DEV Community

Cover image for Hybrid Classical-Quantum Cryptography — What It Is and How quantum-audit Handles It
takundanashebmuchena-pixel
takundanashebmuchena-pixel

Posted on

Hybrid Classical-Quantum Cryptography — What It Is and How quantum-audit Handles It

#javascript #security #blockchain #cryptography

Hybrid Classical-Quantum Cryptography — What It Is and How quantum-audit Handles It

Part 4 of the quantum-audit series. Part 1 | Part 2 | Part 3

🌐 quantum-audit-site.vercel.app

After Part 1 dropped, a reader asked:

"How does quantum-audit handle hybrid classical-quantum systems? I'm curious if it can audit both types simultaneously."

This is the right question. And it's more nuanced than it looks.

What is a hybrid classical-quantum system?

A hybrid system uses both classical cryptography and post-quantum cryptography simultaneously — typically during a migration period.

The most common pattern looks like this:

// Classical signing (vulnerable to Shor's algorithm)
const classicalSig = secp256k1.sign(message, privateKey);

// Post-quantum signing (quantum-resistant)
const pqcSig = dilithium.sign(message, pqcPrivateKey);

// Send both — verifier checks both
const payload = { classicalSig, pqcSig, message };
Enter fullscreen mode Exit fullscreen mode

The idea: a verifier that understands both can validate the PQC signature. A legacy verifier that only understands ECDSA can still validate the classical one. You get backwards compatibility while adding quantum resistance.

This is called hybrid key encapsulation or hybrid signing and it's the approach recommended by NIST during the transition period.

Why hybrid instead of just switching?

Because the ecosystem doesn't switch overnight.

Consider Ethereum: wallets, nodes, smart contracts, hardware signers, exchanges — all rely on ECDSA/secp256k1. You can't flip a switch. Even if a new post-quantum standard is chosen tomorrow, the migration would take years.

Hybrid is the bridge. You add PQC without breaking existing systems.

The same pattern applies to:

  • TLS — hybrid key exchange (X25519 + Kyber)
  • JWT — HS256 (symmetric) alongside RS256 (classical asymmetric)
  • SSH — hybrid key algorithms in OpenSSH 9.0+

The problem with hybrid systems

Hybrid systems introduce a subtle security question: which signature do you actually trust?

If an attacker can selectively strip the PQC signature and present only the classical one to a legacy verifier — you've gained nothing. The system is only as strong as its weakest link.

This is called a downgrade attack. Good hybrid implementations defend against it explicitly.

// Vulnerable — verifier accepts classical-only
function verify(payload) {
  if (payload.classicalSig) {
    return secp256k1.verify(payload.message, payload.classicalSig);
  }
}

// Secure — verifier requires both
function verify(payload) {
  const classicalValid = secp256k1.verify(payload.message, payload.classicalSig);
  const pqcValid = dilithium.verify(payload.message, payload.pqcSig);
  return classicalValid && pqcValid; // BOTH required
}
Enter fullscreen mode Exit fullscreen mode

How quantum-audit v0.2.3 handles hybrid systems

quantum-audit now detects hybrid setups automatically.

When it finds both a vulnerable classical library and a post-quantum library in your project:

⚡ Hybrid Mode: Post-quantum library detected (@noble/post-quantum,
   sphincs) — hybrid transition in progress.
   Critical penalties reduced by 50%.

🔒 Multi-layer PQC detected (@noble/post-quantum + sphincs)
   — +10 bonus applied.
Enter fullscreen mode Exit fullscreen mode

What this means in practice:

A project with ethers (ECDSA — critical) and @noble/post-quantum (Dilithium — safe) would normally score:

100 - 40 (ethers ECDSA weight) = 60/100 — Grade C
Enter fullscreen mode Exit fullscreen mode

In hybrid mode:

100 - 20 (50% reduction) + 0 = 80/100 — Grade B
Enter fullscreen mode Exit fullscreen mode

The tool recognises you're actively migrating, not ignoring the problem.

What quantum-audit does NOT yet do

Full transparency — there are things v0.2.3 doesn't cover yet:

1. Downgrade attack detection
We don't yet check whether your hybrid implementation requires both signatures or accepts classical-only as a fallback. That's source-level analysis that requires understanding your verification logic, not just your dependencies.

2. Protocol-level hybrid awareness
If you're using OpenSSL 3.x's provider system or a custom TLS stack with hybrid key exchange — quantum-audit won't understand the protocol context. It sees the libraries, not how they're composed.

3. Smart contract hybrid patterns
Solidity scanning is new in v0.2.3 — we detect ECDSA imports in .sol files but don't yet understand hybrid signing patterns at the contract level.

These are on the roadmap.

The right way to think about hybrid migration

Step 1 — Audit first

npx quantum-audit . --json > audit.json
Enter fullscreen mode Exit fullscreen mode

Know exactly what you're dealing with before planning migration.

Step 2 — Add PQC alongside classical
Don't replace — add. Keep existing ECDSA signing, add Dilithium on top.

npm install @noble/post-quantum
Enter fullscreen mode Exit fullscreen mode

Step 3 — Require both in verification
Make sure your verifier requires both signatures. No classical-only fallback.

Step 4 — Monitor the ecosystem
Ethereum's PQC migration is tracked via EIPs. Bitcoin via BIP-360. Watch these for when the ecosystem is ready to drop classical.

Step 5 — Eventually deprecate classical
When the ecosystem catches up, drop the classical layer. You're now fully post-quantum.

Real-world hybrid: OpenSSL 3.x

OpenSSL 3.x introduced the provider system that allows hybrid key exchange in TLS. The OQS (Open Quantum Safe) provider adds post-quantum algorithms:

npm install liboqs-node
Enter fullscreen mode Exit fullscreen mode

This is the most mature hybrid implementation available today for Node.js projects.

Install quantum-audit 

npx quantum-audit .
npx quantum-audit . --json
npx quantum-audit . --threshold=70
Enter fullscreen mode Exit fullscreen mode

GitHub: takundanashebmuchena-pixel/quantum-audit
npm: npmjs.com/package/quantum-audit

Are you running a hybrid system already? Drop your setup in the comments — especially interested in hearing from anyone using OpenSSL's OQS provider or building hybrid signing into a Web3 project.

Top comments (0)