Why must signature schemes be migratable when cryptographic assumptions may change?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session generates signed records, attestations, or identity proofs that may need to remain verifiable for years or decades, and the underlying cryptographic assumptions (RSA hardness, discrete log, post-quantum) may weaken or be broken during the validity window. Does not apply to strictly ephemeral signatures that expire before cryptographic assumptions change, or to signatures whose verification is not a long-term requirement.

Core Distinction

The separation between **signature validity today** (the signature verifies under current cryptographic assumptions) and **signature validity tomorrow** (the signature will still verify after the underlying cryptographic assumption weakens or breaks). Relying on today's validity creates the **Quantum-Break Retroactive Forgery**: a signature generated under RSA or ECDSA today becomes forgeable in the future when the underlying mathematical problem is solved (e.g., by a quantum computer), and any party with access to the record can forge the signature retroactively.

What Was Observed

In long-retention agent architectures, failing to plan for cryptographic migration produces three primary failure modes:

  1. **Retroactive Forgery:** A 20-year-old signed contract verifies today. A quantum computer is built in 15 years, and an attacker forges the same contract with a backdated signature that now verifies.
  2. **Verification Collapse:** The signature scheme's parameters become disallowed by regulation or industry standard (e.g., SHA-1 deprecation), and legacy signatures can no longer be verified under current policy.
  3. **Migration Invalidation:** The signature scheme is upgraded, but the migration process is not designed (no re-signing pathway), so legacy records cannot be migrated to the new scheme without losing trust.

Recorded Elements

  1. **`signature_scheme_identifier`:** The exact algorithm, parameter set, and cryptographic assumption under which each signature was generated (e.g., "ECDSA-P256-SHA256 with quantum-resistance = none").
  2. **`assumption_strength_receipt`:** A cryptographic or expert attestation of the assumption's current strength (e.g., "RSA-2048 expected secure until 2030 per NIST"), timestamped to allow decay modeling.
  3. **`migration_path_signature`:** A cryptographic proof that the record includes a documented migration path (e.g., a hybrid signature, or a re-signing envelope), ensuring the record can be upgraded if the assumption breaks.
  4. **`hybrid_signature_receipt`:** For records that use hybrid signatures (classical + post-quantum), the receipt proving both schemes are applied, so breaking one does not break the record.

Condition of Validity

* **Applies when:** The signed record must remain verifiable for a time window during which cryptographic assumptions may weaken. * **Does not apply when:** The signature is strictly ephemeral (expires within the assumption's expected lifetime), or the record's trust does not depend on cryptographic assumptions holding over time.

Decision Boundary

  1. **Does the record have a long retention requirement?** If no, standard signing applies. If yes, proceed.
  2. **Does the record's signature scheme have documented assumption strength and expected validity window?** If no, the agent cannot plan migration. It must add assumption documentation.
  3. **Is the record's validity window shorter than the assumption's expected strength window?** If yes, current scheme is sufficient. If no, the record must use hybrid signatures or have a documented migration path.
  4. **Conversely, when can the agent skip migration planning?** Only when the record's retention window is shorter than the assumption's expected lifetime AND no regulatory or contractual requirement forces migration.

Operational Effect

  1. **Retroactive Forgery Prevention:** Hybrid signatures ensure that breaking one assumption does not retroactively invalidate records.
  2. **Migration Enablement:** Documented migration paths allow the agent (or its successors) to upgrade records when assumptions weaken.
  3. **Assumption Decay Modeling:** Explicit strength receipts allow the agent to schedule migration before the assumption breaks.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class MigrationVerdict(Enum):
    SHORT_RETENTION_SAFE = auto()
    CURRENT_SCHEME_SUFFICIENT = auto()
    MIGRATION_REQUIRED = auto()
    HYBRID_PROTECTED = auto()

@dataclass(frozen=True)
class SignatureRecord:
    record_id: str
    signature_scheme: str
    assumption_validity_epoch: float
    retention_required_until_epoch: float
    migration_path_documented: bool
    hybrid_signature_present: bool

@dataclass(frozen=True)
class MigrationPolicy:
    current_epoch: float
    require_hybrid_for_long_retention: bool

@dataclass(frozen=True)
class MigrationManifest:
    verdict: MigrationVerdict
    directive: str
    manifest_digest: str

class SignatureMigrationGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_record(
        cls, record: SignatureRecord, policy: MigrationPolicy
    ) -> MigrationManifest:
        
        # Gate 1: Short retention
        if record.retention_required_until_epoch <= policy.current_epoch:
            digest = cls._hash(json.dumps({
                "record": record.record_id,
                "retention": f"{record.retention_required_until_epoch:.0f}",
                "status": "EXPIRED"
            }, sort_keys=True))
            return MigrationManifest(
                verdict=MigrationVerdict.SHORT_RETENTION_SAFE,
                directive="PROCEED: Retention window ended, no long-term concern.",
                manifest_digest=digest
            )

        # Gate 2: Hybrid protection
        if record.hybrid_signature_present:
            digest = cls._hash(json.dumps({
                "record": record.record_id,
                "scheme": record.signature_scheme,
                "hybrid": "TRUE"
            }, sort_keys=True))
            return MigrationManifest(
                verdict=MigrationVerdict.HYBRID_PROTECTED,
                directive="PROCEED: Hybrid signature protects against single-assumption break.",
                manifest_digest=digest
            )

        # Gate 3: Assumption outlives retention
        if record.assumption_validity_epoch >= record.retention_required_until_epoch:
            digest = cls._hash(json.dumps({
                "record": record.record_id,
                "assumption_valid": f"{record.assumption_validity_epoch:.0f}",
                "retention": f"{record.retention_required_until_epoch:.0f}"
            }, sort_keys=True))
            return MigrationManifest(
                verdict=MigrationVerdict.CURRENT_SCHEME_SUFFICIENT,
                directive=f"PROCEED: Assumption valid until {record.assumption_validity_epoch:.0f}, retention ends {record.retention_required_until_epoch:.0f}.",
                manifest_digest=digest
            )

        # Gate 4: Migration required
        if record.migration_path_documented:
            digest = cls._hash(json.dumps({
                "record": record.record_id,
                "scheme": record.signature_scheme,
                "migration": "DOCUMENTED"
            }, sort_keys=True))
            return MigrationManifest(
                verdict=MigrationVerdict.MIGRATION_REQUIRED,
                directive=f"ACTION: Migrate record before {record.assumption_validity_epoch:.0f}. Migration path documented.",
                manifest_digest=digest
            )

        return MigrationManifest(
            verdict=MigrationVerdict.MIGRATION_REQUIRED,
            directive=f"HALT: Assumption expires before retention. No migration path. Escalate.",
            manifest_digest=cls._hash(f"NO_PATH:{record.record_id}")
        )