Post-quantum S/MIME email signing

Short answer: Post-quantum S/MIME signing uses the ML-DSA algorithm, with conventions for the Cryptographic Message Syntax (CMS) in RFC 9882 and for X.509 certificates in RFC 9881. A 2026 paper warns that encoding standards alone do not guarantee that an encrypted message is protected against quantum attack, because classical key paths can remain valid. This is specification-level work, and none of the documents reports email deployments.

How ML-DSA Integrates with CMS

The Cryptographic Message Syntax (CMS) serves as the container format for S/MIME, meaning the migration to post-quantum security is fundamentally a CMS migration. RFC 9882 specifies the conventions for using the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) within CMS. RFC 9882 describes ML-DSA, defined in FIPS 204, as a post-quantum digital signature scheme that aims to be secure against an adversary with a cryptographically relevant quantum computer (CRQC).

The integration requires specific algorithm identifiers. ASN.1 data structure types use the AlgorithmIdentifier type to identify cryptographic algorithms. In the context of CMS, these identifiers are used to identify ML-DSA signatures within the signed-data content type. The same identifiers are utilized to identify ML-DSA public keys and signature algorithms. This structural alignment ensures that the signature mechanism is correctly recognized by compliant implementations.

The Role of X.509 Certificates

A digital signature is only usable if the certificate carrying the signer’s public key supports the corresponding algorithm. Therefore, the migration involves two simultaneous standards: the CMS conventions and the X.509 certificate conventions. RFC 9881 describes the use of ML-DSA in X.509 certificates, providing the necessary algorithm identifier syntax.

These certificates are used to verify the ML-DSA signatures generated in the CMS. The AlgorithmIdentifier type appears in X.509 certificates to identify the ML-DSA public keys. This linkage is critical because the verification process depends on the certificate correctly declaring the post-quantum algorithm.

Security Levels and Performance

RFC 9882 specifies the use of ML-DSA in CMS at three distinct security levels: ML-DSA-44, ML-DSA-65, and ML-DSA-87.

RFC 9882 says ML-DSA offers smaller signatures and significantly faster runtimes than SLH-DSA, an alternative post-quantum signature algorithm (FIPS 205). The RFC lets implementations pick among the three levels within CMS.

Distinction Between Signing and Encryption

While ML-DSA addresses the signing aspect of S/MIME, the encryption aspect involves different mechanisms. Post-quantum confidentiality in S/MIME is carried through the KEMRecipientInfo structure, which allows key-encapsulation mechanisms to wrap the content-encryption key. This structure was added to CMS by RFC 9629.

The 2026 paper notes that post-quantum capability in certificates does not automatically ensure message-level security. A mailbox may possess a post-quantum-capable certificate while a generated CMS EnvelopedData object still protects the content-encryption key through classical mechanisms like RSA or elliptic-curve key management. The 2026 paper's framing is that post-quantum confidentiality is a property of the whole message: every valid path to the content-encryption key has to meet the migration policy, and one post-quantum path is not enough if a classical path can recover the same key. It adds that archived mail may remain protected only by quantum-vulnerable mechanisms.

FAQ

Does RFC 9882 mandate ML-DSA for all email?

No. RFC 9882 specifies conventions for using ML-DSA in CMS. It is a specification, not a requirement on existing email.

Can ML-DSA signatures be verified without X.509 support?

The verifier needs the signer's certificate. RFC 9881 describes the use of ML-DSA in X.509 certificates, including the algorithm identifier syntax, so a certificate must identify the ML-DSA public key for the signature to be checked against the signer.

Is ML-DSA faster than other post-quantum signatures?

RFC 9882 says ML-DSA offers smaller signatures and significantly faster runtimes than SLH-DSA, another post-quantum signature algorithm. That comparison is with SLH-DSA only.

Does having a PQC certificate guarantee secure email?

No. A mailbox may possess a post-quantum-capable certificate while the actual encrypted message still uses classical key management for the content-encryption key. Post-quantum confidentiality requires that every valid path to the key satisfies the migration policy. One post-quantum path is not enough if a classical path remains valid.

What is the role of the LAMPS working group?

A field guide on post-quantum S/MIME names the IETF LAMPS working group as the venue where the migration of S/MIME and CMS is specified, with ML-DSA for signatures and ML-KEM for confidentiality.