Search papers, labs, and topics across Lattice.
This paper addresses the challenges of post-quantum signature migration in distributed authorization systems, highlighting the architectural tensions between native-signature compatibility, unilateral-signing resistance, and threshold-layer agility. The authors classify various signing architectures and identify that no existing design achieves all three properties simultaneously, emphasizing the limitations of merely replacing APIs for achieving cryptographic agility. By organizing the design boundary and migration impact surface, the study provides a clearer understanding of the necessary trade-offs in developing robust distributed authorization mechanisms in a post-quantum context.
No existing distributed authorization design can simultaneously ensure native-signature compatibility, unilateral-signing resistance, and threshold-layer agility, revealing a critical architectural tension in post-quantum systems.
Post-quantum signature migration poses a distinct systems problem when authorization is distributed among multiple parties. In native threshold signing, the signature algorithm may determine key generation, share state, preprocessing, interaction, combination, refresh, and recovery. Architectures that evaluate threshold policy outside the native signing relation can reduce this coupling, but their authorization evidence is not accepted by an unchanged native verifier unless a trusted complete-key signer translates approval into a native signature. This paper organizes that design boundary through three properties: native-signature compatibility, unilateral-signing resistance, and threshold-layer agility. We classify specialized threshold signatures, generic MPC signing, distributed hash-based constructions, programmable multisignature and dual-gate authorization, and threshold-authorized HSM signing. A migration impact surface identifies which components change with the signature algorithm. Across the surveyed families, no design simultaneously provides native output, unilateral-signing resistance, and threshold-layer agility. This is an architectural tension, not an impossibility claim, and it clarifies why a replaceable API alone does not make distributed authorization cryptographically agile.
