Post-Quantum Use In Protocols (pquip) R. K. Durga Internet-Draft Microsoft Corporation Intended status: Informational 31 October 2026 Expires: 4 May 2027 Post-Quantum Hybrid Cryptographic Delegation Chains and Merkle- Aggregated Execution Receipts for Autonomous AI Agents draft-durga-pquip-pqc-agentic-delegation-00 Abstract Autonomous AI agent ecosystems rely on multi-hop cryptographic delegation chains and signed execution traces (currently built on Ed25519, ECDSA P-256, and RSA-PSS) to enforce least-privilege tool invocations across Model Context Protocol (MCP) and Agent-to-Agent (A2A) boundaries, and to preserve long-term non-repudiation for regulatory audit logs. This architecture faces two existential vulnerabilities in the Post-Quantum era: (1) "Harvest-Now, Forge-and- Repudiate-Later" (HNFRL) attacks, wherein Cryptographically Relevant Quantum Computers (CRQCs) running Shor's algorithm retroactively forge or repudiate multi-year compliance traces (e.g., 7-to-10-year HIPAA, SOX, FDA 21 CFR Part 11, and defense operational logs) and synthesize retroactive human-in-the-loop approvals; and (2) "Lattice Signature-Bloat Amplification," wherein naively substituting 64-byte Ed25519 signatures with 3,309-byte ML-DSA-65 (FIPS 204) signatures across a 10-hop sub-agent chain inflates per-call authorization headers from 640 bytes to over 46 KB (including public keys), exceeding HTTP/2 header limits and degrading sub-10ms real-time tool routing. This document specifies a wire-compatible Post-Quantum Agentic Delegation and Trace Receipt profile ("PQ-Agentic"). It introduces a two-tier cryptographic architecture: (a) a Hot-Path Hybrid Delegation Envelope combining classical Ed25519 with ML-DSA-65 (FIPS 204) via Pre-Verified Session-Grant Digest Chaining (PVSGDC), replacing redundant per-call inline re-transmission of O(N) prior delegators' 5,261-byte ML-DSA-65 public keys and signatures with 32-byte SHAKE256 digests of out-of-band PEP-verified delegation grants; and (b) a Cold-Path Long-Horizon Archival Receipt anchored with stateless hash- based SLH-DSA-SHAKE-128f (FIPS 205) over RFC 9943 SCITT transparency Merkle roots, guaranteeing 30-year quantum-resistant non-repudiation even under catastrophic lattice cryptanalysis. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Durga Expires 4 May 2027 [Page 1] Internet-Draft PQ-Agentic Delegation & Trace Receipts October 2026 Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 4 May 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Conventions and Definitions . . . . . . . . . . . . . . . . . 4 3. Two-Tier Post-Quantum Agentic Architecture . . . . . . . . . 4 3.1. Tier 1: Hot-Path Hybrid Delegation with Merkle Hop Folding . . . . . . . . . . . . . . . . . . . . . . . . . 5 3.2. Tier 2: Cold-Path Stateless Hash-Based Archival (SLH-DSA / FIPS 205) . . . . . . . . . . . . . . . . . . . . . . . . 6 4. Normative PQ-Agentic Envelope Schema (JCS / JSON-RPC) . . . . 6 5. Security Considerations . . . . . . . . . . . . . . . . . . . 7 5.1. Cryptographic Suite Downgrade Prevention . . . . . . . . 7 5.2. Protection Against Retroactive Policy-Drift Forgery . . . 8 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 7.1. Normative References . . . . . . . . . . . . . . . . . . 8 7.2. Informative References . . . . . . . . . . . . . . . . . 8 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 9 Durga Expires 4 May 2027 [Page 2] Internet-Draft PQ-Agentic Delegation & Trace Receipts October 2026 1. Introduction As autonomous AI agents transition into regulated enterprise, healthcare, financial, and critical-infrastructure operations, security standards—including IETF WIMSE workload credentials, IETF SCITT transparency receipts, and emerging agentic execution-trace verification specifications ([I-D.durga-agenttrust-trace-verification] and [I-D.durga-wimse-ctx-isolation])—rely on asymmetric digital signatures to bind human intent, scope attenuation, and tool- invocation receipts. Today, virtually 100% of production agentic identity tokens (OAuth 2.0 JWT/JWS, SPIFFE SVIDs, and COSE receipts) use classical elliptic- curve cryptography (Ed25519 or ECDSA P-256). While the broader Internet community has prioritized Post-Quantum Cryptography (PQC) for TLS key establishment (to defeat "Harvest-Now, Decrypt-Later" confidentiality attacks via ML-KEM / FIPS 203), the agentic AI ecosystem has overlooked a dual threat that strikes digital signatures directly: * *1. Harvest-Now, Forge-and-Repudiate-Later (HNFRL) on Long-Lived Agentic Audit Logs:* Regulated industries require immutable retention of autonomous decision and tool-execution logs for 7 to 30 years (e.g., HIPAA 6-year minimum, SOX 7-year audit trails, aviation/industrial safety logs). Once a CRQC recovers the classical private key corresponding to a historical agent identity or human approver public key recorded in an audit log, an adversary (or a negligent operator seeking to repudiate liability) can mathematically forge alternative historical execution traces with identical timestamps and valid Ed25519 signatures, destroying the evidentiary integrity of the entire archive. * *2. Multi-Hop Lattice Signature-Bloat Amplification (DoS):* Unlike TLS handshakes—which amortize PQC key and signature sizes across long-lived TCP/QUIC connections—autonomous agent workflows execute stateless, high-frequency JSON-RPC tool invocations across deeply nested delegation chains (User -> Orchestrator -> Planner -> Domain Sub-Agent -> MCP Gateway -> Tool Server). In classical Ed25519, a 10-hop delegation chain carries 10 x (64-byte signature + 32-byte public key) = 960 bytes. Under NIST FIPS 204 (ML-DSA- 65), a single signature is 3,309 bytes and a public key is 1,952 bytes (5,261 bytes per hop). A naive 10-hop nested token balloons to 52,610 bytes (over 70 KB when Base64url-encoded), breaking 8 KB–16 KB HTTP header buffers, overflowing JSON-RPC frame limits, and introducing unacceptable serialization latency. Durga Expires 4 May 2027 [Page 3] Internet-Draft PQ-Agentic Delegation & Trace Receipts October 2026 This specification defines the normative cryptographic structures, CBOR/JCS canonicalization rules, and Merkle-folded delegation envelopes required to make autonomous AI agent protocols quantum- resilient today without violating wire-size or latency budgets. 2. Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. HNFRL (Harvest-Now, Forge-and-Repudiate-Later): An adversarial or evidentiary-repudiation model in which classical public keys and signed agentic audit logs are archived today and subsequently compromised via Shor's algorithm on a CRQC to synthesize counterfeit historical approvals or repudiate authentic execution receipts. Composite Hybrid Algorithm (Ed25519 + ML-DSA-65): A dual-signature construction requiring both a valid RFC 8032 Ed25519 signature and a valid NIST FIPS 204 ML-DSA-65 lattice signature over a domain- separated canonical pre-image. Merkle-Folded Delegation Hop (MFDH): A compact intermediate delegation link that binds scope attenuation into a SHAKE256 Merkle accumulator anchored by the terminal invoker's hybrid PQ signature and verified by the Policy Enforcement Point (PEP) via pre-registered key-directory digests. 3. Two-Tier Post-Quantum Agentic Architecture To simultaneously satisfy sub-10ms runtime tool-invocation latency and 30-year regulatory non-repudiation, compliant agentic runtimes MUST separate cryptographic enforcement into two coupled planes: Durga Expires 4 May 2027 [Page 4] Internet-Draft PQ-Agentic Delegation & Trace Receipts October 2026 +-----------------------------------------------------------------------+ | TIER 1: HOT-PATH DELEGATION & TOOL INVOCATION (Sub-10ms Budget) | | | | [Human / Root Intent] | | | Hybrid Root Anchor: Ed25519 + ML-DSA-65 (Detached JWKThumb)| | v | | [Hop 1..k-1: Intermediate Sub-Agents] | | | Merkle-Folded Scope Attenuation (SHAKE256 + Key-Bound MAC) | | | (32-byte inclusion witness per hop instead of 5.2KB ML-DSA)| | v | | [Hop k: Terminal Invoker -> MCP / A2A Policy Enforcement Point] | | | Single Terminal Hybrid Proof: Ed25519 (64B) + ML-DSA-65 | | | (3,309B) over JCS(Intent_Root || Merkle_Chain_Root || Tool)| +---------+-------------------------------------------------------------+ | | Asynchronous Batch Commit (Every T <= 60s or N <= 1024 steps) v +-----------------------------------------------------------------------+ | TIER 2: COLD-PATH ARCHIVAL TRANSPARENCY LEDGER (30-Year Horizon) | | | | [SCITT / Append-Only Trace Notary] | | | Computes Binary Merkle Tree over Tier-1 Hybrid Receipts | | | Signs Epoch Root with Stateless Hash-Based Signature: | | +--> SLH-DSA-SHAKE-128f (FIPS 205) + RFC 3161 PQ Timestamp | +-----------------------------------------------------------------------+ 3.1. Tier 1: Hot-Path Hybrid Delegation with Merkle Hop Folding In a multi-hop delegation chain of depth k, requiring every intermediate agent A_1, ..., A_k to append an inline ML-DSA-65 public key (1,952 bytes) and signature (3,309 bytes) scales linearly at 5,261 bytes per hop. Instead, this specification defines *Merkle- Folded Delegation Hop (MFDH)* compaction: 1. *Key-Directory Thumbprint Addressing:* Agent identities MUST NOT embed raw 1,952-byte ML-DSA-65 public keys inline within per- request JSON-RPC or HTTP headers. Instead, each agent references its composite key via a 32-byte SHAKE256 JWK/COSE_Key thumbprint (pq_kid) resolved and cached out-of-band via the WIMSE/SPIFFE workload trust bundle. 2. *Epoch-Pinned Hybrid Delegation Grant:* When Agent A_{i-1} delegates attenuated scope S_i (where S_i is a strict subset of S_{i-1}) to A_i, A_{i-1} signs the delegation grant once per session epoch using Hybrid-Ed25519-ML-DSA-65 and registers the 32-byte grant receipt hash H_i = SHAKE256(JCS(Grant_i) || Sig_{ML-DSA-65}) with the local or federated Guardrail Witness cache. Durga Expires 4 May 2027 [Page 5] Internet-Draft PQ-Agentic Delegation & Trace Receipts October 2026 3. *Constant-Size Per-Call Wire Envelope:* On each individual MCP tool invocation, the terminal agent A_k transmits: (a) the ordered list of 32-byte hop digests [H_1, ..., H_{k-1}], (b) the canonicalized tool-call parameters and context-isolation witness ([I-D.durga-wimse-ctx-isolation]), and (c) a single terminal Hybrid-Ed25519-ML-DSA-65 signature (3,373 bytes total) over the Merkle root of [H_1, ..., H_{k-1}, Call_k]. Consequently, a 10-hop Post-Quantum delegation proof on the wire requires only 3,373 + (9 * 32) = 3,661 bytes—a *93.0% wire-size reduction* compared to naive 52,610-byte inline ML-DSA-65 chaining—while preserving full non-interactive lattice verification against cached session grants. 3.2. Tier 2: Cold-Path Stateless Hash-Based Archival (SLH-DSA / FIPS 205) Because structured lattice assumptions (Module-LWE / Module-SIS underlying ML-DSA) are mathematically newer than hash collision- resistance assumptions, high-assurance regulatory archives MUST NOT rely solely on lattice signatures for multi-decade non-repudiation. At configurable epoch boundaries (Delta_t <= 60 seconds or N <= 1,024 trace steps), the Trace Verification Notary aggregates all verified Tier-1 step digests into a SHAKE256 Merkle tree and signs the epoch root using *SLH-DSA-SHAKE-128f (NIST FIPS 205)* alongside a composite ML-DSA-87 signature. Even if an adversary archives all traffic today and later wields both a CRQC (breaking Ed25519) and a theoretical algebraic lattice reduction (weakening ML-DSA), the SLH-DSA-SHAKE- 128f epoch seal remains secure under the sole assumption that SHAKE256 is pre-image and second-pre-image resistant. 4. Normative PQ-Agentic Envelope Schema (JCS / JSON-RPC) When serialized in JSON (such as inside an MCP _meta.pq_delegation block or an A2A task header), the envelope MUST be canonicalized using RFC 8785 JSON Canonicalization Scheme (JCS) prior to domain- separated hashing and signing: Durga Expires 4 May 2027 [Page 6] Internet-Draft PQ-Agentic Delegation & Trace Receipts October 2026 { "pq_profile": "durga-pquip-agentic-v1", "suite_id": "HYBRID-ED25519-MLDSA65-SHAKE256", "policy_epoch": 42, "policy_manifest_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "invoker_pq_kid": "shake256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "hop_chain_digests": [ "shake256:4a44dc15364204a80fe80e9039455cc1608281820fe2b24f1e5233ade6af1dd5", "shake256:6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b" ], "effective_scope": ["mcp:tool:erp.ledger.read", "mcp:max_rows:100"], "clean_context_root": "sha256:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069", "timestamp_ms": 1793460000000, "nonce": "b4f2e8a1-9c3d-4e7b-8a2f-1d5c6e7f8a9b", "signatures": { "ed25519": "base64url(64-byte-rfc8032-signature)", "ml_dsa_65": "base64url(3309-byte-fips204-signature)" } } The domain-separated signing pre-image MUST be constructed as: PreImage = "PQ-AGENTIC-DELEGATION-V1" || 0x00 || SHAKE256_512(JCS(Envelope_Without_Signatures)) A Policy Enforcement Point (PEP) MUST verify *both* signatures.ed25519 and signatures.ml_dsa_65 against the public keys bound to invoker_pq_kid. If either signature fails verification, or if policy_manifest_sha256 does not match the active policy AST digest, the PEP MUST fail closed and reject the tool invocation with error code -32098 (PQ_SIGNATURE_OR_EPOCH_INVALID). 5. Security Considerations 5.1. Cryptographic Suite Downgrade Prevention An adversary capable of intercepting MCP or A2A traffic MAY attempt to strip the ml_dsa_65 signature field and force fallback to classical ed25519. To prevent stripping attacks, the suite_id is bound inside the JCS-canonicalized signed payload, and the workload's SPIFFE/WIMSE trust bundle entry explicitly marks pq_required: true. Any envelope presenting only a classical signature for a pq_required workload MUST be rejected immediately. Durga Expires 4 May 2027 [Page 7] Internet-Draft PQ-Agentic Delegation & Trace Receipts October 2026 5.2. Protection Against Retroactive Policy-Drift Forgery Binding policy_manifest_sha256 and policy_epoch directly into the hybrid-signed pre-image ensures that even across software releases that retain the same invoker_pq_kid, any modification to scope- interpretation semantics produces a deterministic digest mismatch, requiring explicit re-appraisal prior to carrying forward historical authorization conclusions. 6. IANA Considerations This document has no immediate IANA actions. Future revisions will request registration of the HYBRID-ED25519-MLDSA65-SHAKE256 algorithm identifier within the IANA JOSE and COSE Algorithms registries. 7. References 7.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, May 2017, . [RFC8785] Rundgren, A., Jordan, B., and S. Erdtman, "JSON Canonicalization Scheme (JCS)", RFC 8785, June 2020, . [FIPS204] National Institute of Standards and Technology, "Module- Lattice-Based Digital Signature Standard (ML-DSA)", NIST FIPS 204, August 2024, . [FIPS205] National Institute of Standards and Technology, "Stateless Hash-Based Digital Signature Standard (SLH-DSA)", NIST FIPS 205, August 2024, . 7.2. Informative References Durga Expires 4 May 2027 [Page 8] Internet-Draft PQ-Agentic Delegation & Trace Receipts October 2026 [I-D.durga-agenttrust-trace-verification] Durga, R. K., "Cryptographic Execution-Trace Verification and Scope-Bounded Delegation for Autonomous AI Agents", Work in Progress, Internet-Draft, draft-durga-agenttrust- trace-verification-00, October 2026, . [I-D.durga-wimse-ctx-isolation] Durga, R. K., "Cryptographic Separation of Untrusted Data- Plane Context from Control-Plane Tool Invocations in Autonomous AI Agents", Work in Progress, Internet-Draft, draft-durga-wimse-ctx-isolation-00, October 2026, . Author's Address Raghuvar Karthik Durga Microsoft Corporation Chicago, IL United States of America Email: rdurga@microsoft.com URI: https://orcid.org/0009-0003-7014-355X Durga Expires 4 May 2027 [Page 9]