window, or a policy selected by credential type. Review how today's digital signatures work and the platform's current security model, then test failure behavior before changing production trust decisions.
- Prioritize data that must remain trustworthy beyond the migration horizon.
- Benchmark storage, bandwidth, signing, and validation with real payloads.
- Version manifests so future verifiers know exactly what policy applied.
What NIST Standardized
In August 2024, NIST finalized three post-quantum cryptography standards: ML-KEM (CRYSTALS-Kyber) for key encapsulation, ML-DSA (CRYSTALS-Dilithium) for digital signatures, and SLH-DSA (SPHINCS+) as a stateless hash-based signature backup. These algorithms are believed to be resistant to both classical and quantum attacks.
Dilithium, now ML-DSA, is the relevant standard for document signing — the use case at the core of EngineeringID's credential issuance pipeline.
Why Hybrid Signatures Are the Right Transition Strategy
Migrating directly from RSA to Dilithium introduces risk: if a classical vulnerability is found in Dilithium (post-quantum algorithms are newer and less battle-tested), you lose both historical and future signature security. Hybrid signatures — a signature that is valid only if both a classical component (RSA or ECDSA) and a post-quantum component (Dilithium) verify — provide defense in depth. An attacker needs to break both simultaneously.
This is the transition strategy EngineeringID is planning for credential manifest signing. Hybrid signatures are not yet in production: credentials issued today are signed with classical RSA only. The post-quantum primitives are integrated into our cryptography library and undergoing testing, but no production code path emits hybrid signatures yet. We will publish a migration plan before flipping any signing path to hybrid.
Signature Size and Performance
The main practical cost of ML-DSA is signature size. An RSA-4096 signature is 512 bytes. An ML-DSA signature is several kilobytes — roughly an order of magnitude larger. For credential manifests that are verified infrequently, this is not a meaningful constraint. For high-frequency verification flows (e.g., PDF signature validation at document ingestion), the size increase may require pipeline tuning.
Verification performance is better than the size increase suggests: ML-DSA verification is computationally faster than RSA verification at equivalent security levels. Signing is slower, but signing happens once at issuance; verification happens at every trust check.
What This Means for EngineeringID Credentials Today
Credentials issued today carry a classical RSA signature only. Hybrid (RSA + Dilithium) signing is on the roadmap; when it ships, the transition will be additive — historical credentials will remain verifiable under the classical component indefinitely, and new credentials will carry both components so verifiers can opt in to post-quantum verification as the ecosystem migrates.