Cryptographic agility and post-quantum status

In plain language: today's bundles are safe against every computer that exists. A future, large quantum computer could forge Ed25519 signatures, so bundles are designed to let us add a new kind of signature without changing the old ones. We have not yet added one.

2. Why this matters for ledger bundles#

Encryption protects data for as long as it is secret. A signature has to stay trustworthy for as long as anyone relies on it, and a ledger bundle can be relied on for many years: in an audit, a contract dispute or a court case long after the event.

Ed25519, like every signature algorithm in wide use today, rests on mathematical problems that a sufficiently large quantum computer could solve with Shor's algorithm. No such computer exists, and published estimates of when one might exist vary widely. If one is ever built, an attacker could compute a private key from its public key and sign bundles with any date in them. The hash functions we use are affected much less: Grover's algorithm weakens SHA-256 only to roughly the strength of a 128-bit search, which is still out of reach.

3. What protects old bundles if Ed25519 falls#

A forger with a quantum computer could produce a new signature, but could not change what already exists outside our systems. Three things limit the damage:

• Copies held by others. A bundle you exported, or handed to an auditor or a court, is a fixed record of what it said on the day it was handed over. A forgery made later does not change that copy.
• Anchors. Where the daily anchor is switched on for your workspace, the Merkle root of a bundle is batched with others and entered in an OpenTimestamps proof that is tied to a Bitcoin block. The anchor does not depend on our signature. It shows that the root existed by the time of the block, whatever happens to Ed25519 later.
• Re-signing before the break. Before Ed25519 becomes unsafe, bundles that still matter can be countersigned with a post-quantum algorithm. A countersignature made while Ed25519 is still sound shows that the original bundle existed and was valid at that time.

The anchor is an optional feature that is not the same as a signature. Whether a given bundle carries one is shown in the bundle itself (the otsProof member).

4. How bundles are built to change algorithms#

Every bundle names the key that signed it, inside the signed bytes, and every published key states its algorithm. A verifier picks the algorithm from the key, not from an assumption. That means:

• a new algorithm can be introduced under new key ids, and bundles signed with older keys keep verifying with the keys they name;
• a new format version can add a second signature for a transition, so verifiers that only know Ed25519 keep working while newer verifiers check both; and
• retiring an algorithm means we stop signing with it, never that we withdraw the public keys older bundles need. See Key management and Record Format Versions and long-term verification.

5. Our intentions on post-quantum signatures#

NIST published ML-DSA, a post-quantum signature standard, as FIPS 204 in August 2024. We have not implemented it. We intend to move in this order, and we will announce each step on this page and in the changelog before it reaches production bundles:

1. publish post-quantum public keys alongside the Ed25519 keys, so verifiers can prepare;
2. add post-quantum verification to the offline verifier and the /verify page;
3. sign new bundles with both Ed25519 and a post-quantum algorithm; and
4. offer post-quantum countersignatures for bundles issued before step 3.

We have not set dates for these steps, and they are intentions, not commitments to a timetable. We will not drop Ed25519 from new bundles while verifiers commonly depend on it. If we first move signing keys into a hardware-backed key service, we will say so in Key management.

6. Changes and contact#

We update this page whenever the status changes. Questions: security@intramedial.com.

EU notices

• Digital Services Act
• EU Data Act
• EU AI Act
• Right of withdrawal

Receipt practices

• Record Practice Statement
• Verifier Terms
• Key management
• Verifying ledger bundles
• Format versions and long-term verification
• Cryptographic agility and post-quantum status
• If Intramedial stops operating

Program terms

• Startup Program Terms
• Nonprofit Program Terms
• Education Program Terms
• Public Sector Program Terms