AEGIS — Cryptographic attestation and post-quantum assurance for governed AI
Securing not only the model, but the meaning of the decision record
AEGIS is the NEUROVATIC cryptographic-attestation architecture designed to bind a governed decision to its evidence, policy state, authorization events, and provenance identity. Its purpose is not to filter prompts or decide policy. Its purpose is to protect the integrity and origin of the record on which accountability depends.
1. Hybrid signature architecture
AEGIS combines two different security eras:
- ECDSA over secp256k1 provides a compact, widely deployed compatibility path;
- ML-DSA-65, standardized in NIST FIPS 204, provides a post-quantum signature target based on module-lattice assumptions.
At a dual-validation gate, both signatures can be required before a governed envelope is accepted. This preserves current interoperability while creating a migration path for records that may need to remain trustworthy beyond the classical-cryptography horizon.
The architecture must still state deployment scope precisely. A documented dual-signature design, a library implementation, a node-level deployment, and mandatory fleet-wide enforcement are four different evidence claims.
2. What AEGIS binds
An AEGIS attestation can cover:
- the decision identifier and intent fingerprint;
- the evaluated evidence bundle;
- the active NV-GRL7 policy version;
- UNDECA reasoning and assurance references;
- SIGMA’s execution envelope and outcome;
- human or multi-party authorization evidence;
- timestamps, nonces, expiry, and replay protection;
- the provenance anchor emitted to NV-CHAIN.
This prevents the recommendation from being detached from the data and rules under which it was evaluated.
3. ML-DSA-65: exact standardized parameters
FIPS 204 defines ML-DSA-65 as a Category 3 parameter set using a 6 × 5 matrix over the polynomial ring defined by the standard.
These values matter because post-quantum assurance is not free: larger keys and signatures consume more bandwidth, memory, and verification time than compact elliptic-curve signatures.
For comparison, a secp256k1 public key is commonly represented in 33-byte compressed or 65-byte uncompressed form; a raw ECDSA signature uses two 32-byte integers, while DER encoding is variable-length.
4. What quantum risk does — and does not — mean
ECDSA security depends on the elliptic-curve discrete logarithm problem. A sufficiently capable fault-tolerant quantum computer running Shor’s algorithm would undermine that assumption.
That does not mean ECDSA is broken today, nor does it justify precise claims that a fixed number of qubits will recover a key “in seconds.” Quantum-resource estimates depend on the curve, circuit design, error correction, hardware assumptions, and physical-to-logical qubit overhead.
ML-DSA is based on module-lattice problems for which no efficient classical or quantum attack is currently known. NIST describes ML-DSA-65 by a security-strength category rather than a universal “175-bit quantum security” figure. It is therefore accurate to call ML-DSA-65 designed for post-quantum security, but not “mathematically unbreakable.”
The lattice-reduction technique commonly discussed in cryptanalysis is BKZ — Block Korkine–Zolotarev, not “Block-Krylov-Zou.”
5. Signatures and key establishment are different
ML-DSA signs. ML-KEM establishes shared secrets.
Where deployed, ML-KEM-768 under FIPS 203 can support quantum-resistant key establishment for protected channels. It should not be described as a digital-signature mechanism, and a research or roadmap path should not be presented as fleet-wide production enforcement without deployment evidence.
“Harvest now, decrypt later” primarily concerns encrypted data captured today for future decryption. Long-lived signatures face a related but distinct risk: future forgery or loss of confidence in historical validation. A hybrid strategy should therefore preserve algorithm identifiers, signature time, key status, certificate context, and migration evidence.
6. AEGIS in the NEUROVATIC pipeline
[UNDECA reasoning evidence]
↓
[NV-GRL7 governance decision]
↓
[SIGMA execution envelope]
↓
[AEGIS cryptographic attestation]
├──► [NPoI governance-evidence evaluation]
└──► [NV-CHAIN provenance anchor]
AEGIS does not make a bad decision correct. It makes unauthorized alteration detectable and gives an independent verifier a cryptographic basis for establishing which record was actually signed.
7. High-stakes applications
The result is not “absolute security.” It is a stronger, cryptographically explicit accountability boundary — designed to keep governed AI records verifiable across systems, organizations, and technological generations.
Learn more: neurovatic.ai/aegis
— —
This post, including all associated text and visuals, has been generated and assisted by artificial intelligence under the regulatory requirements of the EU AI Act. Powered by NEUROVATIC AI systems.
