| Internet-Draft | PQ-Agentic Delegation & Trace Receipts | October 2026 |
| Durga | Expires 4 May 2027 | [Page] |
Autonomous AI agent ecosystems rely on multi-hop cryptographic delegation chains and signed execution traces (currently built on Ed25519, ECDSA P-256, and RSA-PSS) to enforce least-privilege tool invocations across Model Context Protocol (MCP) and Agent-to-Agent (A2A) boundaries, and to preserve long-term non-repudiation for regulatory audit logs. This architecture faces two existential vulnerabilities in the Post-Quantum era: (1) "Harvest-Now, Forge-and-Repudiate-Later" (HNFRL) attacks, wherein Cryptographically Relevant Quantum Computers (CRQCs) running Shor's algorithm retroactively forge or repudiate multi-year compliance traces (e.g., 7-to-10-year HIPAA, SOX, FDA 21 CFR Part 11, and defense operational logs) and synthesize retroactive human-in-the-loop approvals; and (2) "Lattice Signature-Bloat Amplification," wherein naively substituting 64-byte Ed25519 signatures with 3,309-byte ML-DSA-65 (FIPS 204) signatures across a 10-hop sub-agent chain inflates per-call authorization headers from 640 bytes to over 46 KB (including public keys), exceeding HTTP/2 header limits and degrading sub-10ms real-time tool routing.¶
This document specifies a wire-compatible Post-Quantum Agentic Delegation and Trace Receipt profile ("PQ-Agentic"). It introduces a two-tier cryptographic architecture: (a) a Hot-Path Hybrid Delegation Envelope combining classical Ed25519 with ML-DSA-65 (FIPS 204) via Pre-Verified Session-Grant Digest Chaining (PVSGDC), replacing redundant per-call inline re-transmission of O(N) prior delegators' 5,261-byte ML-DSA-65 public keys and signatures with 32-byte SHAKE256 digests of out-of-band PEP-verified delegation grants; and (b) a Cold-Path Long-Horizon Archival Receipt anchored with stateless hash-based SLH-DSA-SHAKE-128f (FIPS 205) over RFC 9943 SCITT transparency Merkle roots, guaranteeing 30-year quantum-resistant non-repudiation even under catastrophic lattice cryptanalysis.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 4 May 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶
As autonomous AI agents transition into regulated enterprise, healthcare, financial, and critical-infrastructure operations, security standards—including IETF WIMSE workload credentials, IETF SCITT transparency receipts, and emerging agentic execution-trace verification specifications ([I-D.durga-agenttrust-trace-verification] and [I-D.durga-wimse-ctx-isolation])—rely on asymmetric digital signatures to bind human intent, scope attenuation, and tool-invocation receipts.¶
Today, virtually 100% of production agentic identity tokens (OAuth 2.0 JWT/JWS, SPIFFE SVIDs, and COSE receipts) use classical elliptic-curve cryptography (Ed25519 or ECDSA P-256). While the broader Internet community has prioritized Post-Quantum Cryptography (PQC) for TLS key establishment (to defeat "Harvest-Now, Decrypt-Later" confidentiality attacks via ML-KEM / FIPS 203), the agentic AI ecosystem has overlooked a dual threat that strikes digital signatures directly:¶
This specification defines the normative cryptographic structures, CBOR/JCS canonicalization rules, and Merkle-folded delegation envelopes required to make autonomous AI agent protocols quantum-resilient today without violating wire-size or latency budgets.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
To simultaneously satisfy sub-10ms runtime tool-invocation latency and 30-year regulatory non-repudiation, compliant agentic runtimes MUST separate cryptographic enforcement into two coupled planes:¶
+-----------------------------------------------------------------------+
| TIER 1: HOT-PATH DELEGATION & TOOL INVOCATION (Sub-10ms Budget) |
| |
| [Human / Root Intent] |
| | Hybrid Root Anchor: Ed25519 + ML-DSA-65 (Detached JWKThumb)|
| v |
| [Hop 1..k-1: Intermediate Sub-Agents] |
| | Merkle-Folded Scope Attenuation (SHAKE256 + Key-Bound MAC) |
| | (32-byte inclusion witness per hop instead of 5.2KB ML-DSA)|
| v |
| [Hop k: Terminal Invoker -> MCP / A2A Policy Enforcement Point] |
| | Single Terminal Hybrid Proof: Ed25519 (64B) + ML-DSA-65 |
| | (3,309B) over JCS(Intent_Root || Merkle_Chain_Root || Tool)|
+---------+-------------------------------------------------------------+
|
| Asynchronous Batch Commit (Every T <= 60s or N <= 1024 steps)
v
+-----------------------------------------------------------------------+
| TIER 2: COLD-PATH ARCHIVAL TRANSPARENCY LEDGER (30-Year Horizon) |
| |
| [SCITT / Append-Only Trace Notary] |
| | Computes Binary Merkle Tree over Tier-1 Hybrid Receipts |
| | Signs Epoch Root with Stateless Hash-Based Signature: |
| +--> SLH-DSA-SHAKE-128f (FIPS 205) + RFC 3161 PQ Timestamp |
+-----------------------------------------------------------------------+
¶
In a multi-hop delegation chain of depth k, requiring every intermediate agent A_1, ..., A_k to append an inline ML-DSA-65 public key (1,952 bytes) and signature (3,309 bytes) scales linearly at 5,261 bytes per hop. Instead, this specification defines Merkle-Folded Delegation Hop (MFDH) compaction:¶
pq_kid) resolved and cached out-of-band via the WIMSE/SPIFFE workload trust bundle.¶
A_{i-1} delegates attenuated scope S_i (where S_i is a strict subset of S_{i-1}) to A_i, A_{i-1} signs the delegation grant once per session epoch using Hybrid-Ed25519-ML-DSA-65 and registers the 32-byte grant receipt hash H_i = SHAKE256(JCS(Grant_i) || Sig_{ML-DSA-65}) with the local or federated Guardrail Witness cache.¶
A_k transmits: (a) the ordered list of 32-byte hop digests [H_1, ..., H_{k-1}], (b) the canonicalized tool-call parameters and context-isolation witness ([I-D.durga-wimse-ctx-isolation]), and (c) a single terminal Hybrid-Ed25519-ML-DSA-65 signature (3,373 bytes total) over the Merkle root of [H_1, ..., H_{k-1}, Call_k].¶
Consequently, a 10-hop Post-Quantum delegation proof on the wire requires only 3,373 + (9 * 32) = 3,661 bytes—a 93.0% wire-size reduction compared to naive 52,610-byte inline ML-DSA-65 chaining—while preserving full non-interactive lattice verification against cached session grants.¶
Because structured lattice assumptions (Module-LWE / Module-SIS underlying ML-DSA) are mathematically newer than hash collision-resistance assumptions, high-assurance regulatory archives MUST NOT rely solely on lattice signatures for multi-decade non-repudiation.¶
At configurable epoch boundaries (Delta_t <= 60 seconds or N <= 1,024 trace steps), the Trace Verification Notary aggregates all verified Tier-1 step digests into a SHAKE256 Merkle tree and signs the epoch root using SLH-DSA-SHAKE-128f (NIST FIPS 205) alongside a composite ML-DSA-87 signature. Even if an adversary archives all traffic today and later wields both a CRQC (breaking Ed25519) and a theoretical algebraic lattice reduction (weakening ML-DSA), the SLH-DSA-SHAKE-128f epoch seal remains secure under the sole assumption that SHAKE256 is pre-image and second-pre-image resistant.¶
When serialized in JSON (such as inside an MCP _meta.pq_delegation block or an A2A task header), the envelope MUST be canonicalized using RFC 8785 JSON Canonicalization Scheme (JCS) prior to domain-separated hashing and signing:¶
{
"pq_profile": "durga-pquip-agentic-v1",
"suite_id": "HYBRID-ED25519-MLDSA65-SHAKE256",
"policy_epoch": 42,
"policy_manifest_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"invoker_pq_kid": "shake256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"hop_chain_digests": [
"shake256:4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5",
"shake256:6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b"
],
"effective_scope": ["mcp:tool:erp.ledger.read", "mcp:max_rows:100"],
"clean_context_root": "sha256:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069",
"timestamp_ms": 1793460000000,
"nonce": "b4f2e8a1-9c3d-4e7b-8a2f-1d5c6e7f8a9b",
"signatures": {
"ed25519": "base64url(64-byte-rfc8032-signature)",
"ml_dsa_65": "base64url(3309-byte-fips204-signature)"
}
}
¶
The domain-separated signing pre-image MUST be constructed as:¶
PreImage = "PQ-AGENTIC-DELEGATION-V1" || 0x00 ||
SHAKE256_512(JCS(Envelope_Without_Signatures))
¶
A Policy Enforcement Point (PEP) MUST verify both signatures.ed25519 and signatures.ml_dsa_65 against the public keys bound to invoker_pq_kid. If either signature fails verification, or if policy_manifest_sha256 does not match the active policy AST digest, the PEP MUST fail closed and reject the tool invocation with error code -32098 (PQ_SIGNATURE_OR_EPOCH_INVALID).¶
An adversary capable of intercepting MCP or A2A traffic MAY attempt to strip the ml_dsa_65 signature field and force fallback to classical ed25519. To prevent stripping attacks, the suite_id is bound inside the JCS-canonicalized signed payload, and the workload's SPIFFE/WIMSE trust bundle entry explicitly marks pq_required: true. Any envelope presenting only a classical signature for a pq_required workload MUST be rejected immediately.¶
Binding policy_manifest_sha256 and policy_epoch directly into the hybrid-signed pre-image ensures that even across software releases that retain the same invoker_pq_kid, any modification to scope-interpretation semantics produces a deterministic digest mismatch, requiring explicit re-appraisal prior to carrying forward historical authorization conclusions.¶
This document has no immediate IANA actions. Future revisions will request registration of the HYBRID-ED25519-MLDSA65-SHAKE256 algorithm identifier within the IANA JOSE and COSE Algorithms registries.¶