What ETSI TS 119 312 V2.1.1 says about hybrid signatures

ETSI TS 119 312 is the catalogue European trust services use to decide which hash functions and signature algorithms are suitable. Version 2.1.1, published in June 2026, includes post-quantum signature algorithms: ML-DSA (FIPS 204) and SLH-DSA (FIPS 205). The previous edition, V1.5.1 of December 2024, listed none. It also adds clause 6.4, “Hybrid Cryptographic Schemes”.

Clause 6.4.1: the acceptance rule

“For hybrid signatures, implementations shall combine a classical signature and a post-quantum signature. Acceptance requires both signatures to be valid.”ETSI TS 119 312 V2.1.1, clause 6.4.1

Two things follow. A hybrid signature is a classical signature and a post-quantum signature together. And a relying party accepts it only when both are valid: one valid signature out of two is not enough.

Clause 6.4.2 and Table 3.3: which pairs

Table 3.3 lists the recommended algorithm-level hybrid combinations. For the AdES formats the row reads: classical component ECDSA (P-256/P-384), post-quantum component ML-DSA-65, use case CAdES/XAdES/PAdES. Other rows pair RSA-PSS or EdDSA with ML-DSA, and ECDSA or EdDSA with SLH-DSA for time-stamps and firmware signing.

The clause then names two ways to satisfy the hybrid requirement:

• a) algorithm-level hybrids: two independent signature primitives computed and verified separately over the same message data;
• b) protocol-level hybrids: mechanisms provided by the encapsulating protocol or data format, such as the signed-attributes mechanism in CMS (applicable to CAdES and PAdES) or multi-signature constructions in XAdES.

It states that both approaches are considered conformant for the purposes of the document.

What it leaves open

“The specific encoding and interoperability requirements for hybrid signature schemes are outside the scope of the present document and is planned to be addressed in the applicable profile standards and the post-quantum migration document currently under development.”ETSI TS 119 312 V2.1.1, clause 6.4.2, NOTE

So the catalogue settles the algorithms and the acceptance rule, and defers how a hybrid signature is laid out in a PAdES file, and how two implementations interoperate, to documents not yet published.

What this means for a trust service provider

• The pair is no longer a guess. ECDSA P-256 + ML-DSA-65 for PAdES is a named, recommended combination.
• Compatibility is a hard requirement. Until validators everywhere understand post-quantum signatures, a hybrid PAdES signature has to keep the classical signature readable by the tools in use today.
• The acceptance rule needs a validator that applies it. A validator that only reads the classical signature cannot tell whether the post-quantum one was valid, missing or never there. Clause 6.4.1 is enforced only where the post-quantum signature is actually checked.

Perennis is built on the clause 6.4.2 a) construction: an ML-DSA-65 signature over the same document bytes as the ECDSA P-256 signature, carried so that existing validators keep working, and a validator that applies the 6.4.1 rule. The Technical details page describes the encoding.