Post-quantum cryptography in RFC 9421 library, does this align with the foundation's security roadmap?

[dicethedev]

Hi team,

I submitted a proposal for the 2026 SDK Grant Program that includes a RFC 9421 HTTP Message Signatures Rust library (http-sig) with an optional post-quantum backend implementing ML-DSA (FIPS 204) behind a feature flag.

My question is around strategic alignment:

Is post-quantum cryptography readiness something the Interledger Foundation is actively thinking about for Open Payments infrastructure, or is it considered premature for the current roadmap?

My reasoning for including it:

• RFC 9421 is explicitly algorithm-agnostic by design, making PQC an architectural extension rather than scope creep
• Financial infrastructure tends to have long deployment lifetimes, making "harvest now, decrypt later" attacks a genuine concern
• The ML-DSA standard (FIPS 204) was finalized by NIST in August 2024, so this is no longer speculative

I want to make sure this angle strengthens the proposal rather than raising concerns about scope. If the foundation has existing thinking or documentation on PQC for Open Payments, I'd also love a pointer to it.

Thanks in advance.

[jeremiahlee]

IANA maintains the official registry for HTTP Signature Algorithms. We intend to support algorithms as they are recognized by the standard.

[dicethedev]

IANA maintains the official registry for HTTP Signature Algorithms. We intend to support algorithms as they are recognized by the standard.

Thanks for the clarification, @jeremiahlee that's exactly the signal I needed.

The http-sig library in my proposal is designed around full IANA registry compliance as the baseline. The ML-DSA (FIPS 204) backend is gated behind an opt-in feature flag (pqc) specifically because it isn't yet registered in the IANA HTTP Signature Algorithms registry. The intent was always to ship a spec-compliant library first, with PQC as a forward-compatible extension that activates when the ecosystem, and the registry catches up.

So in practice, the foundation wouldn't need to adopt anything outside the IANA-recognized algorithm set until that changes. I'll make sure this distinction is clearly documented in the crate's README and feature flag notes to avoid any ambiguity.

Appreciate you taking the time to respond.