Loading...
Loading...
DRD implements hybrid Ed25519 + ML-DSA-65 (Dilithium) signatures to protect agent credentials and trust attestations against both classical and quantum adversaries. Migrate your agents to quantum-resistant cryptography today.
Quantum computers threaten all widely-deployed digital signature schemes (RSA, ECDSA, Ed25519). DRD adopts a hybrid approach: every signature includes both a classical Ed25519 component and a post-quantum ML-DSA-65 component. This ensures security today while providing protection against future quantum attacks, following NIST FIPS 204 (ML-DSA) standardized in 2024.
Why Hybrid?
Pure post-quantum schemes are newer and may contain undiscovered vulnerabilities. The hybrid approach ensures that even if ML-DSA-65 is broken, Ed25519 still provides classical security — and vice versa for quantum attacks.
DRD hybrid signatures concatenate an Ed25519 signature with an ML-DSA-65 signature over the same message. Verification requires both components to be valid. This follows the IETF draft for composite signatures.
| Scheme | Key Size | Sig Size | Quantum Safe | Speed |
|---|---|---|---|---|
| Ed25519 (Classical) | 32 bytes | 64 bytes | No | ~60,000 ops/sec |
| ML-DSA-65 (Dilithium) | 1,952 bytes | 3,293 bytes | Yes | ~8,000 ops/sec |
| DRD Hybrid | 1,984 bytes | 3,357 bytes | Yes | ~7,500 ops/sec |
Generate hybrid key pairs for agents. The SDK handles both classical and post-quantum key generation in a single call.
import { DRD } from '@drd/sdk';
const drd = new DRD({ apiKey: process.env.DRD_API_KEY });
// Generate a hybrid key pair for an agent
const keyPair = await drd.pqc.generateKeyPair({
agentId: 'agent_abc123',
algorithm: 'hybrid-ed25519-mldsa65',
metadata: {
purpose: 'credential_signing',
rotationPolicy: '90d',
},
});
console.log(keyPair.publicKey); // Base64-encoded hybrid public key (1,984 bytes)
console.log(keyPair.keyId); // 'key_pq_7f8a9b...'
console.log(keyPair.algorithm); // 'hybrid-ed25519-mldsa65'
console.log(keyPair.components); // { ed25519: '...', mlDsa65: '...' }
console.log(keyPair.createdAt); // '2026-02-12T10:00:00Z'
console.log(keyPair.rotateBy); // '2026-05-13T10:00:00Z'
// The private key is stored in your configured KMS (AWS KMS, Vault, etc.)
// It is never returned in API responsesSign messages and credentials with hybrid signatures. Verification checks both the Ed25519 and ML-DSA-65 components.
// Sign a credential with hybrid signature
const signed = await drd.pqc.sign({
keyId: 'key_pq_7f8a9b',
payload: {
type: 'VerifiableCredential',
issuer: 'did:drd:org_acme',
subject: 'did:drd:agent_abc123',
claims: {
complianceStatus: 'certified',
frameworks: ['gdpr', 'eu_ai_act'],
},
},
});
console.log(signed.signature); // Base64 hybrid signature (3,357 bytes)
console.log(signed.signatureFormat); // 'ed25519(64) || mldsa65(3293)'
console.log(signed.signedAt); // '2026-02-12T10:00:00Z'
// Verify the hybrid signature
const verification = await drd.pqc.verify({
signature: signed.signature,
payload: signed.payload,
publicKey: keyPair.publicKey,
});
console.log(verification.valid); // true
console.log(verification.classicalValid); // true (Ed25519 check)
console.log(verification.postQuantumValid); // true (ML-DSA-65 check)
console.log(verification.verificationTime); // '0.8ms'// Verify individual signature components separately
const componentCheck = await drd.pqc.verifyComponents({
signature: signed.signature,
payload: signed.payload,
publicKey: keyPair.publicKey,
});
// Useful for debugging or gradual migration
console.log(componentCheck.ed25519); // { valid: true, time: '0.1ms' }
console.log(componentCheck.mlDsa65); // { valid: true, time: '0.7ms' }DRD follows a phased migration strategy to ensure backward compatibility while progressively strengthening cryptographic guarantees.
New credentials are issued with both Ed25519 and ML-DSA-65 signatures. Existing credentials remain valid.
Verifiers accept both classical and hybrid signatures. Hybrid-signed credentials receive higher trust scores.
New agent registrations default to hybrid keys. Classical-only credentials trigger migration warnings.
All credentials must use hybrid or PQ-only signatures. Classical-only signatures are rejected.
// Migrate an existing agent to hybrid keys
const migration = await drd.pqc.migrateAgent({
agentId: 'agent_abc123',
fromAlgorithm: 'ed25519',
toAlgorithm: 'hybrid-ed25519-mldsa65',
options: {
revokeOldKey: false, // Keep old key valid during transition
transitionPeriod: '30d', // Accept both old and new signatures
reissueCredentials: true, // Re-sign existing credentials with hybrid key
},
});
console.log(migration.status); // 'in_progress'
console.log(migration.newKeyId); // 'key_pq_9c0d1e...'
console.log(migration.credentialsToResign); // 12
console.log(migration.estimatedCompletion); // '2026-03-14T10:00:00Z'