Post-Quantum Hybrid Cryptographic Delegation Chains and Merkle-Aggregated Execution Receipts for Autonomous AI Agents

Introduction As autonomous AI agents transition into regulated enterprise, healthcare, financial, and critical-infrastructure operations, security standards—including IETF WIMSE workload credentials, IETF SCITT transparency receipts, and emerging agentic execution-trace verification specifications ( and )—rely on asymmetric digital signatures to bind human intent, scope attenuation, and tool-invocation receipts. Today, virtually 100% of production agentic identity tokens (OAuth 2.0 JWT/JWS, SPIFFE SVIDs, and COSE receipts) use classical elliptic-curve cryptography (Ed25519 or ECDSA P-256). While the broader Internet community has prioritized Post-Quantum Cryptography (PQC) for TLS key establishment (to defeat "Harvest-Now, Decrypt-Later" confidentiality attacks via ML-KEM / FIPS 203), the agentic AI ecosystem has overlooked a dual threat that strikes digital signatures directly:

1. Harvest-Now, Forge-and-Repudiate-Later (HNFRL) on Long-Lived Agentic Audit Logs: Regulated industries require immutable retention of autonomous decision and tool-execution logs for 7 to 30 years (e.g., HIPAA 6-year minimum, SOX 7-year audit trails, aviation/industrial safety logs). Once a CRQC recovers the classical private key corresponding to a historical agent identity or human approver public key recorded in an audit log, an adversary (or a negligent operator seeking to repudiate liability) can mathematically forge alternative historical execution traces with identical timestamps and valid Ed25519 signatures, destroying the evidentiary integrity of the entire archive.
2. Multi-Hop Lattice Signature-Bloat Amplification (DoS): Unlike TLS handshakes—which amortize PQC key and signature sizes across long-lived TCP/QUIC connections—autonomous agent workflows execute stateless, high-frequency JSON-RPC tool invocations across deeply nested delegation chains (User -> Orchestrator -> Planner -> Domain Sub-Agent -> MCP Gateway -> Tool Server). In classical Ed25519, a 10-hop delegation chain carries 10 x (64-byte signature + 32-byte public key) = 960 bytes. Under NIST FIPS 204 (ML-DSA-65), a single signature is 3,309 bytes and a public key is 1,952 bytes (5,261 bytes per hop). A naive 10-hop nested token balloons to 52,610 bytes (over 70 KB when Base64url-encoded), breaking 8 KB–16 KB HTTP header buffers, overflowing JSON-RPC frame limits, and introducing unacceptable serialization latency.

This specification defines the normative cryptographic structures, CBOR/JCS canonicalization rules, and Merkle-folded delegation envelopes required to make autonomous AI agent protocols quantum-resilient today without violating wire-size or latency budgets.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

HNFRL (Harvest-Now, Forge-and-Repudiate-Later):: An adversarial or evidentiary-repudiation model in which classical public keys and signed agentic audit logs are archived today and subsequently compromised via Shor's algorithm on a CRQC to synthesize counterfeit historical approvals or repudiate authentic execution receipts.
Composite Hybrid Algorithm (Ed25519 + ML-DSA-65):: A dual-signature construction requiring both a valid RFC 8032 Ed25519 signature and a valid NIST FIPS 204 ML-DSA-65 lattice signature over a domain-separated canonical pre-image.
Merkle-Folded Delegation Hop (MFDH):: A compact intermediate delegation link that binds scope attenuation into a SHAKE256 Merkle accumulator anchored by the terminal invoker's hybrid PQ signature and verified by the Policy Enforcement Point (PEP) via pre-registered key-directory digests.

Two-Tier Post-Quantum Agentic Architecture To simultaneously satisfy sub-10ms runtime tool-invocation latency and 30-year regulatory non-repudiation, compliant agentic runtimes MUST separate cryptographic enforcement into two coupled planes: MCP / A2A Policy Enforcement Point] | | | Single Terminal Hybrid Proof: Ed25519 (64B) + ML-DSA-65 | | | (3,309B) over JCS(Intent_Root || Merkle_Chain_Root || Tool)| +---------+-------------------------------------------------------------+ | | Asynchronous Batch Commit (Every T <= 60s or N <= 1024 steps) v +-----------------------------------------------------------------------+ | TIER 2: COLD-PATH ARCHIVAL TRANSPARENCY LEDGER (30-Year Horizon) | | | | [SCITT / Append-Only Trace Notary] | | | Computes Binary Merkle Tree over Tier-1 Hybrid Receipts | | | Signs Epoch Root with Stateless Hash-Based Signature: | | +--> SLH-DSA-SHAKE-128f (FIPS 205) + RFC 3161 PQ Timestamp | +-----------------------------------------------------------------------+ ]]>

Tier 1: Hot-Path Hybrid Delegation with Merkle Hop Folding In a multi-hop delegation chain of depth k, requiring every intermediate agent A_1, ..., A_k to append an inline ML-DSA-65 public key (1,952 bytes) and signature (3,309 bytes) scales linearly at 5,261 bytes per hop. Instead, this specification defines Merkle-Folded Delegation Hop (MFDH) compaction:

Key-Directory Thumbprint Addressing: Agent identities MUST NOT embed raw 1,952-byte ML-DSA-65 public keys inline within per-request JSON-RPC or HTTP headers. Instead, each agent references its composite key via a 32-byte SHAKE256 JWK/COSE_Key thumbprint (pq_kid) resolved and cached out-of-band via the WIMSE/SPIFFE workload trust bundle.
Epoch-Pinned Hybrid Delegation Grant: When Agent A_{i-1} delegates attenuated scope S_i (where S_i is a strict subset of S_{i-1}) to A_i, A_{i-1} signs the delegation grant once per session epoch using Hybrid-Ed25519-ML-DSA-65 and registers the 32-byte grant receipt hash H_i = SHAKE256(JCS(Grant_i) || Sig_{ML-DSA-65}) with the local or federated Guardrail Witness cache.
Constant-Size Per-Call Wire Envelope: On each individual MCP tool invocation, the terminal agent A_k transmits: (a) the ordered list of 32-byte hop digests [H_1, ..., H_{k-1}], (b) the canonicalized tool-call parameters and context-isolation witness (), and (c) a single terminal Hybrid-Ed25519-ML-DSA-65 signature (3,373 bytes total) over the Merkle root of [H_1, ..., H_{k-1}, Call_k].

Consequently, a 10-hop Post-Quantum delegation proof on the wire requires only 3,373 + (9 * 32) = 3,661 bytes—a 93.0% wire-size reduction compared to naive 52,610-byte inline ML-DSA-65 chaining—while preserving full non-interactive lattice verification against cached session grants.

Tier 2: Cold-Path Stateless Hash-Based Archival (SLH-DSA / FIPS 205) Because structured lattice assumptions (Module-LWE / Module-SIS underlying ML-DSA) are mathematically newer than hash collision-resistance assumptions, high-assurance regulatory archives MUST NOT rely solely on lattice signatures for multi-decade non-repudiation. At configurable epoch boundaries (Delta_t <= 60 seconds or N <= 1,024 trace steps), the Trace Verification Notary aggregates all verified Tier-1 step digests into a SHAKE256 Merkle tree and signs the epoch root using SLH-DSA-SHAKE-128f (NIST FIPS 205) alongside a composite ML-DSA-87 signature. Even if an adversary archives all traffic today and later wields both a CRQC (breaking Ed25519) and a theoretical algebraic lattice reduction (weakening ML-DSA), the SLH-DSA-SHAKE-128f epoch seal remains secure under the sole assumption that SHAKE256 is pre-image and second-pre-image resistant.

Normative PQ-Agentic Envelope Schema (JCS / JSON-RPC) When serialized in JSON (such as inside an MCP _meta.pq_delegation block or an A2A task header), the envelope MUST be canonicalized using RFC 8785 JSON Canonicalization Scheme (JCS) prior to domain-separated hashing and signing: The domain-separated signing pre-image MUST be constructed as: A Policy Enforcement Point (PEP) MUST verify both signatures.ed25519 and signatures.ml_dsa_65 against the public keys bound to invoker_pq_kid. If either signature fails verification, or if policy_manifest_sha256 does not match the active policy AST digest, the PEP MUST fail closed and reject the tool invocation with error code -32098 (PQ_SIGNATURE_OR_EPOCH_INVALID).

Security Considerations

Cryptographic Suite Downgrade Prevention An adversary capable of intercepting MCP or A2A traffic MAY attempt to strip the ml_dsa_65 signature field and force fallback to classical ed25519. To prevent stripping attacks, the suite_id is bound inside the JCS-canonicalized signed payload, and the workload's SPIFFE/WIMSE trust bundle entry explicitly marks pq_required: true. Any envelope presenting only a classical signature for a pq_required workload MUST be rejected immediately.

Protection Against Retroactive Policy-Drift Forgery Binding policy_manifest_sha256 and policy_epoch directly into the hybrid-signed pre-image ensures that even across software releases that retain the same invoker_pq_kid, any modification to scope-interpretation semantics produces a deterministic digest mismatch, requiring explicit re-appraisal prior to carrying forward historical authorization conclusions.

IANA Considerations This document has no immediate IANA actions. Future revisions will request registration of the HYBRID-ED25519-MLDSA65-SHAKE256 algorithm identifier within the IANA JOSE and COSE Algorithms registries.