A digital signature is normally assessed at the moment it is created: the certificate is valid, the key is strong enough, the algorithm is recommended. But many records do not live only at the moment of signing. Long-term contracts, clinical records, trial documentation, engineering designs, property titles and regulatory archives may have to be kept, and proven, for decades.
Over that time, certificates expire, certification authorities change, algorithms age and, on the horizon, a deeper change appears: the possibility that sufficiently capable quantum computers could make the signature algorithms most widely used today insecure. This article explains what that means for the integrity of long-lived records and how to prepare for the transition without panic and without waiting too long.
What changes with quantum computing
Most digital signatures in use rely on RSA or on elliptic-curve cryptography such as ECDSA. The security of these schemes depends on the difficulty of mathematical problems, such as factoring large numbers or the discrete logarithm, that a sufficiently large quantum computer could solve efficiently using Shor's algorithm. No quantum computer with that capability exists today, and there is no consensus on when one might. But the window of concern is not defined by the date such a machine appears; it is defined by how long your records need to remain trustworthy.
For confidentiality, the risk is known as "harvest now, decrypt later": encrypted data intercepted today could be decrypted in the future. For integrity, the risk is different, but just as relevant. If a signature algorithm is broken, it becomes possible to forge signatures with the affected keys. From that moment on, a signature on its own is no longer proof that a document was signed by whoever claims to have signed it, and when.
The right question is not "when does the quantum computer arrive?" but "for how long do my records need to keep proving something?"
The new post-quantum standards
In August 2024, NIST published the first post-quantum cryptography standards: FIPS 203 (ML-KEM, for key establishment), FIPS 204 (ML-DSA, lattice-based signatures) and FIPS 205 (SLH-DSA, hash-based signatures). Additional standards are in preparation. In Europe, the Member States, through the NIS Cooperation Group, have published a coordinated roadmap for the transition, which points to starting migration in the short term and to prioritising protection of the highest-risk use cases by the end of the decade.
The existence of these standards does not mean every system should migrate tomorrow. It means the path is set and that organisations managing long-lived records should start planning.
Why hash functions age better
Not all cryptography is affected in the same way. Hash functions such as SHA-256 do not rely on the mathematical problems that Shor's algorithm solves. Grover's algorithm offers a quadratic speed-up in searching for preimages, which in practice reduces the effective security margin but does not eliminate it: hash functions with 256-bit outputs are still considered adequate for preimage resistance in a post-quantum scenario.
This has an important consequence for archive design. An integrity proof based on a fingerprint (the document's hash) sealed with a timestamp in an independent registry depends mainly on the strength of the hash function and the preservation of the registry, not exclusively on the longevity of a signing key pair. Separating the integrity proof from the signature makes the archive more resilient to cryptographic change.
Signature, timestamp and renewal
The role of the timestamp
If you can prove that a document and its signature existed at a date when the algorithm was still secure, the signature retains evidentiary value even after the algorithm is considered weak. This is the principle behind the long-term signature formats defined by ETSI and the evidence records described in RFC 4998 (Evidence Record Syntax): adding successive timestamps that "wrap" the earlier proof before it loses strength.
Renew before it is too late
Renewal of proofs has to happen while the algorithms in use are still trustworthy. A proof that is renewed only after the underlying algorithm has been compromised can no longer be credibly reconstructed. That is why long-term archives need an explicit renewal policy, with owners, deadlines and technical criteria.
Cryptographic agility
The most lasting lesson of the post-quantum transition is the need for agility: systems able to switch algorithms without rewriting architectures or invalidating earlier evidence. Records that store which algorithm was used, rather than assuming it implicitly, are much easier to migrate.
A practical plan for long-lived records
- Take inventory. Identify the records that must retain evidentiary value for long periods and the cryptographic mechanisms that protect them today.
- Classify by retention horizon. A record that must be kept for decades takes priority over one that is discarded after a year.
- Separate integrity from signature. Make sure there is an independently sealed, timestamped fingerprint of each record, in addition to any signature.
- Seal now. A reliable timestamp applied today is the best defence against future doubts about when a document existed.
- Define renewal cycles. Establish when and how proofs are renewed with newer algorithms.
- Demand agility from vendors. Ask how each vendor plans to support the new standards and preserve the validity of proofs already issued.
- Follow the guidance. Follow the recommendations of NIST, ENISA and national authorities, which will continue to evolve.
How ROOTKey helps
ROOTKey separates, by design, the proof of integrity from the document itself. Every asset receives a unique fingerprint, permanently sealed on an independent public registry: a timestamped record of its exact state. With a custom deployment, the content stays on your infrastructure; only the fingerprint is recorded.
This approach gives long-lived records an independently verifiable time anchor, which complements existing signatures and can be confirmed years later, by any party, through the public verification portal. Continuous monitoring detects any change against the sealed state, and the chain of custody is ready to present to auditors and regulators when needed.