Classical Acceptance Is Not Hybrid Authentication: Measuring X.509 Verifier Semantics in Post-Quantum Migration

Source: arXiv:2607.20800 · Published 2026-07-23 · By Taesung Kim, Boheung Chung, Keonwoo Kim, Yousung Kang

TL;DR

This paper addresses a critical but underappreciated challenge in migrating public-key infrastructure (PKI) to post-quantum cryptography through hybrid X.509 certificates. Hybrid certificates contain both classical and post-quantum credentials and are intended to ensure classical clients remain interoperable while future-proofing authentication against quantum attacks. However, the leading hybrid designs place post-quantum evidence in non-critical certificate extensions or separate certificates, which RFC 5280 validation allows classical verifiers to ignore without rejecting. This creates a semantic gap: classical path validation accepts a certificate as valid, but this acceptance does not guarantee that post-quantum authentication actually succeeded. The authors measure this phenomenon empirically across eight widely used path-validation stacks (seven independent codebases), nine validation modes, and six certificate schemes (two pure post-quantum baselines and four hybrid designs including atomic and separable types). Nearly every stack parsing separable hybrid certificates accepts on classical evidence alone without requiring the post-quantum evidence to influence the outcome — silently promoting classical acceptance to a false hybrid authentication result. They also show that even when post-quantum signature verification is supported, default policies rarely enforce hybrid binding or revocation coherence, causing lifecycle-desynchronization attacks where revoked post-quantum credentials are ignored if classical certificates remain valid. The authors contribute a specification-derived four-layer verifier model (recognition, enforcement, policy, lifecycle), an executable policy-parametric verifier contract stating what a verifier must enforce to claim hybrid authentication, and a reproducible measurement methodology with openly released artifacts. They diagnose why standards do not require this enforcement and demonstrate interoperability fractures arising from inconsistent enforcement. This study highlights a fundamental structural gap, not just implementation gaps, in post-quantum migration using hybrid certificates.

Key findings

• Across eight path-validation stacks and six certificate schemes under a hybrid-required policy, nearly every stack parsing separable hybrid certificates accepts based on classical evidence alone without making post-quantum evidence outcome-bearing.
• One enforcement mode in wolfSSL breaks interoperability due to signature-input encoding not yet interoperably profiled, showing that enforcement can cause compatibility fractures.
• Stacks that demonstrate capability to verify post-quantum signatures (e.g., ML-DSA) still do not enforce hybrid binding by default, indicating the gap is structural and policy-driven, not solely due to missing primitives.
• Lifecycle desynchronization occurs: when a bound post-quantum credential is revoked but the classical certificate stays valid, the default validation path still accepts, losing post-quantum authentication guarantees.
• Non-criticality of post-quantum evidence extensions per RFC 5280 permits classical forks to ignore that evidence, causing a silent but critical downgrade hazard.
• The paper defines four verification layers (recognition, enforcement, policy, lifecycle) to separate causes of acceptance gaps and structures measurement results accordingly.
• The executable, policy-parametric verifier contract explicitly states the checks and scope a verifier must perform before reporting hybrid authentication, but current standards do not require it.
• Atomic composite certificates enforce verifying both classical and post-quantum signatures as a unit and do not suffer from silent classical acceptance, highlighting a design contrast with separable hybrids.

Threat model

The adversary is either M1, an active network attacker or misconfigured/hostile operator who cannot forge classical signatures but can present classical-only certificates to downgrade PQ/T authentication, or M2, a quantum-capable forger who can forge classical signatures but not post-quantum ones. Both adversaries seek to cause a relying party requiring hybrid authentication to accept classical-only evidence, nullifying post-quantum protection. The adversary does not break or remove the post-quantum extensions but exploits verifier interpretation and policy gaps allowing classical acceptance to be silently interpreted as hybrid.

Methodology — deep read

1. Threat Model & Assumptions: The paper models two adversaries: M1 (classical downgrade, network or operator who cannot forge classical signatures but can substitute or withhold evidence) and M2 (quantum-capable attacker who can forge classical signatures but not post-quantum signatures). The adversaries aim to cause a relying party requiring hybrid authentication to accept classical credentials alone, defeating post-quantum migration guarantees. The security goal is that a hybrid-required policy verifier must not accept classical-only evidence as hybrid authentication.

2. Data: They construct a corpus of test certificates with six schemes: two pure post-quantum baselines and four hybrid designs (atomic composite and three separable: Catalyst, Chameleon, Related). Certificates are issued under three-tier chains with fixed profiles, deterministic signing randomness and validity dates, and reproducible digests. They create variants invalidating precisely one post-quantum component while keeping classical evidence valid to isolate enforcement failures. For lifecycle tests, they separately revoke or expire the post-quantum credential while keeping classical credential valid.

3. Architectures: Eight path-validation stacks over seven independent codebases are tested: OpenSSL 3.5.7 (with native ML-DSA), oqs-provider (Open Quantum Safe provider atop OpenSSL), GnuTLS 3.7.3, Mozilla NSS 3.98, Go crypto/x509 1.26.4, Python cryptography 49.0.0, Bouncy Castle 1.84 (Java), wolfSSL 5.9.2 (with enforcement mode). They drive each stack's default validation endpoints recording decisions and reasons without invoking optional enforcement APIs unless measuring those modes separately.

4. Training Regime: Not applicable (empirical software measurement).

5. Evaluation Protocol: Each stack is tested against the corpus using default validation paths with revocation checking enabled. Outcomes are classified into five verdicts: hybrid-verified, classical-accept (hybrid not established), recognized-but-not-enforced, loud-fail, interop-fracture. These are mapped to RFC 5280 conformity (conformant, contested) and hybrid-required policy verdicts by an independent reference procedure implementing normative clauses from RFC 5280, RFC 9763, and schemes, thus decoupling ground truth from stack outputs. They measure 48 stack-scheme combinations plus 54 mode-scheme observations.

6. Reproducibility: They release full artifacts including corpus generator, fixed certificate digests, annotated reference procedure code, stack adapters, raw logs, and containerized test environment ensuring deterministic builds and measurements. The detailed corpus construction and environment info is in supplementary materials.

Technical innovations

• A specification-derived four-layer verifier model (recognition, enforcement, policy, lifecycle) that precisely distinguishes classical RFC 5280 path acceptance from true hybrid authentication in PQ/T certificate validation.
• A multi-stack, multi-scheme empirical measurement isolating semantic gaps in hybrid certificate validation across seven independent codebases and nine validation modes.
• Identification and formalization of the 'criticality trap' where the non-critical marking of post-quantum evidence extensions structurally enables silent downgrade vulnerabilities.
• A policy-parametric executable reference procedure (verifier contract) that explicitly defines all checks a verifier must perform to confirm hybrid authentication under a hybrid-required policy.
• Discovery of lifecycle desynchronization failure modes violating hybrid-authentication assumptions where revoked post-quantum credentials fail to impact acceptance when classical certificates remain valid.

Datasets

• Synthetic PQ/T Hybrid Certificate Corpus — hundreds of certificates across six schemes (two pure PQ, four hybrid atomic/separable) — deterministically generated with fixed randomness and validity; not public beyond reproducibility package

Baselines vs proposed

• Classical RFC 5280 Path Validation: Accept-Hybrid metric = near 0% for separable schemes under default stacks; Accept-Classical metric = >90% acceptance without outcome-bearing PQ evidence
• Bouncy Castle default path versus policy-parametric reference contract: default accepts classical path only, contract flags missing post-quantum enforcement
• wolfSSL default mode: classical acceptance without PQ enforcement; wolfSSL enforcing mode: PQ enforcement enabled but causes interoperability fractures
• Atomic Composite schemes: loud-fail or hybrid-verified (enforces both signatures), showing strict binding avoids downgrade

Limitations

• The sample includes only open-source or widely used libraries; commercial and embedded stacks are out of scope.
• Measurement focuses on default validation paths; alternate opt-in enforcement APIs are less extensively explored.
• Certain lifecycle states (e.g., unknown OCSP status, absent responders) are modeled rather than measured live.
• The executable policy contract is a reference oracle, not a production validator, so practical integration challenges remain unaddressed.
• The paper does not propose new hybrid certificate formats; it studies existing standards and libraries as they stand.
• The interoperability fractures observed indicate standards ambiguity, but no mechanism for reconciliation or standard update is provided.

Open questions / follow-ons

• How might standards evolve to require criticality or equivalent binding enforcement of post-quantum evidence to eliminate silent downgrade risks?
• What mechanisms could protocol negotiation and continuity defenses add atop verifier semantics to detect or prevent downgrade attacks?
• How practical is integrating the executable, policy-parametric verifier contract into production PKI stacks without inducing interoperability fractures?
• Can new hybrid certificate formats be designed that balance compatibility and enforceable binding without relying on non-critical extensions?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners relying on strong cryptographic authentication in PKI-based systems, this study highlights a subtle but consequential semantic gap in post-quantum migration efforts. Hybrid X.509 certificates, heavily considered for future-proof identity assertions, may by default be validated only on classical evidence, silently downgrading guarantees against quantum-capable attackers. This undermines assumptions about the strength of authentication in TLS or other certificate-validated protocols often underlying bot-detection or CAPTCHA challenge gating. Defensive architectures should not rely solely on the presence of a hybrid certificate but must confirm that verifiers recognize and enforce post-quantum evidence as outcome-bearing. Understanding these semantics can help design validation policies, stack configurations, or additional protocol-level checks (e.g., pinned post-quantum signatures or continuity extensions) to maintain true hybrid authentication and avoid downgrade-induced bypasses by sophisticated adversaries.

Cite

@article{arxiv2607_20800,
  title={ Classical Acceptance Is Not Hybrid Authentication: Measuring X.509 Verifier Semantics in Post-Quantum Migration },
  author={ Taesung Kim and Boheung Chung and Keonwoo Kim and Yousung Kang },
  journal={arXiv preprint arXiv:2607.20800},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.20800}
}

Read the full paper

• arXiv:2607.20800 (abstract)
• arXiv:2607.20800 (PDF)