Skip to content
Tech

Why can I not migrate a credential I issued last year to quantum-safe signatures?

78

Oportunidade

NIST finalized ML-DSA and ML-KEM in 2024, giving new systems a clear cryptographic target, but every verifiable credential already in circulation is signed with ECDSA or EdDSA. There is no technical path to upgrade an issued credential to a new signature scheme without revoking and reissuing it, which requires simultaneously coordinating every issuer and every holder. Long-lived credentials in government, healthcare, and education are precisely the documents an adversary archives today to decrypt when quantum capability matures. On top of the key-migration problem, ML-DSA signatures are roughly five times larger than Ed25519, which breaks the compact presentation formats that selective-disclosure implementations currently depend on. The cryptography has a standardized roadmap; the credential lifecycle does not.

Por que importa

Without a migration path for already-issued credentials, the post-quantum transition will force simultaneous mass-reissuance crises at governments and health systems worldwide.

Como avalio a oportunidade

A Pontuação de Oportunidade é minha própria leitura, não uma medição: o quanto dói, com que frequência aparece e o quanto pouco existe para resolvê-lo hoje. Quanto maior, mais vale a pena construir, na minha opinião.

Gravidade8/10

O quanto de dor causa quando aparece.

Frequência6/10

Com que frequência as pessoas realmente se deparam com isso.

Lacuna8/10

O quanto pouco de boas ferramentas existe para isso hoje.

Mais problemas que merecem ser resolvidos