Signed Twice, Broken Never: The Rise of Hybrid PKI

Signed Twice, Broken Never: The Rise of Hybrid PKI

Speakers: Ganesh Mallaya, Appux

Conference: BSides Seattle 2026

YouTube: https://www.youtube.com/watch?v=jKE06DJ5vNs

Overview

Ganesh Mallaya, who works at Appux and contributes to the CA/Browser Forum and IETF standards bodies on post-quantum cryptography signature standards, delivered a dense technical briefing on why and how organizations should begin transitioning their PKI infrastructure to hybrid (composite) certificates that combine classical and post-quantum algorithms. The talk addresses the dual threat vectors of Harvest Now, Decrypt Later (targeting confidentiality) and the less-discussed Trust Now, Forge Later (targeting certificate integrity and authenticity).

The core argument is that full post-quantum cryptography (PQC) adoption is not viable today due to certificate size constraints that break TCP performance, but doing nothing creates unacceptable risk as RSA and elliptic curve algorithms face deprecation by 2030-2035. Hybrid composite certificates — carrying both a classical signature (RSA or ECC) and a PQC signature (ML-DSA) in a single certificate — provide a migration bridge that maintains backward compatibility while adding quantum-resistant protection.

This is not theoretical. Mallaya presented test results from Cloudflare and Google labs, reported that approximately 60% of internet traffic already uses TLS 1.3 with hybrid key exchange (ML-KEM + X25519) as of January 2026, and noted that two FAANG companies and two of three major US telecoms (one based in Seattle) are running pilot implementations.

Background

▶ Watch: Harvest Now Decrypt Later vs Trust Now Forge Later threat vectors (0:00)

The urgency for PQC migration is driven by converging regulatory mandates. CNSA 2.0 specifies which enterprise systems must transition to PQC-ready states by specific years. NIST, CISA, the European Union, and India's government have all published adoption timelines. ABI Research surveys show the hybridization adoption curve rising sharply through 2034-2035.

The certificate lifecycle itself is under pressure independent of PQC. The CA/Browser Forum has mandated reducing certificate validity from 398 days down to 47 days by the end of 2029, with the first reduction to 200 days starting March 16, 2026. This eliminates manual certificate management as a viable approach and makes automated, repeatable deployment processes essential.

Mallaya cited that 63% of Fortune 100-500 CISOs now consider PKI modernization a board-level topic, driven by the convergence of PQC migration, shortened certificate lifetimes, and the expanding role of certificates in identity management (mTLS, VPNs, ZScaler, user authentication). The identity and certificate space has evolved more in the last two and a half years than in the preceding decade.

Key Findings

▶ Watch: Regulatory mandates: CNSA 2.0, NIST, CISA timelines (4:00)

The central technical finding comes from testing composite certificates in Cloudflare and Google labs:

• Classical RSA baseline: Certificate chain is approximately 1,664 bytes (61,664 bytes cited for full chain context)
• Full PQC chain (ML-DSA-87): 13x larger than classical RSA, with key sizes starting around 16,000 bytes
• Composite (hybrid) certificates (ML-DSA-65 + RSA): 8-9x larger than RSA, but 30% smaller than full PQC chains
• TCP segment tipping point: Performance degradation begins at approximately 11KB; full PQC exceeds this at 11-11.5 TCP segments, while composite stays under at approximately 8 segments
• Composite certificates reduced overall transaction size by 30% compared to full PQC while maintaining quantum-resistant protection

The composite signature approach works through concatenation of classical and PQC signatures into a single signature field within the certificate, without fundamentally altering how the TLS handshake processes signature verification. This is defined in an active IETF draft on composite signatures.

Google's announcement of Merkle Tree certificates was cited as a parallel approach to modernizing web PKI using hybrid principles, also based on an IETF draft.

Technical Deep Dive

▶ Watch: Composite certificates explained: dual signatures in one cert (12:00)

The fundamental constraint driving hybrid adoption is that TLS 1.2 cannot handle PQC and TLS 1.3, while required for full PQC, is supported by only a fraction of the internet's application infrastructure. Composite certificates solve this by allowing the hybrid signature to function over TLS 1.2, giving organizations a runway to upgrade to TLS 1.3 by the 2030-2035 deprecation window.

The composite signature mechanism concatenates the classical algorithm (RSA-2048 or ECC) and the PQC algorithm (FIPS 203/204/205 approved, specifically ML-DSA-65 or ML-DSA-87) into a single signature. Because the concatenation process creates a unified signature rather than two separate signatures, the resulting key length is smaller than simply adding two independent signatures together. This was confirmed during the Q&A when an audience member asked how a double-signed key could be smaller than a standalone quantum key.

The TLS handshake currently understands only one signature per certificate. The composite approach maintains this single-signature model from the handshake's perspective, requiring only application-layer changes to parse the composite signature internally. This means existing Apache applications running login pages, for example, can adopt composite certificates without rewriting code for backward compatibility, though TLS 1.2 remains a temporary requirement.

Bandwidth consumption analysis showed the composite approach is particularly relevant for the telecom sector, where bandwidth efficiency directly impacts infrastructure costs. The IETF working group PENS (PKI and certificate transparency) is the active forum for these standards.

The four implementation pillars are: (1) Inventory all certificates, starting with internal PKI; (2) begin pilot implementations using signatures already available in crypto libraries and registered in IANA databases; (3) modernize CPS/CP standards that are currently outdated for AI and PQC threats; and (4) approach migration as a transition with backward compatibility baked into the platform, not a lift-and-shift.

Demo / Proof of Concept

▶ Watch: TLS handshake performance: classical vs PQC vs composite (16:00)

While no live demo was performed during the talk, Mallaya referenced concrete lab testing conducted in partnership with Cloudflare and Google. The tests involved basic login pages loaded in Google Chrome using classical, full PQC, and composite certificates. Full PQC certificates caused pages to take significantly longer to load due to TCP segment fragmentation, while composite certificates maintained acceptable performance. GitHub repositories containing composite signature implementations are publicly available. Two FAANG companies and two of three major US telecoms are running pilot-stage implementations.

Defensive Implications

▶ Watch: Four pillars of implementation and crypto agility (24:00)

The implications for security leaders are immediate and strategic. Organizations should begin with a certificate inventory across internal and web-facing PKI. The shortened validity timeline (47-day certificates by 2029) means automation of certificate lifecycle management is a prerequisite, not an enhancement.

The hybrid model is explicitly a migration bridge, not an end state. Organizations should plan for eventual full PQC adoption on TLS 1.3 while using composite certificates to protect against harvest-now-decrypt-later and trust-now-forge-later attacks during the transition. The backward compatibility property means this protection can be added without rearchitecting existing applications.

Crypto agility is the strategic goal: designing systems so that cryptographic algorithms can be swapped without rebuilding infrastructure. Mallaya emphasized this is a milestone, not a destination, since future threats beyond PQC (potentially AI-driven) may require further transitions.

Key Takeaways

• Trust Now, Forge Later is the PKI-specific quantum threat: adversaries collecting certificates today could forge identities once quantum computers can break classical signatures
• 60% of internet traffic already uses TLS 1.3 with hybrid key exchange (ML-KEM + X25519) as of January 2026
• Composite certificates carrying both RSA/ECC and ML-DSA signatures reduce PQC overhead by 30% while maintaining backward compatibility on TLS 1.2
• Certificate validity is shrinking to 47 days by 2029, making automated lifecycle management a hard requirement
• 63% of Fortune 100-500 CISOs consider PKI modernization a board-level topic
• Crypto agility (designing for swappable algorithms) is the strategic destination, with hybrid adoption as the first milestone

About the Speaker(s)

Ganesh Mallaya works at Appux and is actively involved in the CA/Browser Forum (which sets mandates for certificate authorities and browsers) and the IETF (which defines signature and PKI standards). His day-to-day work focuses on modernizing PQC standards for signatures, and he has contributed to testing composite certificates in collaboration with Cloudflare and Google labs. He works closely with NIST and various international standards bodies on the hybridization roadmap.