SPDX-License-Identifier: MPL-2.0
SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council

================================================================================
EXHIBIT B - QUANTUM-SAFE PROVENANCE SPECIFICATION
================================================================================

Supplement to Palimpsest-MPL License v1.0

--------------------------------------------------------------------------------
PURPOSE
--------------------------------------------------------------------------------

This specification defines cryptographic requirements for post-quantum
provenance signatures. As quantum computing advances, traditional digital
signatures (RSA, ECDSA) will become vulnerable. This exhibit ensures that
provenance information remains verifiable for the lifetime of creative works.

--------------------------------------------------------------------------------
APPROVED ALGORITHMS
--------------------------------------------------------------------------------

The following post-quantum cryptographic algorithms are approved for
Quantum-Safe Signatures under this License:

1. ML-DSA (Module-Lattice Digital Signature Algorithm)
   - FIPS 204 (formerly CRYSTALS-Dilithium)
   - Security levels: ML-DSA-44, ML-DSA-65, ML-DSA-87
   - RECOMMENDED for general use

2. SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)
   - FIPS 205 (formerly SPHINCS+)
   - Security levels: SLH-DSA-128s/f, SLH-DSA-192s/f, SLH-DSA-256s/f
   - RECOMMENDED for high-assurance use cases

3. FN-DSA (FFT over NTRU-Lattice Digital Signature Algorithm)
   - FIPS 206 (formerly FALCON)
   - Security levels: FN-DSA-512, FN-DSA-1024
   - Approved for use where signature size is critical

4. Hybrid Schemes
   - Combinations of approved PQC algorithms with classical algorithms
   - Example: ML-DSA + Ed25519
   - RECOMMENDED for transition period (2025-2035)

--------------------------------------------------------------------------------
SIGNATURE FORMAT
--------------------------------------------------------------------------------

Quantum-Safe Signatures for Covered Software MUST use the following format:

    -----BEGIN PALIMPSEST SIGNATURE-----
    Version: PMPL-SIG/1.0
    Algorithm: <algorithm-identifier>
    Signer: <signer-identity>
    Timestamp: <ISO-8601-timestamp>
    Content-Hash: <sha3-256-hash-of-content>

    <base64-encoded-signature>
    -----END PALIMPSEST SIGNATURE-----

Where:
- <algorithm-identifier> is one of: ML-DSA-65, SLH-DSA-256s, FN-DSA-1024, etc.
- <signer-identity> is an email, URL, or cryptographic key identifier
- <ISO-8601-timestamp> is the signing time in UTC
- <sha3-256-hash-of-content> is the SHA3-256 hash of the signed content

--------------------------------------------------------------------------------
PROVENANCE CHAIN
--------------------------------------------------------------------------------

For derivative works, the provenance chain SHOULD be maintained:

    -----BEGIN PALIMPSEST PROVENANCE-----
    Version: PMPL-PROV/1.0

    Contribution: <contribution-hash>
    Author: <author-identity>
    Date: <ISO-8601-date>
    Signature: <signature-reference-or-inline>

    Parent: <parent-contribution-hash>
    Parent: <parent-contribution-hash>
    ...
    -----END PALIMPSEST PROVENANCE-----

This creates a directed acyclic graph (DAG) of contributions that can be
verified cryptographically.

--------------------------------------------------------------------------------
KEY MANAGEMENT
--------------------------------------------------------------------------------

1. Key Generation
   - Generate keys using cryptographically secure random number generators
   - Store private keys securely (hardware tokens recommended)
   - Publish public keys via HTTPS or signed key servers

2. Key Distribution
   - Public keys SHOULD be published at:
     - .well-known/pmpl-keys.json on contributor's domain
     - Major key servers (keys.openpgp.org with PQC extension when available)
   - Keys SHOULD be cross-signed by known community members

3. Key Rotation
   - Rotate keys at least every 5 years
   - Sign new keys with old keys before expiration
   - Maintain key history for verification of old signatures

--------------------------------------------------------------------------------
VERIFICATION
--------------------------------------------------------------------------------

To verify a Quantum-Safe Signature:

1. Parse the signature block and extract the algorithm identifier
2. Retrieve the signer's public key from published sources
3. Compute the SHA3-256 hash of the content
4. Verify the signature using the specified algorithm
5. Optionally verify the timestamp against trusted time sources
6. For provenance chains, recursively verify parent signatures

Tools for verification are available in the palimpsest-license repository
under tools/pmpl-verify/.

--------------------------------------------------------------------------------
IMPLEMENTATION LIBRARIES
--------------------------------------------------------------------------------

Recommended cryptographic libraries with PQC support:

- Rust: pqcrypto, oqs-rs
- Go: Cloudflare circl (circl/sign/dilithium)
- Python: liboqs-python
- JavaScript/WASM: liboqs compiled to WASM
- C/C++: liboqs (Open Quantum Safe)

All implementations MUST use libraries that pass NIST validation or are
approved by the Palimpsest Stewardship Council.

--------------------------------------------------------------------------------
TRANSITION PERIOD
--------------------------------------------------------------------------------

During the transition period (2025-2035):

1. Hybrid signatures (PQC + classical) are RECOMMENDED
2. Classical-only signatures remain valid if signed before 2030
3. PQC-only signatures are required for new signatures after 2030
4. Systems SHOULD support verification of both classical and PQC signatures

After 2035:
- Classical-only signatures are considered deprecated
- Verification systems MAY refuse to validate classical-only signatures
- All new signatures MUST use PQC algorithms

--------------------------------------------------------------------------------
ALGORITHM UPDATES
--------------------------------------------------------------------------------

The Palimpsest Stewardship Council will update the approved algorithm list
as cryptographic research advances. Updates will be published:

- In new versions of this exhibit
- On the project website
- Via the project mailing list/announcements

Algorithm deprecation will follow a minimum 2-year notice period.

--------------------------------------------------------------------------------
REFERENCES
--------------------------------------------------------------------------------

- NIST Post-Quantum Cryptography: https://csrc.nist.gov/projects/post-quantum-cryptography
- FIPS 204 (ML-DSA): https://csrc.nist.gov/pubs/fips/204/final
- FIPS 205 (SLH-DSA): https://csrc.nist.gov/pubs/fips/205/final
- FIPS 206 (FN-DSA): https://csrc.nist.gov/pubs/fips/206/final
- Open Quantum Safe: https://openquantumsafe.org/

--------------------------------------------------------------------------------
END OF EXHIBIT B
--------------------------------------------------------------------------------
