Recommendations for Post-Quantum Signature Algorithms in TLS 1.3

The rapid advancement of quantum computing structures introduces severe systemic risks to prevailing public-key infrastructures (PKIs) globally. Traditional cryptographic primitives—primarily those reliant on integer factorization, finite field discrete logarithms, or elliptic curve discrete logarithms—are inherently vulnerable to polynomial-time quantum cryptanalysis via Shor's algorithm. To preemptively mitigate these threats, the cryptographic community has initiated a wholesale transition toward post-quantum (PQ) cryptography and hybrid post-quantum/traditional (PQ/T) architectures across core transport layer validation frameworks. Within the context of Transport Layer Security (TLS) version 1.3 , this migration has triggered a massive expansion of the signature scheme namespace. Various working groups within the Internet Engineering Task Force (IETF) and the broader cryptographic ecosystem have introduced an extensive library of algorithm specifications. Specifically, 16 distinct composite ML-DSA combinations have been proposed to use in TLS 1.3, alongside 3 standalone pure ML-DSA parameter sets and 12 stateless hash-based SLH-DSA parameter variations . When aggregated across the Internet Assigned Numbers Authority (IANA) registries , over 30 separate post-quantum and hybrid signature schemes are now available for session negotiation and certificate chain path building. While this wide array of parameters offers flexible trade-offs between performance, signature boundaries, and mathematical hardness assumptions, it simultaneously introduces a critical challenge: implementation complexity. Requiring TLS engines to store, process, and negotiate an unmanaged number of code points invariably leads to increased software attack surfaces, potential interoperability friction, and inefficient ClientHello negotiations. Furthermore, the inclusion of heavy signature options can induce network-level penalties, such as packet fragmentation and increased time-to-last-byte metrics across volatile or lossy connection channels. To prevent systemic fragmentation of the TLS ecosystem, this document provides structured deployment profiles that identify a curated, highly interoperable subset of post-quantum signature schemes. By delineating clear boundaries between general-purpose handshake authentication and long-term certificate authority trust anchors, these recommendations enable protocol implementers to align with strict regulatory frameworks while keeping operational execution costs manageable.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The post-quantum signature options currently specified for use within TLS 1.3 originate from two fundamentally distinct mathematical families standardized by NIST: module-lattice-based cryptography and stateless hash-based cryptography. Each family presents varying engineering trade-offs regarding computational execution times, public key boundaries, and signature verification payloads. Understanding these characteristics is essential for analyzing how different algorithms affect standard TLS handshakes and packet processing pipelines. The Module-Lattice-Based Digital Signature Algorithm (ML-DSA) represents the primary general-purpose public-key signature framework for post-quantum migration. Derived from the Crystals-Dilithium primitive, ML-DSA is specified across three security levels: ML-DSA-44, ML-DSA-65, and ML-DSA-87, mapped respectively to the TLS SignatureScheme namespace as mldsa44, mldsa65, and mldsa87 . ML-DSA achieves a highly optimized balance between public key generation, signing speed, and verification efficiency. Its signature sizes range from roughly 2,420 bytes to 4,595 bytes. While significantly larger than traditional elliptic curve or RSA signatures, these sizes generally fit within standard TCP initial window limits without triggering extensive packet fragmentation. Conversely, the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) , derived from SPHINCS+, relies on the conservative security assumptions of symmetric hash functions (such as SHA-256 or SHAKE256). SLH-DSA introduces zero new structural mathematical hardness assumptions beyond the collision resistance of its underlying hash primitives. This property makes it exceptionally resilient against prospective lattice cryptanalysis breakthroughs. However, this robust security comes with heavy performance trade-offs. Across its 12 registered variations , the "small" (S) variants minimize payload size at the cost of slower signing speeds, yet still produce signatures ranging from 7,856 bytes to nearly 30 kilobytes. The "fast" (F) variants accelerate signature production but increase verification overhead and result in much larger transmission payloads. This substantial size boundary introduces a persistent risk of network-level disruptions, such as middlebox drops caused by fragmented UDP packets in DTLS environments. To bridge the operational gap during this multi-decade migration, Composite ML-DSA signature schemes have been introduced as a transitional framework for Post-Quantum/Traditional (PQ/T) hybrids. A composite scheme packages both a post-quantum algorithm (such as ML-DSA) and a classical primitive (such as ECDSA, Ed25519, or RSA) into a single cryptographic element. Protocol logic treats this combination as a single opaque identifier, executing both signing and verification routines sequentially. Authentication succeeds if and only if both component signatures are verified as structurally valid. This architecture provides robust defense-in-depth, protecting session security even in the event of an unforeseen structural break in early post-quantum lattice primitives or their initial software implementations.

Selecting post-quantum signature schemes for TLS 1.3 requires navigating a multi-dimensional engineering trade-off matrix consisting of payload size, processing latency, and security longevity. Ecosystem fragmentation can be avoided by dividing recommendations into distinct deployment profiles based on operational roles. The following is a preliminary recommendation.

To establish baseline engineering logic, the structural metrics of the candidate algorithms are compared below. Byte overhead figures represent the combined total of the public key and the signature payload, which directly impacts the TLS handshake packet footprint. Post-Quantum Signature Scheme Resource Metrics

Signature Scheme Identifier	Public Key & Signature (Bytes)	Signing Latency	Verification Latency	Primary Mathematical Assumption
`mldsa65`	5,251	Low	Very Low	Module Learning With Errors (M-LWE)
`mldsa65_ecdsa_secp256r1_sha512`	5,379	Low-Medium	Low	Dual: M-LWE and Elliptic Curve ECDSA
`slhdsa_shake_128s`	7,888	High	Low-Medium	Symmetric Hash Function Strength
`slhdsa_shake_192s`	16,272	High	Medium	Symmetric Hash Function Strength

For standard ephemeral TLS handshakes where minimal time-to-last-byte (TTLB) and low CPU utilization are critical constraints, mldsa65 is RECOMMENDED as the default pure post-quantum baseline scheme. As demonstrated in , the ~5.2 KB overhead of mldsa65 allows the handshake transmission to comfortably fit within standard TCP Initial Congestion Window limits (typically 10 packets or ~14.6 KB) without triggering multi-round-trip IP fragmentation anomalies. For deployments governed by transitional regulatory mandates or requiring cryptographic risk mitigation against prospective lattice flaws, the composite signature scheme mldsa65_ecdsa_secp256r1_sha512 is RECOMMENDED. The incremental transmission cost of adding the classical ECDSA layer is negligible (+128 bytes), while the processing overhead remains well within the operational tolerances of modern hardware accelerators.

The engineering logic shifts significantly when evaluating root and intermediate Certificate Authority (CA) trust anchors. Because trust anchors and intermediate certificates are infrequently updated and are often cached by relying parties, signature verification reliability and long-term security safety take precedence over signature size limits. For these scenarios, SLH-DSA variants—specifically slhdsa_shake_128s—are RECOMMENDED for signing long-lived intermediate and root structures. By trading away signing performance, the small ("s") variants limit the byte boundary inflation to under 8 KB, ensuring compatibility with standard X.509 certificate path parsers. Leveraging the conservative symmetric assumptions of SHAKE256 ensures that the root anchor framework remains secure against algorithmic breakthroughs targeting lattice geometry, providing a secure foundation throughout the post-quantum migration era.

To be added later.