Add a post-quantum signature to any file
that anyone can verify.
A classical signature keeps your documents valid in Adobe Acrobat and under Malaysia's Digital Signature Act 1997. An external post-quantum signature (ML-DSA or SLH-DSA or Malaysia's KAZ-SIGN) adds quantum resistance. Anyone can verify it. No special software required.
Hybrid signing · Any file type · Public verification portal · PDF · Word · images · media and more
The problem
You can't put a post-quantum signature inside a PDF today
The PDF and CAdES/PAdES signature formats have not yet added the NIST post-quantum algorithms. Standard signing tools can only apply classical RSA/ECC signatures as a result. A large quantum computer would eventually be able to forge those signatures. That puts the long-term validity of everything you sign now at risk.
PDF can't carry a PQC signature
The PDF standard and PAdES/CMS profiles do not define the NIST PQC algorithms as of 2025. No compliant PDF signing tool can embed one natively.
Classical signatures won't survive quantum
RSA and ECC signatures rely on math a quantum computer is expected to break. That puts the long-term validity of today's signed documents at risk.
Signing is stuck on PDF
Most solutions only sign PDFs. Word · Excel · PowerPoint · images · audio · video have no standardised quantum-safe signing path.
No easy way to verify PQC
There is no public and no-software way for a recipient to check a post-quantum signature. Verification usually demands specialised crypto tooling.
A disruptive switch breaks workflows
A PQC-only cutover would break existing verifiers and interoperability. Organisations need a migration path instead of a hard fork.
Legal recognition depends on PKI
Legal standing flows from an X.509 certificate issued by an MCMC-licensed CA under the DSA 1997. A purely PQC certificate has no defined recognition today.
How it works
Two signatures on one document
A hybrid workflow puts a quantum-safe signature on top of a proven classical one. You keep legal validity and interoperability today. You gain quantum resistance for tomorrow.
1 · Classical signature for validity
The document is first signed with a standards-compliant RSA/ECC signature and a visible signature block for PDFs. That gets embedded as a PAdES-based or CMS-based signature. It opens and validates in Adobe Acrobat and Foxit with no extra software. It carries legal standing under the DSA 1997 when the certificate comes from an MCMC-licensed CA.
2 · External PQC signature for quantum resistance
The entire signed file is then hashed and signed again with a NIST post-quantum algorithm: ML-DSA (FIPS 204) or SLH-DSA (FIPS 205) or Malaysia's KAZ-SIGN. This one lives outside the file as an external signature because PDF can't yet hold a PQC signature. That is why the same approach works for any file type and not only PDF.
3 · Anyone verifies with no software needed
The signed document carries a clickable link to a public verification portal. Recipients drag in the file or follow the embedded link or enter a reference ID. They see validity · signer identity · the algorithms used · timestamp · integrity and revocation status. The classical layer stays verifiable in Acrobat. The PQC layer is verified through the portal or API. No client-side PQC software is needed.
Non-PDF files skip the classical step. They are signed directly with the external PQC signature. The original file stays completely unchanged.
The signature package
A verifiable and self-describing record
Every external PQC signature is stored as a package that records the signature value(s) · the signing algorithm identifier(s) · the signer's PQC certificate reference · the original file hash and the signing timestamp. That is everything the verification engine needs to prove integrity and authenticity later.
- Document hashed with the SHA-3 family (SHA3-256 / 384 / 512).
- Sign with one or several PQC algorithms at once for maximum assurance.
- Per-algorithm verification status when multiple signatures are present.
{
"document_hash": {
"alg": "SHA3-512",
"value": "b1f4…c09a"
},
"signatures": [
{
"alg": "ML-DSA-65", // NIST FIPS 204
"standard": "FIPS 204",
"signer_cert_ref": "pqc-ca:signer/2481",
"value": "9d3e…7f21"
},
{
"alg": "SLH-DSA-SHA2-192s", // NIST FIPS 205 (long-term)
"standard": "FIPS 205",
"signer_cert_ref": "pqc-ca:signer/2481",
"value": "0a7c…be44"
}
],
"signed_at": "2026-07-02T09:14:22Z",
"verify_url": "https://verify.mypqc.my/d/DOC-2481-A9"
}
Capabilities
Everything you need to sign and to be believed
Sign any file type
PDFs · Office documents · images · text · audio · video · anything at all. The external PQC signature leaves the original file untouched.
Public verification with zero software
A public no-login portal and REST API let any recipient confirm validity · signer identity · algorithms · timestamp and integrity.
Multi-algorithm assurance
Sign a single document with several PQC algorithms at once (for example ML-DSA plus SLH-DSA). Per-algorithm verification results come with it.
Long-term archival signatures
SLH-DSA (FIPS 205) rests on conservative hash-based assumptions. That makes it well suited to signatures that must hold for decades.
Multi-signer & batch signing
Route documents through multiple signers. Each gets their own visible signature position. Sign in bulk for high-volume workflows.
Crypto-agile by policy
The signing algorithm is a policy choice you can change at any time. Swap or add algorithms as standards and threats evolve. No re-engineering needed.
Managed PQC keys & certificates
Generate classical and PQC keypairs. Obtain X.509 certificates from the platform CA. Store keys in an encrypted keystore or an HSM via PKCS#11.
REST API for integrators
An OpenAPI 3.0 signing and verification API over TLS 1.3. API-key or mTLS auth and webhook callbacks support async pipelines.
Tamper-evident audit trail
Every signing and verification operation is logged with tamper-evident audit records. Revocation is checked via OCSP/CRL.
A national algorithm option alongside the NIST standards
KAZ-SIGN (a Malaysian post-quantum signature scheme) can be selected alongside the NIST-standardised ML-DSA and SLH-DSA for organisations that want a locally-developed option and less dependence on foreign crypto standards. It is an optional and policy-selectable national choice. It is not a NIST-standardised algorithm.
Algorithm selection is crypto-agile. This is a policy decision you can change at any time. Choosing a national option never locks you out of the global NIST ecosystem.
Use cases
Built for documents that have to be trusted
Wherever a signature carries weight (legally or financially or operationally) a hybrid classical and PQC signature protects it now and for the long term.
Government documents
Sign official records and permits and notices and correspondence with a national quantum-safe signature that remains verifiable in standard readers and stands up for decades.
Contracts & agreements
Give contracts a visible signature that opens in Acrobat plus an external PQC signature. Counterparties can verify authenticity and integrity without any special tooling.
Banking & regulated industries
Add quantum resistance to statements and instructions and disclosures. Tamper-evident audit trails and public verification support long-retention record requirements.
Standards & compatibility
Aligned with the algorithms your auditors expect
MyPQC Document Signing implements the finalized NIST post-quantum signature algorithms and keeps compatibility with the classical PKI standards that carry legal weight today.
| Layer | Algorithms / standards | Role |
|---|---|---|
| Classical signature | RSA-3072+ · ECDSA (P-256 / P-384); PAdES or CMS profiles; X.509 | Visible signature in the PDF; validates in Acrobat/Foxit; DSA 1997 standing via an MCMC-licensed CA cert |
| PQC signature | ML-DSA (NIST FIPS 204) · SLH-DSA (NIST FIPS 205) | External quantum-resistant signature over the whole file and verifiable via the portal/API |
| National option | KAZ-SIGN (optional and policy-selectable) | Malaysian scheme offered alongside the NIST algorithms and not NIST-standardised |
| Hashing | SHA-3 family (SHA3-256 / 384 / 512) | Document hash computed before signing |
| Verification & trust | OCSP / CRL revocation; OpenAPI 3.0; TLS 1.3 | Public verification portal & API and no client-side PQC software required |
A note on the Digital Signature Act 1997
A signature gains legal standing under Malaysia's Digital Signature Act 1997 when it is verified against a valid X.509 certificate issued by a Certification Authority licensed by the MCMC. MyPQC's classical signing layer supports that workflow and can be deployed with certificates from an MCMC-licensed CA. That is a deployment capability. It is not an automatic guarantee. The PQC layer then adds quantum resistance on top.
Sign for today's law and tomorrow's threats
See how hybrid classical and post-quantum signing keeps your documents valid now and quantum-safe for the long term.