Agent-008 — Agent GovernanceHATS — Cyber InsuranceH33-74 — Portable ProofH33-You — Living IdentityCryptographic APIs
AIR
The Cryptographic Lifecycle
How It WorksWatch DemoThe MapPatent Portfolio
Architecture
H33-RootAgent-ZeroQ-SignReplayTruth
Cryptographic Services
UpstreamFHE-IQBFVCKKSTFHE
Open Standards
HATSHICSPQ-Verified (New)CRVOISQ-Key
Verification
Conformance SuiteVerification GuaranteesHATS SpecificationArchitectureProtocol Stability
Proof Lab
Cyber Insurance (HATS)BankingGovernmentHealthcareLaw FirmsPayments (WireProof)AI Companies
SDKs & Tools
SDKs HubTypeScript SDKMCP SDKVerifier CLIGitHub
References
DocumentationAPI ReferenceConformance VectorsSchemasBenchmarks
AboutPressPartnersPricingContactLegal
StartEcosystem
White PapersBenchmarksProofsResearch Overview
Explore (579)Live Systems (52)Pricing
Log InGet API Key✓ Verify It Yourself
Patent Pending · FIPS 204 + FIPS 206
Built on H33-74 →

One Signature.
Three Mathematical Families.
Zero Single Points of Failure.

Related · tier-1 reading. For what a portable artifact actually is, see Portable Artifact.

The 3-Key signature is what makes every governed decision in the Agent-008 enterprise AI governance platform provable for the long term — three independent post-quantum families chained so the signature still verifies decades from now.

H33-3-Key chains three independent PQ signature families through the H33 Substrate — 74 bytes total attestation (32 on-chain, 42 cached). Dilithium (MLWE lattice), FALCON (NTRU lattice), and SPHINCS+ (hash-based) each sign the same substrate-derived message. No single algorithm break can unravel the attestation. No validator changes. No block size impact.

Get API Key Run Live Demo Read the Docs
~0µs
Triple Sign
~0µs
Triple Verify
~0B
Signature Size
0
Independent Families
The Problem

Every Post-Quantum Deployment Today
Bets on a Single Family

If that family breaks — through mathematical advance, side-channel, or supply-chain backdoor — everything signed with it is retroactively compromised. No migration path exists.

🔎
Mathematical Break
A new algorithm significantly reduces the cost of solving MLWE or NTRU SVP. All signatures using that family become forgeable overnight. Single-algorithm deployments: total compromise.
⚡
Implementation Vulnerability
Timing side-channels or fault injection exposing secret key material. Highly algorithm-specific — a Dilithium side-channel doesn't affect FALCON. Single algorithm: no fallback.
🔒
Algorithmic Backdoor
A deliberately weakened parameter set or hidden trapdoor introduced during standardization. Historical precedent exists (Dual EC DRBG). Single algorithm: undetectable compromise.
How It Works

The Temporal Binding Chain

Each outer layer signs everything beneath it. The result is a cryptographic dependency chain — breaking any single layer is never enough to forge the composite.

Layer 1 · Inner ---
Ed25519 signs the payload
Classical anchor. Signs the raw identity payload to produce σ₁ (64 bytes). This survives any lattice break — ECDLP is entirely independent mathematics.
RFC 8032 Curve25519 ECDLP hardness 64 B
composite₁ = payload ‖ σ₁
Layer 2 · Middle ---
Dilithium-5 signs payload ‖ σ₁
Module-LWE post-quantum signature. By committing to σ₁, Dilithium proves the classical signature existed at this exact moment. Breaking Dilithium alone still requires forging Ed25519.
FIPS 204 ML-DSA-87 MLWE + MSIS 4,627 B
composite₂ = payload ‖ σ₁ ‖ σ₂
Layer 3 · Outer ---
FALCON-512 signs payload ‖ σ₁ ‖ σ₂
NTRU lattice post-quantum signature. Commits to the entire prior chain. To forge this document, an adversary must break ECDLP, MLWE, and NTRU SVP simultaneously.
FIPS 206 FN-DSA-512 NTRU SVP ~666 B
Click "Sign Payload" to watch the temporal binding chain build in real time
Interactive Simulator

What If an Algorithm Breaks?

Click each algorithm to simulate a cryptographic break. Watch how the nested structure degrades gracefully — the signature remains unforgeable until all three independent families fall.

Ed25519 Secure
Elliptic Curve · ECDLP (Curve25519)
Dilithium-5 Secure
Module Lattice · MLWE + MSIS
FALCON-512 Secure
NTRU Lattice · NTRU SVP (SIS)
🛡️
Signature Unforgeable
All three algorithm families are intact. The nested hybrid signature provides maximum security across three independent mathematical hardness assumptions.
Ed25519
Dilithium-5
FALCON-512
Single-Algorithm vs H33-3-Key
Dilithium-only deployment Secure
FALCON-only deployment Secure
Ed25519-only deployment Secure
H33-3-Key nested Unforgeable
Live Demo

Run a Real Triple-Key Operation

This calls our production Graviton4 infrastructure. Real KeyGen, real Sign, real Verify. Not a simulation.

H33-3-Key Pipeline
POST /api/v1/demo/run-3key
1
Triple Key Generation
Ed25519 + Dilithium-5 (ML-DSA-87) + FALCON-512
---
2
Nested Triple Sign
Ed25519 → Dilithium-5 → FALCON-512 (temporal chain)
---
3
Nested Triple Verify
FALCON → Dilithium → Ed25519 (outer-in, fail-fast)
---
Total: ---
Performance

Benchmarked on Graviton4

All measurements on c8g.metal-48xl (96 cores, AWS Graviton4, ARM Neoverse V2). Criterion.rs v0.5, 100+ samples. February 2026.

~0
microseconds
Full triple sign
~0
microseconds
Full triple verify
~0
microseconds
Full cycle (sign + verify)
Sign Breakdown
Ed25519~50µs
Dilithium-5 (ML-DSA-87)~330µs
FALCON-512~70µs
Total~450µs
Verify Breakdown (Outer-In)
FALCON-512 (outermost first)~55µs
Dilithium-5~150µs
Ed25519~35µs
Total~240µs
Wire Format

Signature Anatomy: Version 0x03

Hover over the byte blocks to explore every field of the ~5,390-byte nested hybrid signature blob.

TripleHybridSignature · v0x03 ~5,390 bytes total
Hover to explore
Move your cursor over the byte blocks to see what each section of the signature contains.
Features

Engineered for Algorithmic Independence

Every design decision serves one goal: no single algorithm compromise breaks the system. From nested composition to constant-time implementation, H33-3-Key is defense-in-depth by construction.

🔑
Three Independent Keys
Ed25519 (classical) + Dilithium-3 (PQ lattice) + SPHINCS+ (PQ hash-based). No single algorithm compromise breaks the system.
3 families
📚
Nested Composition
Inner signature (Ed25519) wrapped by middle (Dilithium-3) wrapped by outer (SPHINCS+). Mathematical proof that security = max(individual securities).
Provable security
🛡️
Graceful Degradation
If any algorithm is broken, the remaining two maintain full security. Automatic fallback with zero application code changes.
Zero-downtime fallback
⏱
Constant-Time Implementation
No branch-dependent timing in any signing path. Zeroize + ZeroizeOnDrop for all key material. Side-channel resistant by construction.
Side-channel safe
👤
Algorithm-Agnostic Identity
Your identity hash derives from the composite signature, not individual algorithms. Swap algorithms without changing identity.
Future-proof identity
⚡
Sub-Millisecond Signing
Full 3-key nested sign+verify in under 800µs. Ed25519 (~50µs) + Dilithium-3 (~200µs) + SPHINCS+ (~500µs). Parallelizable verification.
<800µs total
Use Cases

Built for High-Stakes Signing

Triple-key nested signatures protect the documents, transactions, and artifacts where a single algorithm failure would be catastrophic.

🏛️
Government & Defense Signing
CNSA 2.0 compliant document signing. Three-layer protection ensures classified documents remain authenticated even if quantum computers break one algorithm.
CNSA 2.0
💰
Financial Transaction Authorization
Multi-algorithm signing for wire transfers, trade confirmations, and regulatory filings. Non-repudiable with Dilithium audit trail.
Non-repudiation
📦
Code Signing & Software Supply Chain
Sign releases with 3-key composition. Even if one algorithm is compromised, attackers cannot forge valid signatures. Backward-compatible verification.
Supply chain
🏥
Healthcare Record Authentication
HIPAA-compliant record signing. Three independent verification paths ensure medical records are provably authentic for regulatory retention periods (7+ years).
HIPAA compliant
Use Cases

Who Needs This

Triple nesting is for documents, tokens, and attestations that must remain valid for decades — where a single algorithm break would be catastrophic.

⛓️
Soulbound NFTs
Non-transferable identity tokens are permanent. If Dilithium breaks in 2035, a token minted today with only Dilithium is retroactively forgeable. Triple nesting survives any single-algorithm break throughout the token's entire lifetime.
Lifetime-critical
⚖️
Legal Documents
Contracts, wills, court filings, and title deeds are signed once and must remain valid for decades. Triple nesting provides the temporal binding that courts can audit even if one algorithm is later deprecated.
Decades-valid
📦
Software Supply Chain
Binary attestation and release signing. Software artifacts signed with a single PQ algorithm create a single point of failure for the entire distribution chain. Nested hybrid signing closes this gap.
Critical infrastructure
🌐
Cross-Border Compliance
Different jurisdictions standardize on different PQ families. A nested signature satisfying both MLWE (EU/NIST) and NTRU simultaneously eliminates re-signing for cross-border recognition.
Multi-jurisdiction
FAQ
Frequently Asked Questions
Why three signatures instead of one?
Defense in depth. Each signature algorithm relies on a different mathematical hardness assumption. If a future breakthrough (quantum computing, novel attack) breaks one algorithm, the remaining two still protect the document. One algorithm failing is survivable. Two failing simultaneously is extraordinarily unlikely because they are from independent mathematical families (elliptic curves, structured lattices, and hash functions). This is the cryptographic equivalent of three independent locks on a vault door.
What does temporal binding mean?
Temporal binding chains the three signatures in sequence so each signature covers the previous one. The ECDSA signature signs the document. The Dilithium signature signs the document plus the ECDSA signature. The FALCON signature signs the document plus both prior signatures. This creates a tamper-evident chain where modifying or removing any layer invalidates all subsequent layers. It also embeds a timestamp at each layer, proving the exact order and time of signing.
Which three algorithms are used?
Layer 1: Ed25519 (elliptic curve, immediate backwards compatibility with existing systems). Layer 2: Dilithium-5 / ML-DSA (structured lattice, NIST PQC standard, primary post-quantum layer). Layer 3: FALCON-512 (NTRU lattice, hash-based structure, independent lattice family from Dilithium). Each layer is from a different mathematical family, maximizing cryptographic diversity.
What happens if one algorithm is broken?
The document remains protected by the two surviving algorithms. For example, if a quantum computer breaks Ed25519, the Dilithium and FALCON layers still provide full post-quantum security. If a novel lattice attack weakens Dilithium, Ed25519 and FALCON still hold. The temporal binding chain means an attacker must break all three algorithms to forge a signature. Verification succeeds as long as at least one layer is intact, with the verifier reporting which layers are valid.
What is the performance overhead of triple signing?
The full triple sign cycle takes approximately ~690 microseconds on Graviton4. Broken down: Ed25519 sign is ~30 microseconds, Dilithium-5 sign is ~280 microseconds, and FALCON-512 sign is ~380 microseconds. Verification is faster at roughly 450 microseconds total. For comparison, a single Dilithium sign alone is ~280 microseconds, so the overhead of adding two more layers is roughly 2.5x, not 3x, due to pipelining.
When should I use 3-Key vs single Dilithium?
Use 3-Key for long-lived artifacts that must remain valid for decades: regulatory filings, legal contracts, certificate chains, notarized documents, and archival records. Use single Dilithium for short-lived tokens, session authentication, and real-time API attestation where the signature only needs to be valid for hours or days. The cost difference is 5 credits (3-Key) vs 1 credit (single Dilithium sign).
How large is a triple-nested signature?
Ed25519 signature: 64 bytes. Dilithium-5 signature: ~4,627 bytes. FALCON-512 signature: ~690 bytes. Total: approximately ~5.4 KB for the complete triple signature envelope. The envelope also includes timestamps, algorithm identifiers, and the temporal binding chain metadata, bringing the total to roughly 6 KB. This is compact enough to embed in PDF metadata, X.509 certificates, or blockchain transactions.
What is the verification time?
Full triple verification takes approximately ~450 microseconds: Ed25519 verify (~15 microseconds), Dilithium-5 verify (~130 microseconds), and FALCON-512 verify (~305 microseconds). The verifier can optionally perform early-exit verification, checking only the first layer for quick validation and deferring the full chain for audit. Parallel verification of all three layers is also supported, reducing wall-clock time to roughly 310 microseconds.
Is triple signing overkill for short-lived tokens?
Yes, generally. For JWT tokens, session cookies, and API request signatures that expire in hours, a single Dilithium signature provides sufficient post-quantum security. The threat model for short-lived tokens does not include "adversary breaks a NIST-standardized algorithm within the token's lifetime." Reserve 3-Key for artifacts where the cost of a future signature break would be catastrophic, such as land titles, medical records, or financial instruments.
How does H33-3-Key align with the NIST PQC transition timeline?
NIST recommends organizations begin transitioning to post-quantum algorithms by 2025 and complete migration by 2035. H33-3-Key exceeds this guidance by providing two post-quantum layers (Dilithium + FALCON) alongside a classical layer (Ed25519) for backwards compatibility. This means documents signed today will be valid through the entire NIST transition period and beyond, regardless of which algorithms are deprecated or broken during the transition.
Can I choose which algorithms to include?
The default triple stack (Ed25519 + Dilithium-5 + FALCON-512) is recommended for maximum security diversity. Custom configurations are available for enterprise customers. You can substitute Ed25519 with ECDSA P-256 for FIPS compliance, or replace FALCON with SPHINCS+ for a hash-based alternative. The API accepts an algorithm_config parameter to specify the desired triple stack. Minimum two layers are required; single-algorithm signing uses the standard H33-128 endpoints.
Is H33-3-Key backwards compatible with ECDSA-only verifiers?
Yes. The triple signature envelope includes the Ed25519/ECDSA signature as an independently verifiable first layer. Legacy verifiers that only understand ECDSA can extract and verify the first layer while ignoring the Dilithium and FALCON layers. This means you can deploy 3-Key today without waiting for every verifier in your ecosystem to support post-quantum algorithms. Full-chain verifiers validate all three layers.
How does H33-3-Key work in certificate chains?
Each certificate in the chain carries its own triple signature. The root CA signs with 3-Key, intermediate CAs sign with 3-Key, and end-entity certificates carry a 3-Key signature from the issuing CA. Verification walks the chain, checking all three layers at each level. If a future algorithm break compromises one layer, the chain remains valid through the surviving layers. This provides quantum-resistant PKI without a forklift upgrade of existing X.509 infrastructure.
Can H33-3-Key be used with TLS?
H33-3-Key is designed for document and artifact signing, not TLS handshakes. TLS requires real-time key exchange and session establishment where triple signing would add unnecessary latency. For TLS, H33 offers Kyber (ML-KEM) key encapsulation with Dilithium server authentication through the post-quantum TLS product. However, TLS server certificates can be signed with 3-Key if you want the certificate itself to carry triple protection for its validity period.
What does a triple signature cost?
A single 3-Key sign operation costs 5 credits. Verification is free (verifiers do not consume credits). The free tier includes 1,000 credits per month, which covers 200 triple signatures. For bulk document signing (contracts, certificates, regulatory filings), volume pricing reduces the per-signature cost. Compare to single Dilithium at 1 credit per sign, the 3-Key premium is 4 credits for the additional two algorithm layers and temporal binding chain.
TECHNICAL DEEP DIVES

Go Deeper

📝 DEEP DIVE
Nested Hybrid Signatures: Why One Algorithm Isn't Enough
The full technical breakdown — Ed25519 inner, Dilithium-5 middle, FALCON-512 outer, temporal binding chain.
Read Full Article →
⚔️ COMPARISON
FALCON vs Dilithium: Post-Quantum Signature Comparison
Lattice vs hash-based, key sizes, signing speed, verification cost — which PQ signature scheme wins where.
Read Full Article →
✍️ ML-DSA
CRYSTALS-Dilithium Digital Signatures
NIST FIPS 204 standardized ML-DSA. How it works, performance benchmarks, and why it's the middle layer in 3-Key.
Read Full Article →

Ship Algorithmic Independence Today

One API call. Three mathematical families. Zero single points of failure. Free tier included.

Get Free API Key → API Documentation Technical Deep Dive
Free tier · 1,000 hybrid signs/month · No credit card · 10 Patents Pending · 300+ Claims Pending
Verify It Yourself