Classical Acceptance Is Not Hybrid X.509 Authentication
Eight X.509 path-validation stacks were pointed at hybrid certificates carrying both a classical signature and a post-quantum credential.
Classical Acceptance Is Not Hybrid X.509 Authentication
Eight X.509 path-validation stacks were pointed at hybrid certificates carrying both a classical signature and a post-quantum credential. Most of them shrugged, validated the classical path, and returned a “hybrid” verdict anyway. That is the finding of arXiv:2607.20800, and it is a quiet catastrophe for anyone planning a phased PKI migration under the NIST post-quantum standards FIPS 203/204/205.
The problem is semantic, not cryptographic. The math is fine. The verifier reports what the operator wants to hear.
What the measurement actually shows
The authors constructed hybrid certificates and probed how each stack treats the post-quantum evidence. The pattern: the PQ credential is parsed, sometimes even validated in isolation, but its outcome does not gate the final decision. A classical verify_ok promotes the entire chain to “hybrid accepted” regardless of what happened on the PQ side.
The concrete downgrade demonstration matters more than the survey. When the PQ credential is revoked but the classical certificate is still valid, seven of eight verifiers report a successful hybrid validation. The operator dashboard shows green. The PQ revocation was outcome-inert.
This is not an implementation bug you fix with a patch. It is an underspecification the IETF LAMPS working group has been circling for two years without landing conformance language a verifier author can execute against.
2026-07-24T09:14:03Z x509.verify chain_id=7a3f status=HYBRID_OK
classical: ecdsa-p256 status=OK ocsp=good
pq: ml-dsa-65 status=REVOKED ocsp=revoked
policy: hybrid_required=true outcome_bearing_pq=false ← the bug
verdict: accepted (classical path sufficient)That outcome_bearing_pq=false line is the entire paper in one field.
The verifier contract the paper proposes
The authors do not stop at measurement. They derive a specification-level verifier model and publish a policy-parametric reference contract: a machine-checkable statement of what a stack must recognize, verify, and enforce before it is allowed to emit the string “hybrid”. Three obligations stand out.
Recognize the PQ credential structurally. Verify it cryptographically. Make its revocation status outcome-bearing at the same tier as the classical one. Any weaker contract is classical authentication with post-quantum decoration.
Why this lands on the CRA and NIS2 desk
For operators under the EU Cyber Resilience Act, “supports post-quantum cryptography” is becoming a claim with legal weight. If the verifier accepts on the classical path when the PQ credential is revoked, the product does not do what its datasheet says. ENISA’s post-quantum guidance already flags migration lifecycle desynchronization as the top operational risk, and this paper gives it a name and a reproducer.
Our position at CAI Technology is narrower than the paper’s. Hybrid should not be a verifier verdict at all. It should be two independent verdicts the caller composes under an explicit policy — because the moment “hybrid” is a single boolean, someone downstream will treat it as authentication when it is only acceptance. Our work on identity primitives under CAI-AUTH treats the PQ and classical decisions as separate signals with separate provenance, and our AEGIS detection pipeline surfaces mismatches as first-class alerts rather than silently reconciling them.
The measurement in this paper is the artifact the standards conversation was missing. Read it before your next PKI roadmap review.