C2PA vs. Post-Quantum Signatures
This page compares signature approaches at the standards level: the classical cryptographic algorithms most C2PA manifests use today versus post-quantum algorithms like ML-DSA. It is not a comparison of Certivu the product against C2PA the standard — see Certivu vs C2PA for that. The distinction matters because a signature's usefulness depends on the algorithm underneath it staying unbroken for as long as the content needs to be trusted.
What C2PA manifests are typically signed with
The C2PA specification recommends signing manifests with ES256 (ECDSA on the P-256 curve), EdDSA (Ed25519), or PS256 (RSA-PSS) — all classical, pre-quantum algorithms built on integer factoring or elliptic-curve discrete logarithm problems. These algorithms are mature, fast, and broadly supported by existing tooling, which is exactly why they were chosen for a standard designed for wide, immediate interoperability. C2PA the specification is not inherently tied to classical algorithms, but classical algorithms are what today's deployed C2PA signing tools and trust lists overwhelmingly use.
Why post-quantum signatures are a different bet
ML-DSA (standardized as NIST FIPS 204) instead relies on structured lattice problems, which have no known efficient algorithm for either classical or quantum computers. The distinction matters most for content that needs to stay verifiable over a long horizon: a manifest signed with ECDSA or RSA today could, in principle, become forgeable once large-scale quantum computers exist, while a manifest signed with ML-DSA is designed to resist that specific threat from the outset. Neither approach is wrong for its intended purpose — classical algorithms remain a reasonable default for short-lived, low-stakes signing — but for archival, legal, or compliance-relevant content, the algorithm choice compounds over time.
How this shows up in practice
Certivu embeds real C2PA manifests into JPEG and PNG files, but signs them with ML-DSA instead of a classical algorithm — the manifest is structurally standard, but the signature inside it is post-quantum. Because most C2PA-aware verifiers currently expect classical algorithms, they may report Certivu's signature algorithm as unrecognized even though the manifest itself is valid and interoperable; that's a today-limitation of deployed C2PA tooling, not a defect in the manifest.
Source: C2PA Implementation Guidance — recommended signature algorithms
FAQ
Does the C2PA standard require classical (non-post-quantum) signatures?
No — the specification itself isn't limited to any one algorithm family. In practice, though, the algorithms C2PA's implementation guidance recommends, and that today's signing/verifying tools support, are classical: ECDSA, Ed25519, and RSA.
Are classical C2PA signatures insecure right now?
No. ECDSA, Ed25519, and RSA are all secure against any computer that exists today. The concern is forward-looking: a large-scale quantum computer, if and when one exists, is expected to be able to break these algorithms, which matters for signatures that need to stay trustworthy for years or decades.
Is this the same comparison as Certivu vs C2PA?
No, that's a different, product-level comparison of Certivu the service against C2PA the standard. This page compares signature algorithms in the abstract — classical vs. post-quantum — independent of any specific vendor.