RFC 10073: the IETF standardizes hybrid post-quantum signatures
· BehindLines newsroom
The IETF has published RFC 10073, a Proposed Standard that describes how to combine a post-quantum signature with a classical one inside X.509 certificates. According to the RFC Editor's page and the Datatracker entry, the text comes from the LAMPS working group, formerly the draft draft-ietf-lamps-pq-composite-sigs. Its authors are S. Fluhrer (Cisco), J. Klaußner (Bundesdruckerei), M. Pala (OpenCA Labs), and M. Ounsworth and J. Gray (Entrust). The entry gives November 2026 as the date, last updated on 6 November.
The principle: two signatures are safer than one
The document pairs the post-quantum algorithm ML-DSA with one traditional algorithm: Ed25519, Ed448, ECDSA, RSASSA-PSS or RSASSA-PKCS1-v1_5. The Datatracker says these combinations are meant, among other things, to meet certain regional regulatory requirements. The aim is to protect applications against a break or serious flaw in ML-DSA while staying usable in the existing certificate infrastructure.
What the standard fixes in practice
The RFC Editor page says eighteen algorithm identifiers are registered, covering ML-DSA-44, ML-DSA-65 and ML-DSA-87 paired with various classical variants. Composite keys go directly into the usual certificate fields. When the key-usage extension is present, it must include at least one signing or certification function and must not contain any encryption or key-agreement bit, so a composite key cannot serve two purposes at once. The component keys may not be recycled as a stand-alone key or placed in another composite key, and certificate authorities are urged to check each component too when they verify revocation.
An acknowledged limit
The text states that the construction provides EUF-CMA security but not SUF-CMA, and that it is not suited to uses where EUF-CMA is considered insufficient. It therefore advises against using it in applications where SUF-CMA is critical.
A transition backdrop
The publication comes in the same week that CISA, the NSA and the Australian Signals Directorate's cyber security centre released, on 5 November, a guide titled "Post-Quantum Questions to Ask Your Vendors." According to CISA, it offers vendor-neutral questions for judging whether a supplier understands quantum risks, stays transparent about its cryptographic implementations and can support a timely transition. RFC 10073 is one technical piece of that migration, without setting its timetable.