Can ECDSA signature signing and verification process replaces password hashed based login system?

The title of this question won't be exactly right.

This is a question that I asked long time ago. I would like to ask does the same application or the underlying mechanism still applicable or is still consider secure when using standardized PQC algorithms that have go through a lot of cryptanalysis?

In such a case, is there a need to really consider a hybrid approach whereby using ED25519,448 along with PQC digital signature algorithms? If an hybrid approach was required, is there any proper ways to do it and what's the recommended PQC algorithms?

  • 1
    $\begingroup$ The question asks if current Post-Quantum signature schemes can be trusted (in an application where it's signed a challenge for authentication purposes), or if it's needed to additionally use a standard signature scheme (and then how). This contains the view of French security authorities. In a nutshell, they recommend "hybridation" at least till 2030. $\endgroup$
    – fgrieu
    May 23, 2023 at 14:37
  • $\begingroup$ Check out this blog post for the controversy around hybrid and how to do it. As for recommended algorithms, have a read of the NIST PQC competition publications/results and the BSI recommendations alongside ANSSI. $\endgroup$ May 23, 2023 at 15:09


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.