Crypto-Agility Is Not Marketing — Why We're Already Post-Quantum-Ready in 2026

Quantum computing breaks Ed25519 in the 2030s. The standards bodies have already chosen the replacement. Nexbid's signed cart-mandates carry both signatures from day one.

Quantum-resistant cryptography is the kind of topic that produces two equally lazy responses. The first lazy response: "It's a 2030s problem, ignore it." The second lazy response: "We're quantum-ready" splashed across a marketing page with no implementation behind it. Both are wrong. The honest position is crypto-agility — the engineering discipline of being able to swap your cryptographic primitives without rewriting your protocol. Nexbid's signed cart-mandates carry both Ed25519 and ML-DSA-65 signatures from day one. This blog post explains why that decision is in production code today, what it costs, and what it buys. The thing nobody wants to say about Ed25519 Ed25519 is the dominant signature scheme in open agentic commerce. Cart-mandates, agent-cards, MCP-protocol envelopes — all of them sign with Ed25519. The scheme is fast (microseconds per signature), small (64-byte signatures, 32-byte keys), well-audited, and supported in essentially every modern crypto library. It is also broken in polynomial time by Shor's algorithm on a sufficiently large quantum computer. The phrase "sufficiently large" is doing the work in that sentence. Estimates from Google's quantum hardware team and ID Quantique's threat models converge on a window that opens somewhere between 2028 and 2034 for the first cryptographically-relevant quantum machines. That window matters less than it sounds. The threat model is not "quantum computer cracks signature on day X." The threat model is harvest-now, decrypt-later: an adversary captures signed mandates today and verifies-or-forges them once quantum becomes available. For a payment authorization that lives for hours, this is irrelevant. For an authorization mandate that establishes ongoing buying authority for an agent — increasingly common in subscription, enterprise procurement, and cart-coverage flows — the harvest window is real. What NIST actually picked NIST's Post-Quantum Cryptography (PQC) standardisation finished in 2024 with three winning signature schemes. The pragmatic choice for agentic commerce is ML-DSA-65 (formerly known as Dilithium-3) — Module-Lattice-based Digital Signature Algorithm. Trade-offs vs Ed25519: Signature size: ML-DSA-65 produces 3'309-byte signatures vs Ed25519's 64 bytes. About 50× larger. Key size: 1'952-byte public keys vs 32. About 60× larger. Verification speed: ~3× slower than Ed25519 on commodity x86. Library maturity: production-grade implementations exist (PQ-CRYSTALS, AWS-LC, BoringSSL); ecosystem coverage is partial but improving. Quantum resistance: presumed secure against quantum and classical attacks for the next several decades. The cost is real. A signed mandate envelope balloons from sub-100 bytes to multi-kilobyte. Network transit, storage, and verification CPU all increase. For a high-volume auction layer …

Author

Holger von Ellerts

Published

2026-04-29

Topics

Security, Verification, Protocol Commerce