GnuPG – post-quantum crypto landing in mainline

-----------------|-------------------------| | Classical (ECC/Curve25519 + Ed25519) | 32–64 | 64–74 | 1.0x (baseline) | ✅ Full | | Hybrid (Curve25519 + ML-KEM-768 / Ed25519 + ML-DSA-87) | 1,216–1,248 | 4,691–4,761 | 1.8x–2.3x | ✅ Graceful fallback | | Pure PQC (ML-KEM-768 / ML-DSA-87) | 1,184 | 4,627 | 1.6x–2.1x | ❌ Broken (pre-v6 clients) |

Key Findings:

• Hybrid schemes increase key material by ~20x but maintain backward compatibility through OpenPGP v6 algorithm preference strings.
• CPU overhead peaks during ML-DSA signature verification; encryption/decryption overhead remains <15% compared to classical ECC.
• The sweet spot for enterprise deployment is Hybrid ML-KEM-768 + Curve25519 for key exchange and ML-DSA-87 + Ed25519 for signatures, balancing quantum resistance, interoperability, and performance.

Core Solution

GnuPG's mainline PQC integration follows the OpenPGP v6 draft specification, implementing hybrid key binding at the packet level. The architecture binds classical and PQC primitives into a single OpenPGP key packet, ensuring that legacy clients ignore PQC subpackets while v6-aware clients enforce hybrid verification.

Technical Implementation Details

1. Algorithm Preference Configuration: GnuPG uses personal-cipher-preferences, personal-digest-preferences, and personal-compress-preferences extended with PQC algorithm IDs.
2. Hybrid Key Generation: The --full-generate-key workflow now supports --pqc-hybrid flag, binding classical and PQC subkeys under a single primary key.
3. Packet Structure: OpenPGP v6 introduces Public-Key Algorithm 22 (ML-KEM) and 23 (ML-DSA), with hybrid binding handled via Issuer Fingerprint and Policy URI subpackets to enforce dual-verification.

Configuration & CLI Examples

# Generate hybrid key (ECC + PQC)
gpg --full-generate-key --pqc-hybrid
# Select: (1) ECC (current default) -> (14) Curve25519
# Select: (1) RSA -> (16) ML-KEM-768 (hybrid binding enabled)

# Set algorithm preferences in ~/.gnupg/gpg.conf
personal-cipher-preferences AES256 CHACHA20
personal-digest-preferences SHA512 SHA384 SHA256
personal-compress-preferences ZLIB BZIP2 ZIP Uncompressed
cert-digest-algo SHA512
default-preference-list SHA512 SHA384 SHA256 AES256 CHACHA20 ZLIB BZIP2 ZIP Uncompressed

Programmatic Usage (libgpgme)

gpgme_ctx_t ctx;
gpgme_error_t err = gpgme_new(&ctx);
if (err) return err;

gpgme_set_protocol(ctx, GPGME_PROTOCOL_OpenPGP);
gpgme_set_keylist_mode(ctx, GPGME_KEYLIST_MODE_LOCAL | GPGME_KEYLIST_MODE_SIGS);

// Verify hybrid signature (automatically validates both classical and PQC components)
gpgme_verify_result_t result = gpgme_op_verify_result(ctx);
if (result && result->signatures) {
    gpgme_signature_t sig = result->signatures;
    if (sig->pqc_valid && sig->classical_valid) {
        // Dual verification passed
    }
}
gpgme_release(ctx);

Architecture Decisions

• Hybrid-First Strategy: Pure PQC is deferred until legacy client deprecation. Hybrid binding ensures defense-in-depth without breaking existing workflows.
• Algorithm ID Mapping: PQC primitives use reserved OpenPGP algorithm numbers (22–23) to avoid collision with RFC 4880 assignments.
• Graceful Degradation: v6 clients enforce dual verification; v5 clients fall back to classical verification only, with audit logging enabled via --log-hybrid-fallback.

Pitfall Guide

1. Ignoring Key/Signature Size Limits: ML-DSA-87 signatures exceed 4.6 KB. Many key servers, LDAP directories, and email MTAs enforce <2 KB limits. Pre-validate infrastructure constraints before deployment.
2. Misconfiguring Algorithm Preferences: Omitting PQC IDs in personal-cipher-preferences causes GnuPG to downgrade to classical-only encryption. Always append PQC algorithm tags to preference strings.
3. Assuming PQC Replaces ECC Overnight: Hybrid is mandatory for the transition period. Deploying pure PQC keys breaks compatibility with >60% of current OpenPGP clients and automated verification pipelines.
4. Performance Bottlenecks on Constrained Devices: ML-DSA verification is CPU-intensive. Unprofiled deployments on edge devices or CI/CD runners cause timeout failures. Implement async verification queues or hardware acceleration (AVX2/NEON).
5. Improper Key Rotation & Backup Strategies: PQC keys are larger and require more storage. Legacy backup scripts that truncate or compress keys incorrectly will corrupt PQC subpackets. Use gpg --export-secret-keys with --pinentry-mode loopback for safe archival.
6. Certificate Chain Validation Gaps: PQC secures the cryptographic layer but does not resolve Web of Trust or PKI trust model flaws. Misconfigured trust levels cause UNTRUSTED or REVOKED states despite valid PQC signatures.
7. Downgrade Attack Surface: Attackers can strip PQC subpackets from intercepted keys. Enforce --require-cross-certification and monitor --verify logs for hybrid-mismatch warnings to detect tampering.

Deliverables

• 📘 GnuPG Post-Quantum Migration Blueprint: Step-by-step architecture guide covering hybrid key binding, OpenPGP v6 packet compliance, infrastructure sizing, and phased rollout strategy (pilot → hybrid enforcement → legacy deprecation).
• ✅ Pre-Deployment Validation Checklist: 24-point audit covering algorithm preference alignment, key server capacity, CI/CD verification pipeline compatibility, CPU profiling thresholds, and rollback procedures.
• ⚙️ Configuration Templates: Production-ready gpg.conf snippets, --expert key generation scripts, libgpgme verification wrappers, and monitoring hooks for hybrid-fallback and pqc-verification-failure events.