Where Symmetric Assumptions Are Load-Bearing: Hash-Based Signatures, KDFs, and the PQC Standards Themselves

The post-quantum conversation frames symmetric cryptography as a footnote — a mild Grover adjustment while the real drama plays out in public-key. This final article argues the opposite: the symmetric and hash world is the load-bearing foundation of the entire post-quantum edifice. The most conservative post-quantum signatures rest on nothing but hashing; the new lattice standards themselves lean pervasively on symmetric primitives; and the key-derivation, authentication, and commitment layers that hold every protocol together are symmetric through and through. Understanding where these assumptions are load-bearing is the fitting conclusion to a series on symmetric cryptography in the quantum era, and to the whole cryptography track.

Hash-based signatures rest on hashing alone

Hash-based signatures are the purest expression of how much can be built on a hash function alone. Schemes like the stateless SLH-DSA (standardized from SPHINCS+) and the stateful LMS and XMSS construct a full digital-signature scheme whose security reduces entirely to standard properties of a hash function — pre-image, second-pre-image, and collision resistance. There is no number-theoretic problem, no lattice, no new structure to trust: if the hash function is secure, the signature is secure, full stop.

This makes hash-based signatures the most conservative post-quantum choice available. Every other post-quantum signature rests on a hardness assumption that is either newer than we would like or less exhaustively studied than the symmetric primitives, whereas a hash-based signature introduces no assumption beyond the one the whole field already relies on for hashing. Its quantum security follows directly from the previous articles: pre-image resistance is only quadratically affected by Grover, so with adequate output length these signatures stand on the firmest ground in the post-quantum landscape.

The trade-off is practical rather than foundational — hash-based signatures are large and, for the stateful variants, require careful state management to avoid reusing a one-time key. But where conservatism matters most, they are the reference. Firmware signing, secure-boot roots of trust, and long-lived artifact signing increasingly favor them precisely because their security rests on the best-understood primitive in cryptography, and because that primitive degrades only gently under quantum attack. When a signature must be trusted for decades, resting it on hashing alone is the safest bet.

Symmetric primitives inside the lattice standards

The more surprising fact is that the flagship lattice standards do not stand apart from the symmetric world — they lean on it heavily. ML-KEM and ML-DSA use SHAKE, the extendable-output function from the SHA-3 family, pervasively throughout their constructions. It hashes messages and public keys, expands short seeds into the large pseudorandom matrices and vectors the schemes need, samples coefficients from the required distributions, and derives the shared secrets. Strip out the symmetric primitive and the lattice scheme does not function.

It is also load-bearing for security, not just plumbing. The Fujisaki-Okamoto transform that gives ML-KEM its strong (chosen-ciphertext) security hinges on a re-encryption step whose hash must behave like a random oracle; ML-DSA's Fiat-Shamir structure derives its challenge from a hash, exactly as the zero-knowledge series described. The security proofs of these lattice standards therefore invoke assumptions about the hash and pseudorandom functions alongside the lattice assumption — the scheme is secure if the lattice problem is hard and the symmetric primitive behaves well. The symmetric assumption is a genuine part of the foundation.

This means a quantum weakness in the symmetric layer would undermine the lattice standards too, which is another reason the conservative symmetric analysis of this series matters. Fortunately the conclusion is reassuring: SHA-3 and SHAKE are only quadratically affected by quantum search, and the standards are parameterized with adequate output sizes, so the symmetric components hold up. But the dependency is real and worth naming — the post-quantum public-key standards are not an alternative to symmetric cryptography; they are built on top of it.

The broader symmetric layer

Beyond signatures and the internals of lattice schemes, a whole layer of symmetric machinery holds every real protocol together. Key-derivation functions like HKDF turn a raw shared secret — including the one a post-quantum key exchange produces — into the working keys a session uses, and they are built from hash-based message-authentication codes. Message-authentication codes protect integrity; commitments (as the zero-knowledge and MPC series used) are built from hashes; and pseudorandom functions and generators supply the randomness everything else consumes. None of this is public-key, and all of it is essential.

This layer is quantum-durable for the same reasons the rest of the series established: it rests on hash and block-cipher assumptions that Grover only quadratically weakens and the birthday bound governs, so adequate parameters — 256-bit keys, 256- or 384-bit hashes — keep it strong. When a hybrid post-quantum handshake completes, it is a symmetric key-derivation function that turns the negotiated secret into the keys, a symmetric AEAD that then protects the data, and a symmetric MAC or committing construction that guards integrity. The public-key layer establishes trust; the symmetric layer does the ongoing work.

Seen as a stack, the picture is clear. Applications sit on top; post-quantum public-key schemes establish keys and identities; and beneath them a symmetric and hash foundation — AES, SHA-2, SHA-3, SHAKE, HKDF, the MACs and commitments — carries the actual load of protecting data and even of implementing the public-key schemes. That foundation is the oldest, most scrutinized, and most quantum-durable part of the whole edifice, which is precisely why it can bear the weight.

The synthesis, and the AI stakes

The through-line of this series inverts the usual framing. Symmetric cryptography is not the quiet corner of the post-quantum story that needs only a Grover footnote; it is the bedrock the whole structure stands on. Hash-based signatures rest on it alone and are the most conservative post-quantum signatures for that reason; the lattice standards are built on top of it and would fall without it; and the key-derivation, authentication, and commitment layer that every protocol needs is symmetric and quantum-durable. The symmetric and hash foundation is the best-understood, least-likely-to-fail part of cryptography, and doubling key lengths and hash sizes is all it needs to remain so.

This closes the argument the whole series made. Grover only halves key strength, collision resistance is barely touched, AES-256 and SHA-384 are the safe floor, committing AEAD closes the multi-key gap, and the symmetric layer is load-bearing everywhere — including inside the new public-key standards. The reassuring conclusion is that the part of cryptography we understand best is also the part that survives the quantum transition most intact, and it is the part that the rest of the edifice, new mathematics included, ultimately relies on. Post-quantum readiness is as much about using the symmetric floor correctly as about adopting new public-key schemes.

For AI this is where the stakes come home. The long-lived assets that matter most — model weights representing enormous training investment, training-data archives with decade-scale sensitivity, and the integrity of the entire model supply chain — are protected, at bottom, by symmetric encryption and hashing. A model encrypted at rest under AES-256, its integrity guaranteed by SHA-384, its provenance signed by a hash-based signature, and its keys derived by a symmetric key-derivation function from a post-quantum-established secret, is durably secure into the quantum era on foundations we understand better than any other in cryptography. Across this whole track — from the quantum threat and lattice foundations through migration, implementation security, confidential computing, verifiable inference, and collaborative learning — the recurring lesson is that the primitives which endure are the conservative, well-studied, symmetric and hash-based ones. They are the load-bearing foundation of post-quantum security, and they are what will keep AI's most valuable and longest-lived assets safe when the quantum era arrives. That is the note to end on: build on the bedrock, size it generously, and the rest of the structure can be trusted to stand.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

symmetric_foundation:
  conservative_signatures: [slh_dsa, lms, xmss]
  lattice_standards_use: shake
  layer:
    kdf: hkdf
    mac: hmac
    aead: aes_256_committing
    hash: [sha_256, sha_384]
  ai_long_lived_assets:
    weights_at_rest: aes_256
    integrity: sha_384
    provenance: hash_based_signature

Glossary

Hash-based signature

A signature scheme (SLH-DSA, LMS, XMSS) whose security reduces entirely to hash-function properties, with no other assumption.

SLH-DSA

The stateless hash-based signature standard (from SPHINCS+), resting only on hash security.

SHAKE

An extendable-output function from the SHA-3 family, used pervasively inside ML-KEM and ML-DSA.

Key-derivation function (KDF)

A symmetric construction (e.g., HKDF) that turns a shared secret into working keys, built from hash-based MACs.

Load-bearing assumption

A security assumption the system genuinely depends on; here, the hash/symmetric assumptions underpinning even the lattice standards.

Symmetric foundation

The layer of AES, SHA, SHAKE, KDFs, MACs, and commitments on which applications and post-quantum public-key schemes both rest.

References

1. NIST FIPS 205, Stateless Hash-Based Digital Signature Standard (SLH-DSA)
2. NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
3. NIST FIPS 204, Module-Lattice-Based Digital Signature Standard (ML-DSA)
4. McGrew, Curcio, Fluhrer, Leighton-Micali Hash-Based Signatures / LMS (RFC 8554)
5. Krawczyk, Eronen, HMAC-based Extract-and-Expand Key Derivation Function / HKDF (RFC 5869)