Post-quantum HSM signing (PQS) preview-capability status

At a glance

Preview-capability status. Opt-in, default-off, fail-closed. This is a preview of HSM-delegated post-quantum signing. The preview is off until you opt in; when off, the signing call fails closed with a typed exception.

NextPDF Enterprise exposes an experimental post-quantum signature (PQS) surface that drives ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) signing through a PKCS#11 hardware token. The path is Pkcs11Signer::signPqs(), gated behind an explicit per-signer opt-in ($enablePostQuantum) and, separately, behind a process-level env flag (NEXTPDF_FEATURE_PREVIEW_PQS_HSM). Both are off by default.

The preview delegates a real post-quantum signing operation to the token. The standards that would make a post-quantum PDF signature interoperable for long-term archival have not landed yet (see Standards boundary).

Availability & licensing

This capability ships in NextPDF Enterprise (nextpdf/enterprise) and activates with an Enterprise-tier license envelope. A deployment without that entitlement does not load the capability’s classes. Compare editions and get a license.

It builds on the Enterprise PKCS#11 hardware-token signer — see HSM signing. The classical (RSA / ECDSA) PKCS#11 signing path is the supported, stable Enterprise capability; the post-quantum path described here is an experimental preview layered on top of it. NextPDF Enterprise includes the Pro feature set.

Preview-capability status

The preview drives a genuine signing operation: when enabled, signPqs() dispatches to the candidate PKCS#11 v3.1 post-quantum mechanism on the token, the private key never leaves the token boundary, and the returned bytes are length-checked against the FIPS-mandated signature length for the chosen parameter set before they are accepted.

It is, at the same time, a preview and not a generally available product capability:

• The PKCS#11 post-quantum mechanism and parameter-set identifiers are provisional — OASIS PKCS#11 v3.1 has not finalised a post-quantum mechanism registry, so the values used are tracked as provisional and HSM operators must confirm their token’s PQ firmware matches them before enabling.
• No post-quantum verification path exists in NextPDF, and no ETSI suite registers a post-quantum signature for AdES long-term archival, so a signature produced here is not yet interoperable and most PDF viewers will reject it at validation time.
• A companion descriptor, PqsCapabilityStatus, reports these facts in a machine-readable form. Every positive claim boolean — generallyAvailable, adesCompliant, verificationAvailable, conformanceClaimed — is hard-coded to false and stays false even when the preview flag is on, and no configuration can flip one on. (It also carries a recognitionOnly flag, hard-coded true, which records that algorithm recognition is never a conformance verdict; it does not mean the surface cannot sign — signing happens through signPqs() as described above.)

Why it works this way

NextPDF can already compute a real ML-DSA or SLH-DSA signature through the token. Even so, every conformance boolean stays hard-coded to false, behind two default-off gates. A signature is only worth the ability to verify it later. For post-quantum there is no verification path, no registered ETSI AdES suite, and no FIPS-validated HSM round-trip yet. Shipping this as generally available would issue signatures that no viewer can validate and no archive can trust. So the design separates producing the bytes from claiming that anyone may rely on them, and no preview flag can blur that line.

Design background: Long-term validation.

Algorithm parameter sets

signPqs() selects the algorithm and parameter set through the Pkcs11PqsAlgorithm enum. Each case maps a NIST parameter set to a provisional PKCS#11 mechanism / parameter-set identifier and to the FIPS-mandated signature byte length used for the defence-in-depth length check.

ML-DSA — FIPS 204 (module-lattice). Three parameter sets, claimed at the NIST security-strength categories shown:

Parameter set	NIST category	Signature length (bytes)
ML-DSA-44	2	2420
ML-DSA-65 (recommended default)	3	3309
ML-DSA-87	5	4627

SLH-DSA — FIPS 205 (stateless hash-based). Twelve parameter sets, formed as SHA2 / SHAKE x 128 / 192 / 256 x small (s) / fast (f). The s variants minimise signature size; the f variants minimise signing latency:

Parameter set family	NIST category	Signature length (bytes)
SLH-DSA-{SHA2,SHAKE}-128s	1	7856
SLH-DSA-{SHA2,SHAKE}-128f	1	17088
SLH-DSA-{SHA2,SHAKE}-192s	3	16224
SLH-DSA-{SHA2,SHAKE}-192f	3	35664
SLH-DSA-{SHA2,SHAKE}-256s	5	29792
SLH-DSA-{SHA2,SHAKE}-256f	5	49856

Enabling the preview

Two independent gates must both be open. Both default to off.

1. Process gate. Set NEXTPDF_FEATURE_PREVIEW_PQS_HSM=1 before the process boots (or via putenv() before the status is read). Strict equality to the string 1 is required; any other value — including 0, true, yes, or empty — is treated as off.
2. Per-signer opt-in. Pass $enablePostQuantum: true to the Pkcs11Signer constructor.

use NextPDF\Enterprise\Security\Signature\Hsm\Pkcs11Signer;
use NextPDF\Enterprise\Security\Signature\Hsm\Pkcs11PqsAlgorithm;
use NextPDF\Enterprise\Security\Signature\Hsm\PqsCapabilityStatus;
use NextPDF\Enterprise\Security\Signature\Hsm\PqsPreviewFeature;

// 1. Open the process-level preview gate (default-off).
putenv(PqsPreviewFeature::ENV_PREVIEW_PQS_HSM . '=1');

// 2. The capability status is honest even with the gate open:
//    generallyAvailable / adesCompliant / verificationAvailable stay false.
$status = PqsCapabilityStatus::current();

// 3. Construct the PKCS#11 signer with the per-signer opt-in.
$signer = new Pkcs11Signer(
    libraryPath: '/usr/lib/softhsm/libsofthsm2.so',
    slotId: 0,
    pin: '1234',
    certLabel: 'my-pqc-signing-cert',
    enablePostQuantum: true,
);

// 4. Sign with a chosen parameter set. The returned bytes are length-checked
//    against Pkcs11PqsAlgorithm::signatureLength() before being accepted.
$signature = $signer->signPqs(
    data: $tbsBytes,
    algorithm: Pkcs11PqsAlgorithm::MlDsa65,
);

isPostQuantumEnabled() reports whether the per-signer opt-in was set, and PqsCapabilityStatus::current() reports the process-level state plus the honest claim booleans.

Fail-closed boundary

The surface is fail-closed and reports failures through named, typed exceptions rather than silent fallback:

• Opt-in absent. If signPqs() is called when $enablePostQuantum is false, it throws HsmOperationException. No signing occurs.
• Context too long. A signing context octet string longer than 255 bytes throws InvalidArgumentException (per the FIPS 204 / FIPS 205 context bound) before any token call.
• Key absent. If no private key matches the configured label on the token, signPqs() throws HsmOperationException.
• Length mismatch. If the token returns a signature whose byte length does not equal the FIPS-mandated length for the parameter set, signPqs() throws HsmOperationException — a malformed (truncated or oversized) signature is rejected before it can reach CMS SignedData encoding.
• Token error. Any underlying PKCS#11 error is wrapped in HsmOperationException.

The process-level env flag changes nothing about this boundary: even when the flag is on, the capability booleans stay false and the signing path stays length-checked and fail-closed.

Standards boundary

The standards involved are maintained by external bodies, and the preview takes no position on conformance to any of them:

• The algorithm parameter sets and signature lengths follow FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).
• The token mechanism identifiers follow OASIS PKCS#11; the post-quantum mechanism registry in PKCS#11 v3.1 is not yet finalised, so NextPDF uses provisional identifiers.
• The PDF-signature long-term-archival profiles are ETSI EN 319 142-2 (PAdES extended profiles, built on CMS SignerInfo) and the cryptographic-suites catalogue ETSI TS 119 312, which currently profile RSA and ECDSA only — no post-quantum suite is registered for CAdES/PAdES. A post-quantum PDF signature produced today is therefore not yet AdES-compliant for archival.

No standards text is reproduced on this page.

Security notes

A preview is not a security control. The presence of a post-quantum signature produced by this path does not establish AdES validity, does not imply a trusted key, and is not verifiable by NextPDF (there is no post-quantum verification path). Do not rely on this preview for signature assurance, and do not deploy it where an AdES-compliant or FIPS-validated signature is required. Keep both gates off in production until the standards land.

API surface

Symbol	Role
Pkcs11Signer::signPqs()	Opt-in, fail-closed HSM-delegated post-quantum signing through PKCS#11. Throws HsmOperationException when disabled, when the key is absent, or on a signature-length mismatch.
Pkcs11Signer::isPostQuantumEnabled()	Whether the per-signer $enablePostQuantum opt-in was set.
Pkcs11PqsAlgorithm	Enum of ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) parameter sets; maps each to a provisional mechanism id and the FIPS-mandated signature length.
PqsPreviewFeature	Process-level, default-off env gate (NEXTPDF_FEATURE_PREVIEW_PQS_HSM).
PqsCapabilityStatus	Honest, machine-readable status: every positive claim boolean (generally-available, AdES, verification, conformance) is hard-coded false regardless of the preview flag.
HsmOperationException	The typed exception raised on the fail-closed paths.

Publication boundary

This page documents externally observable behavior and the supported public API surface only. Internal namespace paths, helper classes, mechanism tables, runbook filenames, and ticket prefixes are out of scope.

See also

• HSM signing (PKCS#11)
• Enterprise security
• Core signing
• Conformance landing
• C2PA preview-capability status