Cryptography

Post-quantum migration.

Tenzro is on a flag-day cutover to hybrid post-quantum cryptography. Signatures combine Ed25519 with ML-DSA-65; key exchange combines X25519 with ML-KEM-768. Both halves must validate for the composite to be accepted.

STATUS: Shipped (flag-day complete)
SIGNATURES: Ed25519 + ML-DSA-65
KEM: X25519 + ML-KEM-768
MODE: Flag-day cutover (no v1/v2)

Why hybrid

The hybrid construction is conservative against two failure modes: a classical break of Ed25519/X25519 (we still hold ML-DSA-65/ML-KEM-768), and a future cryptanalytic break of the lattice schemes (we still hold the classical primitives). Both halves of a hybrid signature must verify; both halves of a hybrid KEM must agree on the shared secret. This is the NIST “PQ + classical” recommendation for transition deployments.

Wire format — public keys

Public-key bytes dispatch on a leading tag byte:

0x00 — classical Ed25519
0x01 — classical Secp256k1
0x02 — hybrid composite

Hybrid layout:

[
  0x02,
  classical_tag (1 byte),
  classical_len (u16 LE),
  classical_bytes,
  ml_dsa_65_vk (1952 bytes)
]

Wire format — signatures

Classical signatures remain raw 64-byte blobs (Ed25519) or DER (Secp256k1). Hybrid signatures follow the public-key pattern:

[
  0x02,
  classical_sig_len (u16 LE),
  classical_sig,
  ml_dsa_65_sig (3309 bytes)
]

verify_tee_zk_signature auto-dispatches by tag and requires both legs of a hybrid signature to validate.

Hybrid TLS / Caddy

The Caddy reverse proxy fronting *.tenzro.network is already negotiating hybrid post-quantum TLS handshakes for clients that support them, falling back to classical X25519 for older clients. No changes are needed by callers — the upgrade is transparent at the TLS layer.

TEE-ZK hybrid co-signing

The ZK proving system (Plonky3 STARKs over KoalaBear) is post-quantum sound (transparent setup, hash-based commitments). On top of that, sign_tee_zk_proof_hybrid co-signs the proof commitment inside the enclave with both an Ed25519 (or Secp256k1) classical leg and an ML-DSA-65 PQ leg. The signing-pubkey wire format dispatches on a leading tag byte (0x00/0x01 classical, 0x02 hybrid), and verify_tee_zk_signature requires both legs of a hybrid signature to validate.

No compatibility shims

We are pre-alpha. The cutover is a flag day — there is no v1 / v2negotiation, no “legacy classical-only” mode beyond the dispatch tag, no deprecation path. Old keys are rebound at upgrade time by the holder.

← All docs