Vord

Architecture Decision Record

0042. Post-quantum cryptographic posture and migration

Context

Post-quantum cryptography is named once in the corpus — the cryptographic-agility bullet of ADR-0027, which commits to "a path to post-quantum algorithms" with the token-format version (ADR-0003) as the deployability lever. That is a commitment and a seam, but no decision owns the posture, and the posture matters because the naive framing — "make everything post-quantum now" — is the wrong one for an identity system. Vord's quantum exposure is specific, and stating it exactly is most of the work.

The primary exposure is signatures, and it is not harvest-now-decrypt-later. Vord's load-bearing cryptography is the token/credential signature (EdDSA/Ed25519, ES256 — ADR-0003). A signature is an authentication primitive: a harvested signed token has no future value, because forging a new one needs the private key. Shor's algorithm recovers that private key from the public key — and the JWKS publishes the public key (ADR-0010, ADR-0023). So the day a cryptographically-relevant quantum computer (a CRQC) exists, an attacker derives every signing key's private half from public material and forges arbitrary tokens for any principal and tenant. Short TTLs, the status list, per-tenant key separation, and revocation (ADR-0005, ADR-0023) do nothing against this: they bound stolen real tokens, not freshly forged ones. The only defense is to migrate the signature suite before a CRQC arrives — a verification-integrity event with a hard deadline, not a confidentiality leak.

Harvest-now-decrypt-later applies only to confidentiality, and only narrowly. The one asset with a "be careful starting now" clock is the directory PII at rest (ADR-0011, ADR-0034): its envelope encryption is symmetric (Grover-only — safe at 256-bit keys), so the residual quantum surface is the asymmetric key-wrapping in custody (a KeyCustody/KMS concern). Internal mTLS key exchange (ADR-0035) is HNDL-relevant for confidentiality but carries short-lived internal traffic and inherits PQC key-establishment from rustls/the platform as it lands. Argon2id (ADR-0015) and WebAuthn authenticator crypto (ADR-0020) are symmetric or delegated and are not Vord's to migrate.

This ADR fixes the posture before the format and the verifier contract harden.

Decision

  1. Crypto-agility is a first-class property of the verification path, beyond the version lever. The migration substrate already exists: per-kid algorithm binding (ADR-0003), the multi-key JWKS (ADR-0023), and a verifier that pins algorithm-and-key and rejects none/unknown (ADR-0010). A post-quantum migration is therefore a new kid carrying a new alg, published-before-signed (ADR-0023) — not a token-format-version bump. The verifier contract treats the accepted-algorithm set as a configured set bound per kid, so adding ML-DSA is a key-lifecycle event, not a format break.

  2. Hybrid (classical + post-quantum) signing during transition — a reserved structural seat. Because stock OIDC libraries do not yet verify post-quantum algs, a flag-day switch would break every relying party. The transition is therefore staged: Vord issues classical signatures to not-yet-PQC-capable relying parties and post-quantum (or composite) signatures to capable ones, negotiated as per-client configuration (ADR-0038), with the JWKS publishing both suites concurrently. The hybrid seat is pinned to the composite-alg shape: a single signature whose algorithm identifier names a classical+PQC composite (the IETF composite-signature direction), preserving JOSE compact serialization — the only OIDC-conformant JWT shape (ADR-0003 decision 6 reserves the seat). Carrying two separate signatures on one token would force JSON serialization or a second artifact — a wire-shape change, hence a format-version bump, which this seat exists to avoid. Reserved now — the same discipline as biscuit attenuation (ADR-0003) and DPoP (ADR-0014) — and built when the ecosystem is ready.

  3. Named algorithm targets, behind the existing seams. The general-purpose signature target is ML-DSA (FIPS 204); SLH-DSA (FIPS 205), hash-based and conservative, is the alternative behind the same KeyCustody/verifier seam; ML-KEM (FIPS 203) is the key-establishment target for the confidentiality/HNDL side. The exact JOSE binding is chosen when the IETF JOSE/COSE post-quantum drafts finalize; until then the choice is named, not pinned, exactly as the standards table treats other in-flight drafts (architecture §11).

  4. The token-size cost is acknowledged and bounded. ML-DSA signatures are kilobytes where Ed25519 is 64 bytes (SLH-DSA larger still). On an edge-verified bearer token carried on every request this is a real cost — it interacts with edge bandwidth, the JWKS/edge cache (ADR-0023), and the input-size limits of resource-exhaustion hardening (proposal 0006). Suite choice and rollout weigh signature size, not only security level.

  5. The confidentiality/HNDL side is scoped, not blanket. Directory PII at rest stays on 256-bit symmetric data keys (Grover-resistant — ADR-0034), and the asymmetric key-wrapping gains a post-quantum-ready path through KeyCustody/KMS (ADR-0003) when ML-KEM custody support exists. This is the only sub-system with a start-now argument, precisely because of harvest-now-decrypt-later; everything else is paced to the CRQC timeline.

  6. Not v1; paced and triggered, not scheduled. The agility seam, the hybrid format seat, and Grover-resistant symmetric keys exist now; the build follows the ecosystem under the cryptographic-agility and standards-drift review (ADR-0027 §4), with explicit triggers: a NIST / CNSA-2.0 migration milestone, finalization of the JOSE/COSE post-quantum bindings, stock relying-party library support, or any credible escalation in CRQC progress. The commitment is recorded now so the migration is scheduled by trigger, not discovered late.

Consequences

  • The project's most catastrophic latent crypto risk — CRQC-day token forgery, made absolute by the public JWKS — is named with its real shape (a forge-all event with a hard deadline, not HNDL) and its one real defense (migrate signatures before a CRQC).
  • Post-quantum migration is a key-lifecycle operation, not a format break: a new kid with a post-quantum alg, published-before-signed, so the agility already built for rotation (ADR-0023) carries it — and the format version (ADR-0003) is held in reserve for changes that genuinely break the wire shape.
  • Hybrid signing reserved now keeps the migration non-breaking for relying parties that lag — the same reserved-seat payoff as biscuit and DPoP, applied to the one transition the whole ecosystem will make at once.
  • The HNDL surface is correctly scoped to PII-at-rest key-wrapping rather than smeared across the system, so effort goes where harvest-now actually buys an adversary something.
  • Refines ADR-0027 (the crypto-agility commitment gains a posture and a plan) and relates to ADR-0003, ADR-0010, ADR-0023, ADR-0034, and ADR-0035.