Quantum-Resistant Chain of Trust: Dilithium-Signed Payloads and Tokens for Secure APIs

Abstract

Cryptographic algorithms such as RSA, ECDSA, and HMAC-SHA256 underpin modern secure communication, relying on the difficulty of solving complex mathematical problems in polynomial time. However, with quantum computers, Shor’s and Grover’s algorithms may break RSA and ECDSA in polynomial time. Even without quantum computers, adversaries can adopt a “harvest now, decrypt later” approach, prompting research on the standardization of quantum-safe, or post-quantum, cryptography (PQC). This paper proposes a CRYSTALS-Dilithium-driven framework for securing API endpoints. The proposed framework secures APIs using Dilithium-signed JWTs with nonces for authorization claims and request payloads, utilizing Dilithium FIPS-204 “ML-DSA-44,” “ML-DSA-65,” and “ML-DSA-87” from the Open Quantum Safe project. Analysis shows that only legitimate parties can issue and verify tokens; JWTs and keys resist quantum and classical attacks, replay attacks, and offer non-repudiation, data integrity, and authenticity. The protocol was compared with classical algorithms for key generation, signing, decoding, and storage overhead. Benchmarking results indicate that MLDSA-44 (NIST strength category 2) offers the ideal balance between performance, reliability, and quantum readiness. Tamarin-Prover, with its ability to model the unique mathematical structures, larger key sizes, and specific failure modes inherent to PQC algorithms, was used for formal analysis. The proposed framework provides an approach to securing JWTs and APIs with PQC Dilithium, backed by formal guarantees.