Composite (AND) vs. Hybrid (OR) Combiners
It's easy to assume "hybrid" always means the same thing, but the combiner logic is opposite depending on what's being protected. A hybrid KEM protects confidentiality: the session stays secure if either the classical or the post-quantum secret holds, since an attacker needs both broken to read the traffic. A composite signature protects authenticity in the other direction: the signature is only considered valid if both components verify, so an attacker needs to forge both a valid ECDSA signature and a valid ML-DSA signature over the same message to produce a fraudulent composite. If ML-DSA ever turned out to have an undiscovered weakness, the ECDSA half alone couldn't be forged either — the composite is exactly as strong as its strongest surviving component for confidentiality-style OR logic, and exactly as strong as needing both broken for this AND logic used in signatures.
Where This Matters
| Use Case | Why AND-Combined Composite Signatures Help |
|---|---|
| Code signing during migration | Verifiers that only understand ECDSA can still check the classical half; PQC-aware verifiers check both |
| Certificate authorities | IETF LAMPS drafts define composite and "alternative signature" formats for X.509 certificates carrying both a classical and PQC signature |
| Long-term document signing | Documents signed today need to resist forgery decades from now, when ECDSA alone may no longer be trusted |
Note the trade-off: composite signatures are larger (this tool's format is simple length-prefixed concatenation, not the formally specified ASN.1 encoding IETF drafts define) and require verifying two signatures instead of one. That cost buys unforgeability against an adversary who has only broken one of the two algorithms.