💻 computer science

DIT: A Decentralized Identity and Trust Protocol for Post-Quantum CA-Free Web Authentication

DIT is a decentralized, post-quantum secure authentication protocol that eliminates the traditional CA hierarchy by anchoring domain identities in DNSSEC-verified ML-DSA-65 keys and utilizing a hybrid X25519MLKEM768 handshake with Merkle transparency logs to provide efficient, revocable trust without centralized certificate authorities.

Original authors: Debasish tripathy, Dayananda P

Published 2026-07-22

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Debasish tripathy, Dayananda P

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling city where every shop, bank, and home needs a secure way to prove who they are. Right now, this city relies on a massive, centralized system of "notaries" called Certificate Authorities (CAs). Think of these CAs as the only people allowed to stamp a shop's ID card. If a notary gets hacked or makes a mistake, the whole city's security is at risk. To fix this, the city has started making ID cards expire very quickly—sometimes in less than 50 days—forcing shops to renew them constantly. But this is like trying to stop a leaky roof by changing the roof tiles every week instead of fixing the roof itself. The real problem is that the system is too dependent on these central notaries, and it's not ready for the future, where powerful quantum computers might break the locks on these ID cards entirely.

This paper introduces a new way to handle digital identity called DIT (Decentralized Identity and Trust). Instead of relying on a central notary, DIT suggests that every shop should hold its own master key, which is published in the city's public directory (the DNS system) and checked by a group of independent, honest witnesses. It uses "future-proof" math that even quantum computers can't crack to sign these keys. The authors built a working model of this system and found that it can prove identity and keep secrets just as fast as the current system, but without needing the central notaries. However, they also admit that if the master key is lost, the recovery process still relies on older math that quantum computers could break, and the whole system only works if the city's public directory is already secure.

The Big Idea: Ditching the Notary

The current way the web stays secure is a bit like a game of "telephone" where you trust a chain of people to vouch for a stranger. You trust your browser, which trusts a big company (the CA), which vouches for the website you are visiting. If that big company gets hacked, they can pretend to be anyone. The paper argues that this chain is broken. The solution isn't to make the chain shorter or the cards expire faster; it's to cut out the middleman entirely.

DIT proposes a system where a website's identity is anchored directly in the internet's phonebook (DNS). Instead of a CA stamping a certificate, the website publishes a "Master Key" in its phonebook entry. This entry is signed by the phonebook's own security system (DNSSEC), which acts as the ultimate truth-teller.

The Three-Layer Security Castle

To make this work without a central boss, the authors designed a three-layer castle of keys:

The Identity Key (The Master Key): This is the website's permanent, offline master key. It's like the deed to the house. It rarely changes and is kept in a super-secure vault (or split among a group of trusted people). It uses a special "quantum-proof" lock (ML-DSA-65) that is believed to be unbreakable even by future quantum computers.
The Epoch Key (The Daily Pass): Every 24 hours, the website generates a brand new, temporary key. This is like a daily pass that lets you into the building for just one day. The Master Key signs this daily pass to say, "Yes, this pass is real." If a hacker steals the daily pass, it only works for one day, and then it self-destructs.
The Session Key (The Handshake): When you visit the website, you and the server shake hands to create a secret code just for that specific conversation. This uses a mix of old and new math (X25519 and ML-KEM-768) to ensure that even if someone records your conversation today, they can't read it tomorrow if they steal the keys later.

The "Honest Witness" System

How do you know the Master Key in the phonebook hasn't been swapped by a hacker? DIT uses a system of Trust Witnesses. Imagine a group of seven independent auditors (like a jury) who watch the website's activity. Whenever the website changes its Master Key, it must get at least five of these seven auditors to sign off on the change.

The website also keeps a public "transparency log," like a glass-walled diary, where every key change is recorded. If a hacker tries to swap the key without the witnesses' approval, the public can see it immediately. The authors proved mathematically that as long as at least three of the seven witnesses are honest, a hacker cannot trick the system.

The "Quantum-Proof" Promise

The most exciting part of DIT is that it is built for the future. The authors used new types of math (lattice-based cryptography) that are designed to resist attacks from quantum computers.

Authentication: The signatures used to verify identity are quantum-proof.
Secret Keeping: The way secrets are exchanged is also quantum-proof.

However, the paper is very honest about one weak spot: Recovery. If the Master Key is lost or stolen, the website needs a way to get a new one. The current recovery method uses an older type of math (FROST-Schnorr) that is vulnerable to quantum computers. The authors explicitly state that this recovery path is not quantum-proof and suggest that a future update will be needed to fix this once better quantum-proof recovery tools are available.

Does It Actually Work?

The authors didn't just write a theory; they built a working prototype and tested it.

Speed: When a user visits a site they've seen before (the "warm path"), DIT is just as fast as the current system, taking about 6 KB of data to verify.
First Visit: The first time a user visits a new site (the "cold path"), it takes a bit more data (~34 KB) because the user has to download the witness signatures and the log history. But this cost is paid only once; all future visits are fast.
Efficiency: Because the daily keys rotate automatically, websites wouldn't need to renew certificates thousands of times a year. The authors calculated that for a company with 1,000 domains, this saves them from managing 8,000 renewals a year, dropping that number to zero.

The Catch: It Needs a Secure Phonebook

The paper concludes with a crucial reality check. DIT is a brilliant new engine, but it needs a specific type of road to run on. It requires the internet's phonebook (DNS) to be secured with DNSSEC. Currently, only a small fraction of the web uses this security. If the phonebook itself is not secure, the whole DIT system falls apart.

Additionally, the system relies on browsers and websites adopting these new standards. The authors suggest a step-by-step rollout: first as a browser extension, then as a built-in feature, and finally as the default way the web works.

In short, DIT offers a way to build a web where you don't have to trust a single central authority, where your secrets are safe from future quantum computers, and where websites don't have to constantly renew their IDs. But it's not a magic wand; it requires the internet's underlying infrastructure to catch up, and it still has one "classical" weak point when it comes to recovering lost keys. The authors have shown it's possible, but the journey to make it the new normal is just beginning.

Technical Summary: DIT – A Decentralized Identity and Trust Protocol for Post-Quantum CA-Free Web Authentication

Problem Statement
The current web Public Key Infrastructure (PKI) relies on a centralized hierarchy of Certificate Authorities (CAs). This model suffers from structural vulnerabilities: any single trusted root CA can unilaterally issue valid certificates for any domain, and revocation mechanisms (OCSP, CRLs) are unreliable, leading the industry to rely on short certificate lifetimes as a substitute for revocation. The CA/B Forum's Ballot SC-081v3, which mandates reducing public TLS certificate validity to 47 days by 2029, highlights the operational burden and architectural limits of this "revocation-by-expiry" approach. Furthermore, existing post-quantum (PQ) migration efforts in TLS 1.3 often secure only the key exchange (e.g., ML-KEM) while leaving the authentication chain (RSA/ECDSA certificates) vulnerable to quantum attacks. Prior attempts to decentralize trust, such as DANE (DNS-based Authentication of Named Entities), suffer from limited transparency, lack of key recovery mechanisms, and a flat key structure that does not separate long-term identity from short-term session material.

Methodology
The authors propose DIT (Decentralized Identity and Trust), a protocol that replaces the CA hierarchy entirely with a DNS-anchored, post-quantum secure trust model. The architecture consists of six layers:

DNS Identity Publication: Domain identity is anchored in a DNSSEC-signed HTTPS/SVCB record (_dit.domain). This record contains a hash commitment (not the full key) to a canonical identity object fetched from a well-known HTTPS endpoint.
Three-Level Key Hierarchy:
- Identity Key (IK): A long-term ML-DSA-65 key pair stored offline or in a threshold configuration. It signs epoch credentials.
- Epoch Authentication Key (EAK): A fresh, random ML-DSA-65 key pair generated every 24 hours. It is certified by the IK and used to sign handshake transcripts. Compromise of the IK does not retroactively compromise past EAKs.
- Session Key (SK): Derived per-connection via a hybrid key exchange (X25519 + ML-KEM-768) using the TLS 1.3 key schedule.
Transparency Log: A domain-scoped, append-only Merkle tree log (SHA3-384 hashed) records key publications and rotations. Trust is established via Witness Cosigning: a quorum of 5 out of 7 independent "Trust Witnesses" must cosign the Signed Tree Head (STH) for a log entry to be accepted. This prevents equivocation.
Handshake: The protocol follows the TLS 1.3 single-round-trip (1-RTT) shape. The server signs the handshake transcript with the current EAK. The client verifies the chain: DNSSEC commitment $\to$ IK signature on EAK $\to$ EAK signature on transcript $\to$ Log inclusion proof.
Key Rotation:
- Normal Rotation: Performed by the IK holder using dual ML-DSA-65 signatures (old and new keys), maintaining post-quantum security.
- Recovery Rotation: Triggered if the IK is lost. It utilizes a FROST-Schnorr threshold signing ceremony among recovery peers. The authors explicitly note this path is classical-only and not post-quantum secure, pending future lattice-based threshold signature standardization.

Key Contributions
The paper claims five primary contributions:

C1: A formally analyzed, CA-free browser trust protocol that addresses the four failure modes of DANE (DNSSEC dependency, lack of transparency, no recovery, no PQ readiness) using post-quantum cryptography for both authentication and key establishment.
C2: A three-layer key hierarchy that decouples long-term identity from ephemeral session material, enabling automatic, sub-day credential rotation without CA intervention.
C3: A dual rotation mechanism separating normal PQ-secure rotations from classical recovery rotations, enforced by witness cosigning and mandatory waiting periods to prevent silent key theft.
C4: The first complete post-quantum web trust model, combining ML-DSA-65 for identity signing and X25519/ML-KEM-768 hybrid key exchange.
C5: A formal threat model with ten adversary classes and seven security theorems proven via reduction to standard hardness assumptions (ML-DSA-65 EUF-CMA, ML-KEM-768 IND-CCA2, etc.).

Results and Performance
The authors implemented a proof-of-concept in Go 1.24 and conducted benchmarks against classical TLS 1.3 and PQ-TLS 1.3 (with classical certificates).

Handshake Size: The "warm path" (cached identity) requires approximately 6 KB, comparable to classical TLS 1.3 (~~5.6 KB) and roughly 50% smaller than PQ-TLS 1.3 with classical certificates (~~12 KB).
Cold Path: The first-contact handshake is larger (~34 KB) due to the fetch of identity objects and witness verification, but this cost is amortized over the 24-hour epoch.
Operational Overhead: DIT eliminates annual certificate renewals entirely (0 renewals/year for 1,000 domains vs. ~8,000 under the 47-day mandate).
Log Storage: A domain-scoped log is estimated to require ~10 GB/year (using hash-only leaves), significantly less than the ~750 GB/year required for global CT logs.

Significance and Claims
The paper argues that DIT demonstrates that CA independence is achievable with performance characteristics comparable to classical TLS 1.3. By shifting trust from a centralized CA hierarchy to a DNS-anchored, witness-audited transparency log, the protocol eliminates the single point of failure inherent in the current PKI.

The authors are modest regarding limitations:

DNSSEC Dependency: DIT requires DNSSEC validation, which is currently deployed on only ~4–5% of .com/.net domains.
First-Visit Vulnerability: Like any system without a global out-of-band trust root, DIT cannot independently verify if a newly published identity is the historically legitimate one for a domain (the "first-visit" discovery problem), though it mitigates this via audit windows and log observability.
Recovery Path: The key recovery mechanism relies on classical FROST-Schnorr signatures and is explicitly not claimed to be post-quantum secure.

The paper concludes that while DIT introduces architectural complexity, it offers a viable path to a trustworthy web that is resilient to both CA compromise and quantum computing threats, provided the underlying DNSSEC infrastructure matures.