The Challenge
The FIDO Alliance built FIDO2 on asymmetric cryptography that quantum computers will inevitably break. The standard relies on elliptic curve cryptography (ECC) and RSA for public-key operations. Both algorithms are vulnerable to Shor's algorithm on a powerful quantum computer.
Here's why this is urgent: you're deploying passkeys today that will store credentials for years. An attacker can harvest encrypted authentication data now and decrypt it later when quantum computers mature. This "harvest now, decrypt later" threat is real. Nation-state actors are already collecting encrypted traffic at scale.
The FIDO2 specification outlines how authenticators generate key pairs, how relying parties verify signatures, and how the WebAuthn API mediates between browsers and authenticators. None of these components account for post-quantum cryptography (PQC). The metadata service that validates authenticator attestations? Quantum-vulnerable. The CTAP protocol that connects external authenticators to platforms? Quantum-vulnerable. The entire trust chain assumes classical cryptography will remain secure.
The Environment and Constraints
Organizations face a timing problem. NIST finalized its first post-quantum cryptographic standards in 2024: ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism), ML-DSA (Module-Lattice-Based Digital Signature Algorithm), and SLH-DSA (Stateless Hash-Based Digital Signature Algorithm). These algorithms resist known quantum attacks, but they're not drop-in replacements for ECC or RSA.
The constraints are architectural:
Authenticator hardware has limited processing power. The cryptographic devices that store passkeys weren't designed for lattice-based operations. ML-KEM and ML-DSA require more memory and computational overhead than ECC. You can't just push a firmware update to existing FIDO2 security keys.
Key sizes grow significantly. An ECC public key fits in 32 bytes. An ML-DSA public key needs 1,312 bytes for comparable security. That expansion affects every protocol message, attestation statement, and metadata entry. The CTAP specification sets message size limits that post-quantum keys exceed.
Backward compatibility isn't optional. You can't flip a switch and migrate every passkey-enabled service to PQC overnight. Relying parties, authenticators, and browsers must interoperate during a multi-year transition. The FIDO Alliance needs to define hybrid modes where authenticators support both classical and post-quantum algorithms simultaneously.
The threat timeline is uncertain. Cryptographically relevant quantum computers don't exist yet, but the gap between "doesn't exist" and "exists in a classified lab" is unclear. Organizations must balance the cost of premature migration against the risk of waiting too long.
The Approach Required
The FIDO Alliance can't solve this with algorithm substitution alone. The ecosystem needs protocol changes, new authenticator profiles, and updated certification requirements.
Protocol extensions for hybrid authentication. FIDO2 needs to support dual-signature schemes where authenticators sign challenges with both a classical algorithm (for backward compatibility) and a post-quantum algorithm (for future security). The relying party verifies both signatures during the transition period, then drops classical verification once all clients upgrade. This requires changes to the WebAuthn specification, the CTAP protocol, and the metadata format.
Authenticator certification tiers. Not every use case needs quantum resistance immediately. The Alliance should define certification levels: FIDO2 Classic (current ECC/RSA), FIDO2 Hybrid (dual-mode), and FIDO2 PQC (post-quantum only). Organizations can choose authenticators based on their threat model and timeline. High-value targets, financial services, healthcare, government, adopt PQC authenticators first. Consumer applications follow as hardware costs drop.
Metadata service upgrades. The FIDO Metadata Service publishes authenticator capabilities so relying parties know which devices to trust. It must extend the schema to include post-quantum algorithm support, key sizes, and performance characteristics. Relying parties need this data to make informed decisions about which authenticators to accept.
Guidance for phased migration. Organizations need a roadmap: when to start testing PQC authenticators, how to configure relying parties for hybrid mode, which services to migrate first, and how to handle users with legacy devices. The Alliance should publish migration playbooks tied to specific threat scenarios, not just technical specifications.
Results and Metrics
The FIDO Alliance hasn't published a post-quantum roadmap yet. The industry is waiting for concrete timelines, reference implementations, and certification criteria. Without measurable progress, organizations are left guessing.
What success looks like:
- Published specification for hybrid FIDO2/PQC authentication modes
- Certified reference authenticators demonstrating post-quantum algorithms in production
- Migration guides that map threat models to deployment timelines
- Interoperability testing between hybrid authenticators and major relying parties (Google, Microsoft, Apple, financial institutions)
The gap between NIST finalizing PQC standards and FIDO2 supporting them is the window where organizations are vulnerable. Closing that gap is measurable: count the months between standardization and availability of certified hybrid authenticators.
What Should Happen Differently
The FIDO Alliance should have started this work when NIST announced the PQC competition in 2016. Waiting until standards finalize before updating specifications leaves too little time for hardware manufacturers to redesign authenticators, for relying parties to update infrastructure, and for users to replace devices.
The lesson for other standards bodies: cryptographic agility isn't optional. Protocols must support algorithm negotiation from day one. FIDO2 locked in ECC and RSA without a clean path to alternative algorithms. Adding PQC support retroactively is harder than designing for it upfront.
Organizations deploying passkeys today should demand transparency from the Alliance: what's the timeline for hybrid authenticators? Which vendors are committed to PQC support? What's the certification process? Without answers, you're betting your authentication infrastructure on algorithms with a known expiration date.
Takeaways for Your Team
Don't freeze passkey adoption while waiting for PQC. Passkeys still beat passwords and legacy multi-factor authentication today. Deploy them, but plan for a second migration wave when post-quantum authenticators arrive.
Inventory your authentication systems by data sensitivity. Systems protecting long-lived secrets or high-value accounts should be first in line for PQC upgrades. Consumer-facing services with short session lifetimes can wait.
Test post-quantum readiness now. When hybrid authenticators ship, you'll need updated relying party software, modified session management, and new certificate validation logic. Identify those dependencies before you're under pressure to migrate.
Watch for vendor commitments. Ask your authenticator suppliers and identity platform vendors for PQC roadmaps. Vendors who can't articulate a plan are a migration risk.
Track NIST's PQC migration guidance. NIST publishes timelines for when federal systems must support post-quantum cryptography. Those deadlines signal when commercial expectations will shift. If government agencies require PQC by a certain date, your customers will expect it shortly after.
The post-quantum transition isn't a distant problem. It's a multi-year engineering effort that starts now.
