Post-quantum signatures in Arcane 2.10.0
Arcane 2.10.0 adds support for ML-DSA-87, the post-quantum signature algorithm standardized in NIST FIPS 204.
Arcane 2.10.0 brought in support for ML-DSA-87. That is the post quantum signature method from NIST FIPS 204. The release uses it for signing keys the system controls. Session tokens and fresh edge certificates now rely on it. Passkeys and federated logins can switch over too if the device or provider allows. Older methods stay around for compatibility.
RSA and ECDSA still work fine against current machines. The worry is a future quantum computer might handle them. It does not feel like an emergency. The standard and libraries are ready so the switch happens while migration stays simple.
Session tokens
New session tokens get an ML-DSA-87 key generated by Arcane itself. Refresh tokens and federated ones follow the same pattern. The key gets encrypted at rest using the existing ENCRYPTION_KEY.
Passkeys and federated identity
Passkeys now lean toward ML-DSA when the authenticator supports it. If not the process falls back. Old passkeys keep working without any re registration.
OIDC and workload tokens can be checked when they arrive with ML-DSA signatures. Classical ones continue to validate until the provider changes.
Edge certificates
Edge certificates issued after the upgrade use the new algorithm. Existing CAs do not get replaced. Agents stay enrolled as before.
Cookies and TLS
Cookie headers can grow because the signatures are bigger. They might split into four pieces and reach five or six kilobytes total. Reverse proxies usually handle it but some need the buffer limit raised. See the reverse proxy guide for configuration examples.
TLS 1.3 becomes required for new edge connections that use these certificates. Proxies in the middle should support it or the old ECDSA setup stays untouched. See Edge Agent mTLS for details.
Why now
It seems better to move now while everything stays manageable. Token sizes change a bit and header checks matter but there is still time to sort details without pressure. I am not totally sure how the sizes will behave in every environment though.