Toward Quantum-Safe Permissioned Blockchains: Evaluating Hybrid ML-DSA-65/ECDSA Signatures on Hyperledger Fabric

Abstract

Post-quantum migration is a critical challenge for enterprise blockchain systems that rely on classical digital signatures. Hyperledger Fabric extensively uses ECDSA for identity management, endorsement, TLS, and transaction validation, making a full infrastructure-level migration complex. This paper presents a controlled empirical evaluation of a hybrid ML-DSA-65/ECDSA signature architecture for Hyperledger Fabric. The proposed approach preserves Fabric’s native ECDSA-based infrastructure while integrating ML-DSA-65 at the application layer through an external post-quantum signing microservice. ML-DSA-65 signatures and public keys are stored on-ledger as application-level cryptographic evidence, providing an incremental post-quantum signature layer without modifying Fabric core binaries. The scope of this protection is intentionally limited: Fabric’s native MSP/X.509 identities, peer endorsement signatures, TLS-protected communications, block-level metadata signatures, and ordering-service communications remain based on classical cryptography in the evaluated deployment. The implementation is evaluated on a deployed Fabric network with two organizations, four peers, three Raft orderers, CouchDB state databases, and Go chaincode deployed as Chaincode-as-a-Service. A latency-matched ECDSA baseline is compared with the PQC hybrid configuration across six scenarios covering throughput, latency, stress behavior, payload robustness, resource consumption, cryptographic primitive performance, and block-size overhead. Results show that optimized ML-DSA-65 signing achieves an average latency of 0.226 ms, while no statistically significant degradation was detected in the primary transaction-level performance metrics under the tested workloads. The main measured operational cost is storage-related: active blocks in the ML-DSA-65 configuration are approximately $1.43\times $ larger than those of the functionally equivalent application-layer ECDSA P-256 baseline for signing-intensive transactions. These results indicate that application-layer hybrid ML-DSA-65/ECDSA signatures offer a practical incremental migration path for enterprise Fabric deployments, with ledger growth rather than transaction processing performance as the principal measured trade-off.