Why Post-Quantum Cryptography Matters for AI Now

Post-quantum cryptography matters for artificial intelligence now because the signatures and audit records your systems produce today are meant to be trusted for years, and a patient adversary can capture signed or encrypted material now to break it later, once a cryptographically relevant quantum computer exists. This is not a problem you get to defer to the decade in which such a machine is announced. The choice of what you sign with, and how, is being made every time a record is written. I built the Open Audit Record inside our British Sovereign Intelligence Operating System (SIOS) on that assumption, which is why its signatures use a post-quantum scheme from the day they are created.

• Harvest now, decrypt later: adversaries can store signed or encrypted data today and attack it once quantum hardware matures.
• AI audit records are long-lived: a decision trail written this year may need to hold up in a dispute or regulatory review many years from now.
• Classical signature schemes such as RSA, ECDSA and Ed25519 are the ones a large quantum computer is expected to break first.
• FIPS 204 standardises ML-DSA, a lattice-based digital signature designed to resist both classical and quantum attack.
• We chose ML-DSA-65 for the Open Audit Record so its provenance stays verifiable, fully offline, long after the hardware landscape changes.

The threat is about timing, not a future gadget

The usual mistake is to treat quantum risk as something that switches on the day a working machine is announced. The real exposure begins much earlier. An adversary who can intercept and store traffic, or who obtains a copy of your signed archives, does not need a quantum computer today. They need one eventually. Everything they harvest now sits waiting. This is the harvest-now-decrypt-later posture, and it is already a rational strategy for a well-resourced actor.

That reframes the decision. If material you produce today must remain confidential or verifiable for five, ten or fifteen years, then the relevant question is not whether quantum computers exist yet. It is whether they will exist within the lifetime of the thing you are protecting. For a great deal of what an AI system records, the honest answer is that we cannot rule it out.

Why AI makes the record outlast the model

Models are replaced constantly. The evidence of what a model did tends to outlive it. When an AI system takes a decision that affects a person, a contract or a regulated process, the record of that decision can be called on long after the model that made it has been retired. A lending decision, a medical triage suggestion, a document classification in a sensitive context: each may need to be reconstructed and defended years later.

That longevity is exactly what makes the signature choice load-bearing. A provenance record is only as trustworthy as the signature that anchors it. If that signature can be forged in eight years, then in eight years the record proves nothing. Building long-lived AI accountability on a signature scheme with a known expiry date is a quiet way of writing evidence that dissolves on a schedule.

What FIPS 204 and ML-DSA-65 actually are

FIPS 204 is the United States federal standard, published by NIST in 2024, for a post-quantum digital signature algorithm. It specifies ML-DSA, the Module-Lattice-Based Digital Signature Algorithm, derived from the CRYSTALS-Dilithium submission to the NIST post-quantum project. Its security rests on the hardness of lattice problems, which are not known to fall to the quantum algorithms that break RSA and elliptic-curve schemes.

ML-DSA is defined at three parameter strengths. ML-DSA-65 is the middle set, targeting a security level broadly comparable to AES-192. I chose the middle set deliberately: it carries a substantial safety margin without the largest signatures, which matters when you are signing a high volume of audit checkpoints and keeping them offline.

Why we chose it for the Open Audit Record

The Open Audit Record, or OAR, is the tamper-evident ledger inside SIOS. It is an append-only, hash-chained record whose integrity is anchored by signed checkpoints held off-box, so any alteration or rollback of recorded history is cryptographically detectable, fully offline. The signature over those checkpoints is the part that has to survive time, so it is the part that must be post-quantum.

By signing checkpoints with ML-DSA-65, a verifier can confirm, years later and with no network connection, that a chain of AI activity has not been rewritten. The verification runs on the published standard, not on trust in us. This is deliberately narrow. We patent the mechanism, not the model, and I would rather describe the guarantee precisely than inflate it: the OAR is tamper-evident, not tamper-proof, and its strength is that alteration becomes detectable rather than impossible.

Why the decision has to be made now

Migrating cryptography is slow. Standards bodies and national agencies have been explicit that organisations should begin the move to post-quantum schemes well ahead of any machine that would justify a panic. The reason is that you cannot retrospectively protect data already signed with a scheme that later breaks. If a record was signed with a classical algorithm in 2026 and that algorithm is broken in 2034, the 2026 record was exposed the whole time to anyone who kept a copy.

So the defensible position is to sign with a post-quantum scheme from the first record, not to bolt one on once the threat is undeniable. That is why SIOS does not treat this as a roadmap item. The signatures are post-quantum today, on records being written today.

The honest boundary

Post-quantum signatures do not make an audit record unbreakable, and I will not claim they do. An attacker with write access to the machine can still delete the ledger file or refuse to run the verifier. What they cannot do is silently rewrite history and have the signed checkpoint still verify, because they do not hold the signing key and cannot forge a checkpoint over a chain they have altered. Destruction and refusal are conspicuous. Silent alteration is the thing we close off.

I have set out the reasoning behind this choice in more depth in technical preprints on Zenodo, including work on post-quantum-signed provenance and hardware-bound entitlement, published under my ORCID. The point of writing them down is the same as the point of the OAR itself: claims about security should be checkable, not merely asserted.

Frequently asked questions

What is harvest-now-decrypt-later?

It is the strategy of capturing signed or encrypted material today and storing it until a future quantum computer can break the cryptography protecting it. It makes quantum risk a present concern for any data that must stay confidential or verifiable for years.

Is a quantum computer that breaks today's cryptography available now?

No public evidence suggests a cryptographically relevant quantum computer exists yet. The risk is not that one exists today. It is that one may exist within the useful life of records you are creating now, which is why the migration is being urged well in advance.

Why ML-DSA-65 rather than a stronger or weaker parameter set?

ML-DSA-65 is the middle parameter set of FIPS 204, with a comfortable security margin and more manageable signature sizes than the highest set. For signing a high volume of offline audit checkpoints, that balance is the right one.

Does post-quantum signing make the Open Audit Record tamper-proof?

No. The OAR is tamper-evident, not tamper-proof. A post-quantum signature over off-box checkpoints means any rewriting of recorded history is cryptographically detectable offline. An attacker can still destroy the file or refuse to verify, but they cannot alter history silently.

Do I need an internet connection to verify a record?

No. Verification uses the published standard and the signed checkpoint, so it runs fully offline. That is essential for sovereign deployments where the system is expected to operate with no external connectivity at all.

Where can I read the underlying reasoning?

I have published technical preprints on Zenodo under ORCID 0009-0000-5511-5858 covering post-quantum-signed provenance and related mechanisms. The closed beta of SIOS is open at mickai.co.uk/beta, where we are onboarding design partners.