--- title: Who Goes There? Post-Quantum Authentication – IPsec... description: Post-quantum authentication is the second pillar of quantum-safe networking, and it has a subtler threat model than key exchange. Unlike the 'harvest now,... canonical: https://daily.dev/posts/who-goes-there-post-quantum-authentication-ipsec-series-part-6-iskqiozsb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Who Goes There? Post-Quantum Authentication – IPsec Series, Part 6 | daily.dev og:description: Post-quantum authentication is the second pillar of quantum-safe networking, and it has a subtler threat model than key exchange. Unlike the 'harvest now,... og:url: https://daily.dev/posts/who-goes-there-post-quantum-authentication-ipsec-series-part-6-iskqiozsb og:image: https://api.daily.dev/og/posts/iSkQiOZSB.png og:image:alt: Who Goes There? Post-Quantum Authentication – IPsec Series, Part 6 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Who Goes There? Post-Quantum Authentication – IPsec Series, Part 6 **[Cisco](https://daily.dev/sources/cisco)** · 7 min read · 0 upvotes · 0 comments ## Summary Post-quantum authentication is the second pillar of quantum-safe networking, and it has a subtler threat model than key exchange. Unlike the 'harvest now, decrypt later' risk for encrypted traffic, live signatures only need to resist forgery until verified — so short-lived handshakes aren't immediately at risk. However, long-lived trust anchors like root CA certificates (with 10–25 year lifetimes), code-signing keys, and firmware-signing keys must go quantum-safe well before cryptographically-relevant quantum computers arrive, because PKI migration is slow and painful. The post-quantum signature contenders are ML-DSA (FIPS 204, lattice-based, the recommended general-purpose default with three security levels) and SLH-DSA (FIPS 205, hash-function-only security, enormous signatures but the most conservative assumption). Composite signatures — binding a classical and post-quantum signature together — offer a migration safety net. Part 7 will use OpenSSL 3.5 to generate and compare real post-quantum certificates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between the quantum threat to key exchange vs authentication in IPsec? Key exchange faces 'harvest now, decrypt later' — recorded traffic can be decrypted once a quantum computer exists, making post-quantum KEM urgent immediately. Authentication signatures only need to resist forgery until verified, so a completed handshake can't be retroactively forged. However, long-lived CA root certificates (10–25 year lifetimes) and code-signing keys must go quantum-safe early because PKI migration takes years. _Engineers planning IPsec migrations track the authentication vs key-exchange timeline distinction on daily.dev._ ### What are the trade-offs between ML-DSA and SLH-DSA for post-quantum signatures? ML-DSA (FIPS 204) is the lattice-based general-purpose default — fast signing and verification with manageable key and signature sizes, available in three levels (ML-DSA-44, ML-DSA-65, ML-DSA-87). SLH-DSA (FIPS 205) relies solely on hash functions, making it the most conservative security assumption, but produces enormous signatures and signs slowly. ML-DSA-65 is the practical default; SLH-DSA suits rarely-signed long-lived anchors like root CAs. _Choosing between ML-DSA and SLH-DSA for your PKI? Developers weighing that call follow the standards closely on daily.dev._ ### What are composite signatures in post-quantum PKI and why would I use them? Composite signatures bind a classical signature (e.g., ECDSA) and a post-quantum signature (e.g., ML-DSA) into a single credential; a verifier checks both, and the credential is safe as long as either algorithm holds. They provide a migration safety net if lattice crypto is later broken, and satisfy compliance requirements that still mandate a FIPS-validated classical algorithm. The IETF LAMPS working group is actively standardising composite signatures for X.509. _PKI teams navigating the classical-to-post-quantum transition find composite signature developments on daily.dev._ ## Similar posts on daily.dev - [Post‑Quantum Authentication: How Consumer Apps Can Stay Secure in a Quantum‑Ready World?](https://daily.dev/posts/post-quantum-authentication-how-consumer-apps-can-stay-secure-in-a-quantum-ready-world--xvcpygmkq) · Security Boulevard · 0 upvotes · 0 comments - [Mutual Post-Quantum Auth over IKEv2 – IPsec Series, Part 8](https://daily.dev/posts/mutual-post-quantum-auth-over-ikev2-ipsec-series-part-8-xm1etcoxb) · Cisco · 1 upvotes · 0 comments - [The State of Post-Quantum Cryptography](https://daily.dev/posts/the-state-of-post-quantum-cryptography-hjfyungt7) · Feisty Duck · 0 upvotes · 0 comments - [Post-Quantum Cryptography for Authentication: The Enterprise Migration Guide 2026](https://daily.dev/posts/post-quantum-cryptography-for-authentication-the-enterprise-migration-guide-2026-i5hayeibm) · Security Boulevard · 0 upvotes · 0 comments - [Why we cannot wait for better post-quantum signature algorithms](https://daily.dev/posts/why-we-cannot-wait-for-better-post-quantum-signature-algorithms-3zasaxenh) · Cloudflare · 1 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#pki](https://daily.dev/tags/pki) [View this post on daily.dev](https://daily.dev/posts/who-goes-there-post-quantum-authentication-ipsec-series-part-6-iskqiozsb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Who Goes There? Post-Quantum Authentication – IPsec Series, Part 6","url":"https://daily.dev/posts/who-goes-there-post-quantum-authentication-ipsec-series-part-6-iskqiozsb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/who-goes-there-post-quantum-authentication-ipsec-series-part-6-iskqiozsb"},"datePublished":"2026-08-10T14:05:04.824Z","dateModified":"2026-08-10T14:05:43.455Z","description":"Post-quantum authentication is the second pillar of quantum-safe networking, and it has a subtler threat model than key exchange. Unlike the 'harvest now,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3eaf51e7e49e160af96fee3e143bd13b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3eaf51e7e49e160af96fee3e143bd13b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cisco","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cisco","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/68b8a8be17184235a5067d7c84162f77","url":"https://daily.dev/sources/cisco"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/who-goes-there-post-quantum-authentication-ipsec-series-part-6-iskqiozsb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,pki","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cisco","item":"https://daily.dev/sources/cisco"},{"@type":"ListItem","position":3,"name":"Who Goes There? Post-Quantum Authentication – IPsec Series, Part 6"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/who-goes-there-post-quantum-authentication-ipsec-series-part-6-iskqiozsb#faq","mainEntity":[{"@type":"Question","name":"What is the difference between the quantum threat to key exchange vs authentication in IPsec?","acceptedAnswer":{"@type":"Answer","text":"Key exchange faces 'harvest now, decrypt later' — recorded traffic can be decrypted once a quantum computer exists, making post-quantum KEM urgent immediately. Authentication signatures only need to resist forgery until verified, so a completed handshake can't be retroactively forged. However, long-lived CA root certificates (10–25 year lifetimes) and code-signing keys must go quantum-safe early because PKI migration takes years. Engineers planning IPsec migrations track the authentication vs key-exchange timeline distinction on daily.dev."}},{"@type":"Question","name":"What are the trade-offs between ML-DSA and SLH-DSA for post-quantum signatures?","acceptedAnswer":{"@type":"Answer","text":"ML-DSA (FIPS 204) is the lattice-based general-purpose default — fast signing and verification with manageable key and signature sizes, available in three levels (ML-DSA-44, ML-DSA-65, ML-DSA-87). SLH-DSA (FIPS 205) relies solely on hash functions, making it the most conservative security assumption, but produces enormous signatures and signs slowly. ML-DSA-65 is the practical default; SLH-DSA suits rarely-signed long-lived anchors like root CAs. Choosing between ML-DSA and SLH-DSA for your PKI? Developers weighing that call follow the standards closely on daily.dev."}},{"@type":"Question","name":"What are composite signatures in post-quantum PKI and why would I use them?","acceptedAnswer":{"@type":"Answer","text":"Composite signatures bind a classical signature (e.g., ECDSA) and a post-quantum signature (e.g., ML-DSA) into a single credential; a verifier checks both, and the credential is safe as long as either algorithm holds. They provide a migration safety net if lattice crypto is later broken, and satisfy compliance requirements that still mandate a FIPS-validated classical algorithm. The IETF LAMPS working group is actively standardising composite signatures for X.509. PKI teams navigating the classical-to-post-quantum transition find composite signature developments on daily.dev."}}]} ```