Two Locks, Not One: The Case for Hybrid Post-Quantum Security

There's a clean, satisfying story about the quantum transition that goes like this: the old cryptography is about to break, so tear it out and replace it with the new post-quantum kind. One algorithm out, one algorithm in. Done.

It's a tidy story. It's also the riskier one.

The stronger move — the one we made when we built QuantumShield — is less satisfying to explain at a party but far easier to defend in a security review. You don't replace the old lock with the new lock. You fit both, and you require both to open the door. That's what hybrid means, and it's the difference between hedging the quantum transition and gambling on it.

The honest problem with going all-in on post-quantum

Post-quantum algorithms are strong on paper. ML-DSA, the signature scheme NIST standardized in FIPS 204, is the product of years of public analysis and is the right foundation to build on. We use it. The issue isn't the math — it's the mileage.

Classical schemes like ECDSA and RSA have been hammered on by the entire cryptographic world for decades. Every clever attack anyone could think of has been thrown at them, and they're still standing. That kind of sustained, failed assault is its own form of evidence. Post-quantum schemes simply haven't had that yet. They're young, and young cryptography occasionally surprises you.

It already has. In 2022, a scheme called SIKE was a NIST finalist — a serious contender to protect the world's secrets for decades. Then two researchers broke it on a single ordinary computer in about an hour. The same year, another finalist family, Rainbow, fell to an attack that ran over a weekend on a laptop. These weren't fringe candidates. They were on the shortlist. The lesson isn't that post-quantum cryptography is bad — it's that “passed review” and “survived a decade of real-world attack” are not the same sentence, and you find out which one you have at the worst possible moment.

So here's the uncomfortable question a pure post-quantum system has to answer: what happens the day someone finds a weakness in your one and only algorithm? On an all-post-quantum stack, the answer is nothing good. There's nothing underneath.

What hybrid actually does

A hybrid signature is signed twice — once with a battle-tested classical scheme, once with a post-quantum scheme like ML-DSA-65 — and verification requires both to check out. Not either. Both.

That one design choice changes everything about your risk profile, because now an attacker has to defeat two unrelated kinds of mathematics to forge anything:

• A quantum computer eventually breaks the classical half? The post-quantum signature is still there, and quantum computers don't help against it. You're covered.
• A clever researcher dents the post-quantum half tomorrow — a SIKE moment? The classical signature is still there, and it has fifty years of failed attacks behind it. You're covered.

You only lose if both break at the same time, by unrelated methods — and the whole point is that classical and lattice-based cryptography rest on completely different hard problems. A breakthrough against one tells you almost nothing about the other. Hybrid doesn't ask you to predict which algorithm survives. It lets you stop predicting.

This is the part worth sitting with: hybrid never trades a known-good guarantee for an unproven one. It adds the unproven one on top of the proven one. You keep everything you already had, and you gain quantum resistance. The downside case is “we were over-protected.” That's the good kind of wrong to be.

This is not a contrarian take

If hybrid sounds like belt-and-suspenders caution, that's because it is — and the most serious institutions in the field have landed in exactly the same place.

Germany's BSI and France's ANSSI, two of Europe's national cybersecurity authorities, both recommend hybrid constructions through the migration period rather than jumping straight to post-quantum-only. And this isn't just on paper: the post-quantum encryption already shipping in your web browser today is hybrid. When Chrome and others turned on quantum-resistant connections, they didn't drop classical key exchange — they paired the classical X25519 with the post-quantum ML-KEM, and required both. The browser on your screen is running the same logic we're describing here.

When the people standardizing the algorithms, the agencies advising governments, and the engineers securing the entire web all reach for hybrid during the transition, “just replace the old one” stops looking bold and starts looking premature.

The cost is small. The insurance is large.

The honest tradeoff: a hybrid signature is a bit larger, and verifying two signatures takes slightly more compute than verifying one. That's the entire bill.

Set that against what it buys — protection against every attacker that exists today and the quantum attacker that doesn't exist yet, with no single point of cryptographic failure — and it's one of the better deals in security engineering. Slightly bigger payloads are a rounding error. Being wrong about a five-year-old assumption is not.

Why QuantumShield is hybrid by design

SchnelPay is built on a simple promise: your crypto goes straight to your own wallet, and the layer that proves who you are and authorizes what you do is built to outlast the quantum era. QuantumShield is how we keep the second half of that promise.

It signs with a hybrid construction — a proven classical signature alongside ML-DSA-65 (FIPS 204) — and it requires both to verify. There is no downgrade path, no “either one is fine” fallback, no quiet way to strip the strong signature and slip through on the weak one. Both, or nothing.

We could have picked one algorithm and called it quantum-safe. It would have made for a cleaner headline. But the entire reason to take the quantum threat seriously is that you don't want to be caught betting everything on an assumption that turns out to be wrong. A system that hedges that exact risk shouldn't have a single point of failure sitting at the bottom of it.

And hybrid itself isn't permanent — nothing in cryptography is. The day post-quantum schemes have earned the decades of scrutiny classical ones have now, and quantum computers have turned the classical half into dead weight, that second lock gets swapped for another post-quantum one built on different mathematics. You never drop to a single lock. The locks change; the principle of two doesn't.

Two locks. One door. Both have to open. That's not the flashy version of post-quantum security — it's the version still standing the day one of the algorithms surprises everyone.