tech · quantum risk
Is OIDC Quantum Proof? Cyber Program & PQC
Verdict
OIDC is not quantum-proof when tokens are signed with classical algorithms. Migration is an ecosystem problem: IdP, libraries, and every relying party.
Overview
OIDC layers identity on OAuth. Token signature algorithms and TLS to the IdP are the main quantum-relevant surfaces.
Short-lived tokens reduce some risk windows but do not eliminate classical signature forgery concerns under a CRQC.
Program inventory focus: Relying parties trust IdP signatures at internet scale. Typical classical surfaces: ID token and access token signatures (RSA/ECDSA common); JWKS publication. Cross-read /security/program and /assessment. Educational only—not compliance advice.
Cryptographic profile
- Signatures: ID token and access token signatures (RSA/ECDSA common), JWKS publication
- Hash: JWT header/payload hashing per spec
- Public-key exposure: Relying parties trust IdP signatures at internet scale.
What breaks
- RS256 keys never rotated
- Relying parties that cannot accept new algs
Mitigations
- JWKS automation and key rotation drills
- Inventory alg support across apps
- Align with crypto-agility program
FAQ
Symmetric client secrets?
Different threat model; still protect secrets and prefer public-client best practices.
PQC JWT today?
Ecosystem support varies—plan agility and follow standards work; do not wait to inventory.
Key concepts (technical dictionary)
Terms used on this page — open a definition: