On hybrid signatures
In post-quantum cryptography, hybrid key agreement schemes such as X-Wing mitigate the risk that either the classical or the post-quantum scheme is compromised.
In contrast, Sophie Schmieg argues against hybrid signature schemes for several reasons. This one stood out to me:
When it comes to key agreement, or more generally encryption schemes, your vulnerability begins when you create a ciphertext, and ends, well, never really. […]
For signatures on the other hand, your vulnerability begins and ends with your verifier starting and stopping to trust the public key. The bad news is that you don’t even need to create a signature to be potentially vulnerable, the good news is that your window of vulnerability is extremely finite. And even better yet: We have some methods to end the window of vulnerability early, by revoking the public key in question.
Applications requiring long-term validity can address algorithm transitions at the protocol level, for example through signature preservation services.
Aside from the article’s main point, I’m not yet convinced by this statement for practical applications:
Where encryption keys are often ephemeral, there is no use case that would require an ephemeral signing key, that would not be better served with a cryptographic hash instead. After all, conceptually a signature scheme moves authentic channels through time, by using an existing authentic channel to transfer a public key which then can be used in the future to create a new authentic channel. If the channels existed at the same time, transfering a hash in the authentic channel would serve the same purpose.
For example, EU trust services and Sigstore commonly certify just-in-time, single-use signing keys, enabling separation of roles and maintaining compatibility with policies designed for long-lived certificates. Then again, maybe it’s just terminology: compared with ephemeral encryption keys, even a 10-minute certificate validity window is long-lived.