Signatures Built to Last

When people talk about the quantum computer, they mostly mean confidentiality. Authenticity is threatened the same way. An RSA or ECDSA signature can be forged the day those algorithms fall, and with it any signed document believed to be tamper-proof. A contract, minutes, an evidential archive or a software update must remain verifiable long after it was signed.

Why SLH-DSA

Feranor PQC Suite signs with SLH-DSA by default, standardized by NIST in 2024 (FIPS 205). Its security rests on hash functions only, the most conservative assumption cryptography has. That is also why the cryptographic mechanisms guide of ANSSI, the French national cybersecurity agency, admits it on its own, with no mandatory hybridization.

The suite still adds an ECDSA P-384 co-signature by default. Both signers sit in the same CMS message, each with its certificate, and verification follows three rules.

• Both or nothing. A hybrid signature is valid only if both signatures are, certification chains included.
• Never classical alone. A message whose signers are all classical is refused, whatever the profile.
• One identity. The co-signer's certificate must name the same subject as the post-quantum signer, so a third party cannot graft its own classical signature on.

Signing a file, verifying it

A detached signature leaves the document untouched and writes a .p7s file next to it. The command line reads the file once, whatever its size, and the signature weighs about 50 KB, plus the certificates.

fpqc sign contract.pdf --detached
fpqc verify contract.pdf.p7s --content contract.pdf --trust alice-signer.pem --require-hybrid

These signatures are standard CMS. OpenSSL 3.5 verifies them, attached and detached, which our interoperability tests check with every version.

What it costs

SLH-DSA is slow to sign by design, the price of its robustness. On a recent workstation (Intel Core Ultra 9, Linux, OpenSSL 3.5), an SLH-DSA-SHA2-256f signature takes 43 ms, 45 ms with the co-signature through the key store, and 11 ms per signature when four threads sign in parallel. On a shared virtual machine with 2 vCPUs, count 163 ms. Verification takes 1.4 ms on the recent workstation.

For contracts, archives or software releases, that is negligible. For very high signature volumes, composite ML-DSA, much faster, will join the ANSSI profile as soon as .NET supports it in CMS.

A signature must stay verifiable for as long as the document it protects. The algorithm is chosen for that lifetime, not for today.

We apply the principle to ourselves. Every version of the suite ships with checksums signed in SLH-DSA-SHA2-256s by Feranor's release certificate, whose fingerprint is published on this site.