Quantum Proofing Sigstore: A Tale of Three Approaches
summary
Three concrete prototypes add post‑quantum cryptography into Sigstore and cosign and each has clear tradeoffs. hybrid log dual‑signing records every entry and checkpoint with classical and PQ signatures producing bundles that grow from ~6.5 KB to ~13 KB and require verifier upgrades. hybrid X.509 embeds PQ public key and CA signature into certificates making each cert ~8 KB and costly at scale but verifiable offline. merkle‑tree batching moves batching into Fulcio and Rekor to shrink Rekor traffic at the cost of breaking compatibility and adding latency; demos and code live on GitHub and verification works but exposes size and codebase assumptions.
AI-written summary · about
chapters (12)
- 0:00Quantum proofing Sigstore
- 1:03Postquantum cryptography matters
- 3:06TLOG Hybrid Mode approach
- 7:04TLOG Hybrid demo & limits
- 8:54Hybrid X.509 Certificate approach
- 12:07Hybrid Certificates demo & challenges
- 13:52Merkle Tree Chaining approach
- 17:26Merkle Tree Chaining demo
- 19:35Comparing postquantum approaches
- 20:36Lessons learned
- 22:03Next steps & community
- 26:31Q&A
related talks
55mMaking PQ Signatures work in the WebPKI
29mWhy the Internet isn’t ready for Post-Quantum Certificates
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
13mNavigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools
27mPost-Quantum Cryptography
34mBeyond Classical Cryptography: Building Quantum-Resistant Cloud Native Infrastructure With SPIFFE
23mFireside Chat with Charles on Post Quantum World
15mDemystifying Digital Signatures