Technical Whitepaper · Version 1.4 · 15 September 2026

RANNTA Post-Quantum Security Architecture

RANNTA operates active hybrid post-quantum security across two distinct Mainnet layers: protected authorization uses classical secp256k1/ECDSA plus ML-DSA-65, while validator-sensitive transport uses X25519 + ML-KEM-768 + HKDF-SHA256 + AES-256-GCM. Both are enforced with fail-closed HybridRequired policy semantics on their protected paths.

Post-quantum security should be a property of protected authorization and transport paths, not a label attached to one primitive.

Open RANNTA PQ Cloud RANNTA X-Chain X-Chain Security Evidence PQ Cloud Security Report Public RPC

Classical authorizationsecp256k1 / ECDSA · Active

Post-quantum authorizationML-DSA-65 · Active

Policy modelHybridRequired · Fail-Closed

Validator-sensitive transportX25519 + ML-KEM-768 · Active

1. Abstract

RANNTA implements a hybrid post-quantum authorization architecture for security-critical blockchain and digital-asset operations. On HybridRequired paths, the authorization model is explicitly dual-cryptographic: a classical secp256k1/ECDSA authorization factor and an ML-DSA-65 post-quantum authorization factor are both validated before the protected action is authorized.

ML-DSA-65 is standardized by NIST in FIPS 204. RANNTA integrates it as a required authorization factor rather than a decorative signature field. The native hybrid transaction structure carries both secp256k1 signature evidence and ML-DSA-65 signature evidence, and the policy gate rejects a legacy-only path when HybridRequired is active.

The architecture extends the same security thesis into validator and infrastructure authorization, key registration and rotation, canonical action binding, replay controls and external production integration through RANNTA PQ Cloud. On RANNTA X-Chain Mainnet, validator-sensitive transport is also active under HybridRequired using X25519 + ML-KEM-768 key establishment, HKDF-SHA256 key derivation and AES-256-GCM authenticated encryption.

RANNTA X-Chain Mainnet enforces hybrid post-quantum protection across validator-sensitive authorization and transport paths.

2. Active Dual-Cryptographic Security Model

Classical factor

secp256k1/ECDSA binds existing account and transaction authority to the protected operation.

Post-quantum factor

ML-DSA-65 provides an independent post-quantum authorization proof over the RANNTA canonical security context.

Mandatory hybrid authorization

RANNTA requires both classical secp256k1/ECDSA authorization and ML-DSA-65 authorization wherever HybridRequired is active; classical-only authorization is rejected.

On HybridRequired paths these factors are mandatory components of one authorization decision, not optional alternatives and not a migration-only mode.

3. Quantum Threat Model

RANNTA treats quantum migration as a system-wide authorization and protected-transport problem. Long-lived blockchain, treasury, custody and validator authority cannot be protected by changing only a wallet format while leaving policy, key lifecycle, replay controls, operational authorization and validator-sensitive transport unchanged.

Signature resilience

ML-DSA-65 adds a post-quantum authorization factor to security-critical paths.

Transport resilience

ML-KEM-768 is combined with X25519 for validator-sensitive HybridRequired transport sessions.

Migration continuity

The hybrid model strengthens cryptography without discarding established authorization and interoperability infrastructure.

4. RANNTA Hybrid Authorization Path

Canonical Action

secp256k1 / ECDSA

ML-DSA-65

HybridRequired Gate

Commit / Execute

A protected action reaches execution only after the security context is reconstructed canonically and the required cryptographic factors pass. The ML-DSA-65 result is part of authorization itself, not metadata attached after a classical decision.

HybridRequired protected path

1. Reconstruct canonical action context
2. Verify classical secp256k1 / ECDSA authorization
3. Verify ML-DSA-65 authorization
4. Verify key version, validity window and policy context
5. Reject replay or reused operation identity
6. Authorize only when the complete HybridRequired policy passes

5. Native X-Chain Hybrid Authorization

RANNTA X-Chain engineering exposes a native hybrid authorization surface for protected transfers and key lifecycle operations. The hybrid transfer model carries both a secp256k1_signature and an ml_dsa_65_signature. Key registration and rotation similarly bind classical account authority to ML-DSA-65 proof.

Hybrid transfer

Classical and ML-DSA-65 evidence are validated as part of one protected transaction authorization context.

Key registration and rotation

Post-quantum public keys are versioned, registered and rotated under authenticated account control.

Legacy-path enforcement

When an account enters HybridRequired mode, legacy-only authorization is rejected on the protected path.

6. Validator and Consensus Authorization

RANNTA consensus engineering implements HybridRequired authorization surfaces across validator-sensitive proposal, vote and finality paths. Broader distributed validator deployment is the topology-scale expansion of this implemented authorization model.

The HybridRequired consensus authorization model is implemented independently of validator-count growth. Network expansion broadens distributed participation without redefining the protected authorization path.

7. Canonical Payload Binding and Replay Resistance

Cryptographic strength depends on context integrity. RANNTA binds authorization evidence to canonical fields such as chain identity, sender or subject, action, nonce, validity window, key version, policy version and operation identity. Consensus-sensitive paths additionally bind consensus context such as round or message type where applicable.

Executed transaction hashes and used operation identities are tracked so valid evidence cannot simply be reused to create a second authorized operation. The design goal is that a signature valid for one intent cannot silently become authority for another intent.

8. RANNTA PQ Cloud - Exporting the Security Model

RANNTA PQ Cloud is the live commercial and integration surface of the hybrid authorization architecture. It enables exchanges, treasuries, blockchains, validators and digital-asset systems to add ML-DSA-65 verification while retaining their existing classical authorization and custody controls. Professional blockchain and validator engagements can separately include validator-sensitive hybrid transport integration where required.

Exchange withdrawals

Add ML-DSA-65 verification as a required authorization factor before sensitive withdrawal release.

Treasury operations

Bind high-value approvals to an independent post-quantum verification layer and explicit policy context.

Validators and infrastructure

Integrate protected authorization and, where required, validator-sensitive X25519 + ML-KEM-768 transport.

RANNTA PQ Cloud Services · Documentation · Security

9. Crypto-Agility and Active Hybrid Transport

RANNTA does not freeze the protocol around a single primitive. ML-DSA-65 is the active post-quantum signature primitive for the current hybrid authorization architecture. The wider protocol remains crypto-agile as standards, operational requirements and production evidence evolve.

Transport is a separate security layer from authorization. RANNTA X-Chain Mainnet now enforces hybrid post-quantum protection on validator-sensitive transport paths using X25519 + ML-KEM-768 + HKDF-SHA256 + AES-256-GCM under HybridRequired policy. Production acceptance rejects plaintext-sensitive traffic, classical-only peer authentication, replayed records, modified ciphertext, modified AAD, wrong-session records and wrong-direction records, while fresh reconnects establish new sessions.

Scope boundary: the transport claim applies to validator-sensitive protected paths. It does not claim that every public RPC byte is ML-KEM protected.

10. Post-Quantum Scaling and Aggregation

Post-quantum signatures are larger than conventional elliptic-curve signatures, which makes batching, verification parallelism and proof aggregation important engineering domains. RANNTA's expansion program includes post-quantum authorization batching and aggregation so stronger cryptographic assurance can scale with network and infrastructure throughput.

The RANNTA design remains implementation-flexible: aggregation is treated as an optimization and proof-compression layer around authorization, not as a substitute for the underlying HybridRequired security policy.

11. Position Among Major Post-Quantum Blockchain Programs

Post-quantum blockchain engineering is developing through several different architectural strategies. RANNTA's distinctive position is the combination of active native hybrid authorization, active validator-sensitive hybrid transport and a live external post-quantum integration service.

Comparison snapshot: 15 September 2026. Project roadmaps and deployment status change over time; this table reflects the publicly documented status used for this whitepaper version and should be reviewed as those programs evolve.

Project	Primary PQ direction	Authorization / protocol approach	Infrastructure scope
RANNTA	Mandatory hybrid authorization plus active validator-sensitive hybrid transport	secp256k1/ECDSA + ML-DSA-65 authorization; X25519 + ML-KEM-768 transport under HybridRequired	Independent L1 + public RPC + explorer + exchange/routing stack + live PQ Cloud external integration service
Quantus	PQ-native chain design with ML-DSA and ML-KEM-oriented networking	Post-quantum-first transaction and network architecture with proof aggregation research	Focused quantum-resistant blockchain architecture
QRL 2.0	Post-quantum account and validator cryptography	XMSS / ML-DSA evolution with EVM-friendly execution direction	Post-quantum blockchain and validator ecosystem
Sui	Native post-quantum account authentication roadmap	ML-DSA-65 and SLH-DSA integration strategy	Large general-purpose Move ecosystem
NEAR	ML-DSA account signing and staged protocol migration	Progressive quantum-safe account and protocol evolution	Large general-purpose application ecosystem
Ethereum	Long-horizon post-quantum migration and aggregation research	PQ validator, account and proof-system research including lean cryptographic directions	Largest smart-contract ecosystem and extensive migration research

RANNTA's architectural identity is not a future promise of adding one post-quantum signature. It is an active hybrid system spanning protected authorization, validator-sensitive transport and external production integration.

12. Active Security Surfaces

ACTIVE

secp256k1/ECDSA + ML-DSA-65 native hybrid authorization on protected paths.

ACTIVE

HybridRequired fail-closed enforcement and legacy-path rejection for protected accounts.

ACTIVE

ML-DSA-65 public-key registration, versioning and rotation controls.

ACTIVE

Canonical context binding, transaction replay controls and operation identity tracking.

ACTIVE

RANNTA PQ Cloud verification and commercial integration surface.

ACTIVE

Validator-sensitive X25519 + ML-KEM-768 + HKDF-SHA256 + AES-256-GCM transport under HybridRequired.

Implementation-grounded evidence for both native hybrid authorization and Mainnet validator-sensitive transport is published in the X-Chain Hybrid Security Evidence record.

13. Full-Stack Expansion Program

RANNTA's security program advances from active hybrid authorization and validator-sensitive hybrid transport toward progressively broader post-quantum coverage across the full protocol stack.

Canonical PQ state integration: move post-quantum authorization state deeper into protocol-owned canonical state surfaces.
Validator-scale expansion: extend hybrid authorization evidence across broader distributed validator operation.
Broader protected transport coverage: expand the active validator-sensitive hybrid transport architecture to additional protocol transport domains where technically justified.
PQ aggregation: optimize large-scale authorization evidence through batching and aggregation.
Planned third-party security review: expand independent external review and audit evidence as the protocol security surface grows. Current public verification records are project-published evidence and are not represented as a third-party audit or certification.

14. Technical References

15. Conclusion

RANNTA's post-quantum architecture is built around a concrete security rule: protected authorization and validator-sensitive transport are hybrid, explicit and fail-closed. Classical secp256k1/ECDSA authority and ML-DSA-65 post-quantum authority are both active factors in the HybridRequired authorization path. X25519 and ML-KEM-768 are both active factors in the validator-sensitive protected transport handshake, with HKDF-SHA256 and AES-256-GCM protecting session records.

RANNTA then extends that model outward into key lifecycle, replay resistance, infrastructure integration and RANNTA PQ Cloud. The result is a security architecture designed to operate as production infrastructure while preserving clear scope boundaries between authorization, transport and public RPC compatibility.

RANNTA is building post-quantum resilience as operating infrastructure, not as a label.