Composite signatures for post-quantum certificates

Short answer: A composite signature combines a post-quantum signature algorithm with a traditional one into a single signature algorithm with one public key and one signature value. An IETF Internet-Draft, draft-ietf-lamps-pq-composite-sigs (version 19 when we read it), defines such combinations of ML-DSA with RSA, ECDSA, Ed25519 and Ed448 for X.509 certificates. It is a draft in progress, not a standard, and it can change.

What "composite" means in the draft

The draft defines a specific instance of what it calls the PQ/T Hybrid paradigm, called "composite", in which multiple cryptographic algorithms are combined to form a single signature algorithm. According to the draft, the composite algorithm presents a single public key and signature value, so it can be treated as a single atomic algorithm at the protocol level. In other words, software that handles certificates sees one algorithm, not two separate signatures to juggle.

Which algorithms it combines

The draft's abstract says it defines combinations of the NIST Module-Lattice-Based Digital Signature Algorithm (ML-DSA) in hybrid with traditional algorithms: RSASSA-PKCS1-v1.5, RSASSA-PSS, ECDSA, Ed25519 and Ed448. ML-DSA is the lattice-based signature scheme standardised in FIPS 204. The abstract also says the combinations are tailored to meet regulatory guidelines in certain regions.

Where it is meant to apply

The abstract says Composite ML-DSA is applicable to applications that use X.509 or PKIX data structures that accept ML-DSA, where the operator wants extra protection against breaks or catastrophic bugs in ML-DSA, and where existential unforgeability (EUF-CMA) level security is acceptable. The draft has a section on use within X.509 and PKIX. In plain terms, the idea is to keep a traditional signature alongside the new one, so that a flaw in one algorithm does not on its own break the combined signature. That plain-terms reading is ours, not wording from the draft.

Status

The page we read identifies the document as an Internet-Draft, draft-ietf-lamps-pq-composite-sigs-19, from the IETF LAMPS working group. An Internet-Draft is a work in progress. It is not a standard, it is not final, and later versions may differ. The GitHub repository linked from the draft carries the working text.

Why a hybrid at all

The draft's own framing is that an operator may want extra protection against breaks or catastrophic bugs in ML-DSA. ML-DSA is a new standard compared with RSA and ECDSA, which have been used for much longer. Pairing the two means a forger would need to defeat both parts. How well that works in practice depends on the exact construction, which is why the draft specifies it in detail and why it is still being reviewed.

What this does not tell you

This article summarises the draft's abstract and introduction. It does not describe any deployment, product or certificate authority, and it does not say whether or when the draft will become a standard. Anyone planning to use it should read the current version of the draft.

FAQ

What is a composite signature?

A single signature algorithm built from several algorithms, presenting one public key and one signature value.

Which algorithms does the draft combine?

ML-DSA with RSASSA-PKCS1-v1.5, RSASSA-PSS, ECDSA, Ed25519 and Ed448.

What is it for?

Applications using X.509 or PKIX data structures that accept ML-DSA, where the operator wants extra protection against breaks or catastrophic bugs in ML-DSA.

Is it a standard?

No. It is an IETF Internet-Draft in progress, and it may change.

Is it in use?

This article makes no claim about use. The draft is a specification, not a deployment report.