Technical Summary: Binding PQC to Copyleft via QGPL and Evaluating Quantum-Safe Distribution Integrity

1. Problem Statement

The transition to post-quantum cryptography (PQC) is typically framed as a confidentiality issue ("harvest now, decrypt later"). However, the paper identifies a structurally identical but less discussed threat to integrity and authenticity. Classical public-key signature schemes (e.g., RSA, ECDSA, EdDSA) rely on integer factorization or discrete logarithms, which are vulnerable to Shor's algorithm on a future cryptographically relevant quantum computer (CRQC).

For open science and long-term archival, this creates a critical temporal mismatch: research artifacts are often preserved for decades, exceeding the security horizon of the classical signatures used to protect them at release. If a classical signature becomes forgeable, an adversary can substitute an artifact and generate a valid signature, allowing the tampered data to pass verification even after the original distribution environment is gone. Existing supply-chain systems (Sigstore, in-toto, SLSA) provide technical controls but do not bind these integrity requirements to redistribution licenses. Conversely, reciprocal licenses (e.g., GPLv3, CC BY-SA) govern redistribution but do not prescribe cryptographic metadata. This gap leaves long-lived scientific artifacts vulnerable to undetected substitution in a post-quantum future.

2. Methodology and System Design

The authors propose the Quantum General Public License (QGPL) v3.0, a legal-technical specification that makes post-quantum distribution integrity a condition of redistribution. The methodology combines a legal framework with a specific cryptographic compliance toolkit.

2.1 Legal-Technical Construction

• License Layer: The QGPL mandates that any covered modified work redistributed must include Quantum-Safe Distribution Metadata (QSDM). This creates a reciprocal propagation mechanism where the requirement for PQ integrity travels with the artifact through downstream derivatives.
• Technical Conformance Layer: The QSDM consists of a machine-verifiable manifest containing:
  1. Cryptographic digests of the artifacts.
  2. Signatures generated by approved PQ schemes.
  3. Public key material or references.
  4. Explicit algorithm and parameter identifiers.
  5. Issuer and key-state information.

2.2 Cryptographic Architecture

The compliance toolkit employs a two-tier offline-root trust model:

• Root Key: An offline, rarely used root key signs the keys.json document. The paper recommends SLH-DSA-SHA2-256s (stateless hash-based) for this role to provide assumption diversity and minimize exposure.
• Operational Signing Keys: Rotatable online keys sign the release manifests. The paper recommends ML-DSA-65 (Module-Lattice-Based) for routine signing due to performance.
• Hybrid Signatures: The system supports strictly additive hybrid signatures (e.g., ML-DSA-65 + Ed25519). Under the default policy, every component must verify. A classical component supplements but cannot replace the mandatory PQ component.
• Manifest Format: Manifests are JSON documents canonicalized using RFC 8785 (JCS) to ensure deterministic byte representation, preventing signature malleability.

2.3 Verification Protocol

Verification is designed to be offline-capable. A verifier requires only:

1. A pinned root fingerprint (obtained via an out-of-band channel).
2. The keys.json document (signed by the root).
3. The release manifest and artifacts.
   No continuous connection to a Certificate Authority (CA), transparency log, or identity provider is required at verification time. The verifier checks the root signature, validates the signing key's authorization and revocation status within keys.json, and verifies the PQ signature against the manifest.

3. Key Contributions

The paper makes four primary contributions:

1. Legal Specification: A definition of PQ distribution metadata as a mandatory condition of redistribution, applicable to downstream modified works.
2. Offline Trust Model: A key hierarchy supporting signing-key rotation and revocation without requiring a continuously reachable third-party trust service, relying instead on a pinned root fingerprint and cached keys.json.
3. Strictly Additive Hybrid Signatures: A construction where a classical component can supplement but never replace the required PQ component, ensuring that even if classical schemes are broken, the PQ component remains the security anchor.
4. Empirical Evaluation: A reproducible implementation (qgpl_ref) evaluating latency, metadata overhead, conformance, and archival recovery on commodity hardware.

4. Experimental Results

The authors evaluated the system on an Apple Silicon (ARM64) platform using NIST-standardized algorithms.

• Cryptographic Latency:
  • ML-DSA-65: Signs in 0.72 ms and verifies in 0.37 ms.
  • SLH-DSA-SHA2-256s (Root): Signs in 889.2 ms (justifying its use only for infrequent root operations) and verifies in 1.50 ms.
  • Hybrid (ML-DSA-65 + Ed25519): Adds 64 bytes to the signature size and increases the sign-verify path by <0.3 ms.
• Metadata Overhead:
  • For a single artifact, the fixed metadata overhead (manifest + signature + keys) is approximately 10.8 KiB for ML-DSA-65.
  • Relative overhead drops below 1% for artifacts larger than 1.06 MiB.
  • Aggregate Manifests: For 1,000 files, the amortized metadata cost per artifact is 148 bytes, demonstrating scalability for large datasets.
• Conformance and Recovery:
  • The verifier correctly classified all test cases, including valid releases, digest mismatches, corrupted signatures, revoked keys, and expired key states.
  • PQ-Only Recovery: In a scenario where the classical component of a hybrid signature was corrupted, the "PQ-only" verification mode successfully recovered the validity of the PQ component, allowing the artifact to be verified as post-quantum safe despite the loss of the classical signature.

5. Significance and Claims

The paper claims that license-propagated post-quantum integrity is practical for long-term scientific artifact distribution without centralized infrastructure.

• Practicality: The measured latencies and metadata sizes indicate that PQ signatures can be integrated into standard release pipelines with minimal performance impact, particularly when using aggregate manifests.
• Archival Viability: The offline-capable trust model ensures that artifacts can be verified decades later, even if the original signing infrastructure, CAs, or transparency logs cease to exist, provided the root fingerprint is preserved.
• Complementarity: The authors position QGPL as complementary to existing systems like Sigstore and SLSA. While those systems handle identity and build provenance, QGPL specifically addresses the long-horizon authenticity requirement by binding a quantum-resistant signature to the redistribution license itself.

Limitations and Scope:
The authors explicitly state that the work evaluates technical design and compliance overhead, not legal enforceability. The paper does not claim to prove the legal validity of the license conditions across all jurisdictions, nor does it establish that the root key was generated offline (this remains a procedural assumption). Furthermore, the current toolkit cannot cryptographically attest to the offline nature of the root key generation. The solution is presented as a design for open science where the mismatch between archival and cryptographic lifetimes is most pronounced.