# Post-Quantum Migration of the Tor Application
## 2 Literature Review
### Schemes
#### 2.2.2 Signature  
This subsection takes a closer look at the potential signature mechanisms that could be integrated within Tor's different layers. The current 1W-AKE relies on public key cryptography. The hybrid circuit-extension design presented in proposal #269, inspired by [PERSON] et al. 's work [11], does not integrate post-quantum DSA. It maintains the usage of ECDH primitives (signing with the server's Curve25519 public key) for authentication. This is based on the assumption that the session negotiation itself is not vulnerable to quantum attacks. The hybrid protocol derives session keys and authentication tags from the shared secrets of both the ECDH shares and KEM-derived secrets, allowing authenticity verification without an explicit digital signature during session establishment. This approach avoids the additional computational cost and larger communication footprints of the standardised DSAs and the significant modifications to the Tor protocol that their incorporation would lead to. Although the recently introduced ML-DSA and SLH-DSA (Table 15) have larger signature sizes compared to the stateful hash-based schemes XMSS and LMS (Table 16), they offer the advantage of reducing state management complexity and lowering operational overhead; thus, they are better candidates if used in the handshake. The Falcon scheme, like ML-DSA, is based on lattice; it proposes even smaller keys (Table 17) but considerably slower runtimes; Dilithium, with security level 2 parameters, generates key pairs approximately 178 times faster per second than Falcon512, which corresponds to security level 1 (Table 6). SLH-DSA is the only stateless hash-based standard so far, offering robust security without relying on new mathematical problems. However, it generates large signatures (from nearly 8 KB to 50 KB) and performs slower signing than its lattice-based competitors; SPHINCS+ at security level 3 achieves about 14 signing operations per second, as shown in Table 6.  
The relay layer is heavily reliant on the circuit-extension handshake in terms of authentication, yet it also depends on Tor's own certificate mechanism. Tor does not rely on standard CA-issued certificates for its core functioning, avoiding reliance on centralised CAs. Signing is performed with Ed25519 keys; their format differs for certificates used by authorities to sign their identity key [10]. \(CERTS\) cells are at least 104 bytes when containing a single certificate of 96 bytes (32 of certified key and 64 of signature), with its expiration date of 4 bytes plus 4 bytes representing the number, type, and length of certificates in the cell. This number is approximate, as an extension can be added to bundle the signing key along with the certificate, which adds up to at least 36 bytes. Therefore, 140 bytes would represent one certificate and its signing key, which fits into the current absolute maximum fixed size of 512 bytes. ML-DSA, the smallest recently standardised post-quantum equivalent, has a total of 3732 bytes for the public key and signature sizes (Table 4). In regard to onion services, which also rely on a public key for authentication (Table 2) to prevent the linking of descriptors, they use a blinded version of the identity key that changes at regular intervals instead of using the identity key directly [10] #224. This allows us to hide the original identity key while still authenticating without linking the real key directly. The feature is vulnerable to quantum attacks where a capable adversary could forge the OS signature and potentially redirect queries addressed to the service. Regarding its migration to PQC primitives, [PERSON] et al. [43] assessed four schemes, including Dilithium, which outperforms the others both in signing and verification but also reaches a close result of its unblinded counterpart.