1. Home
  2. /
  3. Use cases
  4. /
  5. Quantum-ready code signing

Quantum-ready code signing

As of right now, SignServer supports ML_DSA (Dilithium) and SLH-DSA (SPHINCS+) algorithms for CMS and raw signing.

hero-sub-2-white

Challenge

Considerations for Migrating to New Algorithms and Ensuring Compatibility

Migrating to new quantum-ready cryptography algorithms requires careful evaluation of existing solutions and properly optimizing the environment. As a developer, you must take into consideration:

  • Which algorithms have broad compatibility
  • Use case-specific requirements
  • The benefits and complexities of hybrid certificates
  • How to operationalize (i.e system architecture, infrastructure needs, HSM support, and protocol compatibility
  • Which legacy systems may need “isolation” and be front-ended with enhanced security

You can also read more here:

Get ready for Quantum-ready Cryptography

arrow

Solution

Seamless support for Quantum-ready PKI and signing

The reality is that there are still many unanswered questions, and it will take some time before all the pieces fall into place. SignServer and EJBCA offer a seamless solution for quantum-safe signing and signing certificates alongside the existing PKI and signing environment. This ensures a smooth experience with minimal disruption to your current infrastructure. You can begin experimenting with the technology and gradually understand its relevance to your specific environment over time.

Currently, ML-DSA (Dilithium) and SHL-DSA (SPHINCS+) are supported in SignServer for CMS and raw signing.

EJBCA supports ML-DSA (Dilithium) and NL-DSA (Falcon) algorithms for Root CAs, Issuing CAs, and End entities. 

Check out our how-tos and video on:

  • Issue ML-DSA code signing certificate with EJBCA and sign code in SignServer
  • Create a hybrid certificate using the Bouncy Castle Kotlin project

Please note, the final standards for ML-KEM, ML-DSA and SLH-DSA were finalized in August 2024. We recommend only using standardized quantum-safe algorithms in production environments. 

Tutorials

SignServer logo thumbnail
Code signing
Post-quantum
2023-07-04

ML-DSA (Dilithium) Signing Certificate and Signing in SignServer

Set up your first quantum-ready PKI. Create your ML-DSA (Dilithium) Root CAs, Issuing CAs, and end entities for code signing. Then sign data in SignServer. The ML-DSA (Dilithium) algorithm offers strong security and efficiency by l...
ML-DSA

Get inspired

Stay up-to-date on the latest SignServer news and updates through our news feed. From product releases to the newest tutorial videos and guides, our feed provides the latest information on all things related to SignServer. Don't miss out on our upcoming events, live or online, designed to provide valuable knowledge and hands-on experiences. Join our community and stay in the know with SignServer.

PKI hierarchies - 1, 2, 3 tiers ?
Post-Quantum Cryptography
Tech Update
Ejbca
Signserver
8 April, 2025

#KEYMASTER: When Are You PQC Ready?

The journey to post-quantum cryptography (PQC) readiness is more than just ad...
Keyfactor Release
Implementing Cryptography
Installation & Deployment
Post-Quantum Cryptography
Release
Ejbca
Signserver
31 March, 2025

EJBCA 9.1 Community is Here!

EJBCA 9.1 Community edition brings the latest advancements in PKI and cryptog...
PKI hierarchies - 1, 2, 3 tiers ?
DevOps
Installation & Deployment
Signing
Tech Update
Ejbca
Signserver
26 March, 2025

#KEYMASTER: Bringing Transparency to Software Supply Chains – A Deep Dive into SLSA

In this #KEYMASTER episode, host Sven Rajala is joined by Fredrik Skogman fro...

Related open-source projects

This website uses cookies

Cookies consist of small text files. They contain data that is stored on your device. To enable us to place certain types of cookies we need to obtain your consent. At PrimeKey Solutions AB, corp. ID no. 556628-3064, we use the following kinds of cookies. To read more about which cookies we use and storage times, click here to access our cookies policy.

Manage your cookie-settings

Necessary cookies

Check to consent to the use of Necessary cookies
Necessary cookies are cookies that must be placed for basic functions to work on the website. Basic functions are, for example, cookies which are needed so that you can use menus on the website and navigate on the site.

Functional cookies

Check to consent to the use of Functional cookies
Functional cookies need to be placed on the website in order for it to perform as you would expect. For example, so that it recognizes which language you prefer, whether or not you are logged in, to keep the website secure, remember login details or to be able to sort products on the website according to your preferences.

Cookies for statistics

Check to consent to the use of Cookies for statistics
For us to measure your interactions with the website, we place cookies in order to keep statistics. These cookies anonymize personal data.

Cookies for ad-tracking

Check to consent to the use of Cookies for ad-tracking
To enable us to offer better service and experience, we place cookies so that we can provide relevant advertising. Another aim of this processing is to enable us to promote products or services, provide customized offers or provide recommendations based on what you have purchased in the past.

Ad measurement user cookies

Check to consent to the use of Ad measurement user cookies
In order to show relevant ads we place cookies to tailor ads for you

Personalized ads cookies

Check to consent to the use of Personalized ads cookies
To show relevant and personal ads we place cookies to provide unique offers that are tailored to your user data