Signing Service Migration Reference

Replace classical code signing (GPG, ECDSA, RSA) with post-quantum ML-DSA signatures. Use this playground to try PQC signing, then use the Qudo JNI provider directly in your build pipeline.

1. When to Use PQC Signing

2. Try It: Sign & Verify

Test all three ML-DSA security levels. Sign data, verify the signature, then try tampering to see verification fail.

3. Choose Your Algorithm

4. Migrate Your System

Replace your classical signing tool with the Qudo JNI provider. Your build pipeline stays the same — only the sign/verify step changes.

// GPG signing
gpg --sign --armor myapp.jar

// ECDSA
Signature signer = Signature.getInstance(
    "SHA256withECDSA");
signer.initSign(ecPrivateKey);
signer.update(data);
byte[] sig = signer.sign();

// cosign (container)
cosign sign --key cosign.key myimage@sha256:...

// Generate keypair once at startup
QudoKeyPair keys = provider.generateKeyPair(
    "ML-DSA-65");

// Sign
byte[] sig = provider.sign(data,
    keys.getPrivateKeyPem(), "ML-DSA-65");

// Verify
boolean ok = provider.verify(data, sig,
    keys.getPublicKeyPem(), "ML-DSA-65");

Complete Java Implementation (Qudo JNI Provider)

import com.qudo.crypto.QudoCrypto;
import com.qudo.crypto.QudoKeyPair;
import java.nio.file.Files;
import java.nio.file.Path;

// ============================================================
// Initialize once at application startup
// ============================================================
QudoCrypto provider = QudoCrypto.create();

// Generate ML-DSA-65 keypair once (store securely, reuse across signs)
QudoKeyPair signingKeys = provider.generateKeyPair("ML-DSA-65");

// ============================================================
// Sign a binary artifact
// ============================================================
byte[] artifact = Files.readAllBytes(Path.of("myapp.jar"));
byte[] signature = provider.sign(artifact, signingKeys.getPrivateKeyPem(), "ML-DSA-65");

// Save signature and public key alongside artifact
Files.write(Path.of("myapp.jar.sig"), signature);
Files.write(Path.of("myapp.jar.pub"), signingKeys.getPublicKeyPem());

// ============================================================
// Verify (on the consumer side)
// ============================================================
byte[] sig = Files.readAllBytes(Path.of("myapp.jar.sig"));
byte[] pubKey = Files.readAllBytes(Path.of("myapp.jar.pub"));
boolean valid = provider.verify(artifact, sig, pubKey, "ML-DSA-65");

// ============================================================
// Sign a container image digest
// ============================================================
byte[] digest = "sha256:e3b0c44298fc1c149afbf4c8996fb924...".getBytes();
byte[] containerSig = provider.sign(digest, signingKeys.getPrivateKeyPem(), "ML-DSA-65");

provider.close();

Summary: What Changes vs What Stays

5. Performance

6. Common Pitfalls

7. Compatibility

8. FAQ

Crypto Inventory

Migration Checklist

Raw TLS Handshake Output