Post-quantum cryptography for identity and KYC
Digital identity rests on signatures: a passport chip, a mobile driver’s license, a KYC attestation or a verifiable credential is trusted because an issuer signed it. Those signatures are checked for the full validity period of the credential — often many years — and a signature that becomes forgeable lets an attacker mint fraudulent identities. That is why identity is one of the clearest cases for post-quantum signing.
The issuer signature is the whole trust anchor
When a relying party accepts a credential, it is trusting the issuer’s signature and nothing else. If that signature scheme is ECDSA and a quantum computer breaks it, an attacker can forge issuer signatures and produce credentials indistinguishable from genuine ones — a systemic failure, not a single fraud. Signing credentials with ML-DSA (FIPS 204) keeps the issuer’s attestation unforgeable across the credential’s multi-year lifetime.
Verifiable credentials and selective disclosure
Modern identity favors verifiable credentials that let a holder prove a fact — over 18, resident of a country, cleared KYC — without revealing the underlying document. The issuer signs the credential; the holder presents it; the verifier checks the signature offline. Making that signature post-quantum ensures the proof stays valid for years, while selective disclosure minimizes the personal data exposed at each check.
Honest scope
PQC signatures prove a credential was issued by a trusted authority and not altered. They do not prove the holder is the legitimate subject — that depends on secure enrollment and binding at issuance — nor do they replace liveness and fraud checks. The algorithms are resistant to known classical and quantum attacks per NIST, not unbreakable. The priority is credentials with long validity, where the trust window overlaps the quantum horizon.
Try it yourself — live, free, verifiable in 30 seconds:
Issue verifiable credentials →