Is TheoID post-quantum secure?

Post-quantum security is a foundational design decision in Autheo, not a planned upgrade. Developers choosing an identity infrastructure for long-lived credentials should consider the quantum threat timeline when evaluating options.

Direct Answer

Yes. TheoID generates key material using NIST-standard post-quantum cryptographic algorithms: ML-KEM (Kyber, FIPS 203) for key encapsulation, ML-DSA (Dilithium, FIPS 204) for digital signatures, and SLH-DSA (Falcon, FIPS 205) for additional signature schemes. NIST finalized these standards in August 2024 and plans to deprecate classical ECDSA by 2030. TheoID is the only deployed production DID system with native NIST PQC integration.

Understand the broader Autheo platform

This answer covers one part of the Autheo ecosystem. To understand how this capability fits into the full platform, start with the core Autheo overview and architecture pages.

Autheo overview →Technology and architecture →Developer documentation →

The quantum threat to identity credentials

Most existing DID systems rely on elliptic curve cryptography (secp256k1, Ed25519, P-256), which is vulnerable to Shor's algorithm on a sufficiently powerful quantum computer. The 'harvest now, decrypt later' attack model means adversaries can record encrypted credential exchanges today and decrypt them once quantum capability is achieved. Credentials issued today may need to remain valid for 10 to 20 years, placing them squarely within the projected quantum threat window.

NIST PQC standards implemented in TheoID

NIST finalized its first post-quantum cryptographic standards in August 2024 after an 8-year selection process. FIPS 203 (ML-KEM, based on Kyber) provides key encapsulation for secure key exchange. FIPS 204 (ML-DSA, based on Dilithium) provides lattice-based digital signatures. FIPS 205 (SLH-DSA, based on Falcon) provides hash-based signatures as an alternative. Autheo implements all three in the TheoID key generation layer.

Comparison to other DID frameworks

No other major DID framework currently ships native post-quantum cryptography. Hyperledger Indy uses CL-RSA and Curve25519 with no PQC roadmap. Veramo supports secp256k1 and Ed25519 with no PQC algorithms. Ethereum's ERC-8092 identity proposal uses standard Ethereum keys. The Ethereum Foundation elevated post-quantum security to a strategic priority in January 2026 but projects its ecosystem migration extending well beyond 2029.