White paper WP-002
Post-Quantum Attestation in Production with ML-DSA-65
Sign audit roots today so quantum cannot rewrite them tomorrow.
At a glance
- Paper
- WP-002
- Topic
- Post-Quantum Attestation in Production with ML-DSA-65
- Format
- PDF + web summary
- Signatures
- ML-DSA-65 post-quantum (NIST FIPS 204)
- Sandbox
- Reproducible at affix-io.com/sandbox
- Company
- AffixIO, Wales, UK
Post-Quantum Attestation in Production with ML-DSA-65 is an AffixIO technical paper. Sign audit roots today so quantum cannot rewrite them tomorrow.
Store-now-decrypt-later makes classical signatures a liability for records kept ten years. AffixIO signs Merkle roots with ML-DSA-65 inside FIPS 140-2 Level 3 HSMs. This paper is the production guide we wished existed when we migrated.
Summary
Store-now-decrypt-later makes classical signatures a liability for records kept ten years. AffixIO signs Merkle roots with ML-DSA-65 inside FIPS 140-2 Level 3 HSMs. This paper is the production guide we wished existed when we migrated.
Download the full PDF for technical detail, diagrams, and reproduction steps. Public sandbox: affix-io.com/sandbox.
Related reading
Frequently asked questions
Why ML-DSA-65 specifically?
It is NIST's module-lattice standard with conservative parameter sets suited to long-lived governance records.
When does quantum break RSA for archives?
Nobody knows the exact date, but captured signatures are already at risk under harvest-now-decrypt-later.
Where are keys stored?
a certified HSM in eu-west-2 with private keys non-exportable from hardware.