The Quantum Deadline: Why We Can't Wait for Perfect Algorithms
The cryptographic world is in a race against quantum computers. RSA and ECC, the workhorses of internet security, are vulnerable to sufficiently advanced quantum attacks. While those machines don't exist yet, the threat of 'harvest-now-decrypt-later' makes migration urgent. Cloudflare reports that a majority of their traffic already uses ML-KEM encryption, but signatures are the next frontier. The challenge? The 'all-star' post-quantum signature doesn't exist yet. As Eric Rescorla famously said, "You go to war with the algorithms you have, not the ones you wish you had." This is the core of Cloudflare's strategy: deploy ML-DSA now, even if it's not perfect, because waiting for the ideal scheme is a risk we can't take.
This analysis is based on Cloudflare's recent blog post on the subject, which provides a comprehensive look at the current state of post-quantum signatures. The original article is a critical read for any security engineer planning their migration strategy.
The Current Landscape: No 'All-Star' Algorithm
The table below compares standardized and candidate post-quantum signature schemes against classical ones, highlighting the trade-offs:
| Family | Algorithm | Public Key (bytes) | Signature (bytes) | Signing Time (relative) | Verification Time (relative) |
|---|---|---|---|---|---|
| Elliptic Curves | Ed25519 (Vulnerable) | 32 | 64 | 0.15 | 1.3 |
| Factoring | RSA 2048 (Vulnerable) | 272 | 256 | 80 | 0.4 |
| Lattices | ML-DSA 44 (Standardized) | 1,312 | 2,420 | 1 (baseline) | 1 (baseline) |
| Hash-based | SLH-DSA 128s (Standardized) | 32 | 7,856 | 14,000 | 40 |
| Lattices | FN-DSA 512 (Draft) | 897 | 666 | 3 ⚠️ | 0.7 |
| Isogeny | SQIsign I (Candidate) | 65 | 148 | 300 ⚠️ | 50 |
| Multivariate | MAYO one (Candidate) | 1,420 | 454 | 2.1 | 0.4 |
Key Takeaways:
- Specialists: Algorithms like SQIsign and MAYO excel in specific metrics (e.g., signature size) but have significant drawbacks (e.g., slow signing, large public keys).
- Generalists: ML-DSA is the balanced but bulky option. It's not the best in any category but is secure and implementable today.
- The Verification Time Trap: While ML-DSA is slower to verify than Ed25519, it's still fast enough for most applications. The real pain point is the larger signature size, which impacts bandwidth and storage.
The Hidden Costs and Future of Post-Quantum Signatures
The FN-DSA Dilemma
FN-DSA (Falcon) looks great on paper with small signatures, but it's a nightmare to implement securely. The use of floating-point arithmetic introduces side-channel risks and makes test vectors unreliable. This complexity means it won't be widely available until at least 2033, making it a poor choice for the immediate migration.
The Promise of MAYO and SNOVA
These structured multivariate schemes offer the best performance, but their security is still under scrutiny. MAYO has a conservative design, while SNOVA has been repeatedly tweaked after attacks. NIST expects another round of evaluation, pushing standardization to 2031 or later.
Why We Still Need These Algorithms
Even if we migrate to ML-DSA now, the new schemes are crucial for:
- Reducing Bandwidth: Smaller signatures are critical for constrained environments like IoT and DNSSEC.
- Enabling Advanced Primitives: Schemes like FAEST can be repurposed for anonymous credentials and other privacy-preserving technologies.
The Pragmatic Path Forward
Cloudflare's strategy is clear: Deploy ML-DSA now, plan for upgrades later. The transition period will be complex, and we need to start today to meet the 2030-2035 regulatory deadlines. Waiting for a 'perfect' algorithm is a luxury we can't afford.
Conclusion: Start Your Migration Today
The post-quantum transition is a marathon, not a sprint. The first step is to integrate ML-DSA into your TLS stacks and certificate management, even if it means accepting larger signatures. The future algorithms will come, but they won't save you from the quantum threat that's already on the horizon. For a deeper look at how large-scale systems handle data and AI at scale, you might find our analysis of how Spotify scales data insights with a context layer for their AI assistant and how Netflix routes over a million ML inference requests per second relevant to your own infrastructure planning.