A Post-Quantum Evidence Layer for Incremental Migration of Legacy Digital Signature Systems - Dilly, Gabriel; Martina, Jean Everson (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg.2026.27116, 2026)
Deployed digital-signature infrastructures cannot migrate atomically because cryptographic algorithms are coupled to certificates, policies, validation services, formats, and document workflows. This paper proposes an incremental migration model that introduces post-quantum protection first at the evidence layer. Before practical classical compromise, the target construction commits a document digest, its classical signature, validation material, recorded result, and policy to a Merkle root protected by a post-quantum timestamp token. The model defines a security and deployment boundary identifying which evidence must be captured and which guarantees survive without replacing the original signing infrastructure. Under correct intake validation, collision-resistant hashing, and a trusted timestamping service, it provides tamper evidence and existence-before-time for the captured validation state; it neither upgrades the original signature nor repairs evidence captured too late. A PreserveEU-based prototype evaluates a first implementation step by committing CMS bytes and generating local ML-DSA and SLH-DSA root tokens; enriched package encoding and independently operated post-quantum timestamping remain outside the implementation. Direct CMS measurements contextualize immediate signature-migration costs rather than providing an end-to-end deployment comparison. On the evaluated software-only host, ML-DSA provided the lowest post-quantum token latency and smaller records than the evaluated SLH-DSA variants, whereas SLH-DSA offered diversity from lattice-based assumptions at higher measured cost.