Post-Quantum Model Signing & Crypto Hardening
Objective
Future-proof model supply chain against quantum attack.
Control / requirement
PQC signing (ML-DSA/SLH-DSA) + PQC key exchange (ML-KEM).
Business impact
Failure to implement this control creates risk of model signature forgery via quantum computers within 5-10 years, with estimated long-term financial exposure of $10M-$100M for model IP and supply chain integrity.
Validation approach
Test ID: D1-CTL-06-VTS-001 Test Type: Automated Test Design: Attempt to verify model signature using RSA-2048 while quantum-safe algorithm is available; test TLS downgrade to pre-quantum cipher suite Execution Steps: 1. Generate model signature using legacy RSA-2048 2. Attempt verification with PQC-enabled verifier 3. Test TLS connection: nmap --script ssl-enum-ciphers -p 443 [endpoint] 4. Verify PQC key exchange (ML-KEM) is preferred Pass Criteria: legacy_rsa_signature_rejected = True; tls_downgrade_blocked = True; pqc_key_exchange_enabled = True Independent Verification: Auditor runs NIST PQC validation suite against organisation's model signing infrastructure.
Expected evidence
Not separately specified in the available source.
Mapping and source
Not separately specified in the available source.
Implementation guidance
Translate the requirement into system-specific procedures, responsible roles, technical configurations and review conditions. Retain evidence showing both design and operating performance. Where the source provides no separate implementation instruction, do not infer that a single technical mechanism is sufficient.
Assessment considerations
- Confirm scope and applicability.
- Inspect control design and responsible ownership.
- Test representative operation and adverse conditions where appropriate.
- Evaluate evidence provenance, completeness and contradictory evidence.
- Record limitations and notably absent outcomes.