From cfeda1badd234573be177402b376324291b4c383 Mon Sep 17 00:00:00 2001 From: Richard B <27917610+RichardBarron27@users.noreply.github.com> Date: Wed, 29 Jul 2026 23:54:04 +0100 Subject: [PATCH 1/2] Create ai-inference-layer-quantum-risks.md --- proposals/ai-inference-layer-quantum-risks.md | 181 ++++++++++++++++++ 1 file changed, 181 insertions(+) create mode 100644 proposals/ai-inference-layer-quantum-risks.md diff --git a/proposals/ai-inference-layer-quantum-risks.md b/proposals/ai-inference-layer-quantum-risks.md new file mode 100644 index 0000000..7745431 --- /dev/null +++ b/proposals/ai-inference-layer-quantum-risks.md @@ -0,0 +1,181 @@ +# QS-NEW: AI Inference Layer Quantum Attack Surface + +**Proposed addition to OWASP Quantum Security Top 10** +**Contributed by:** Richard Barron, Red Specter Security Research Ltd +**Date:** 29 July 2026 +**Evidence classification:** Demonstrated (operationalised in NIGHTFALL L46 + AI Shield M103) + +--- + +## The Gap + +Current PQC frameworks — NIST FIPS 203/204/205, OWASP QS draft v0.1 — address the cryptographic migration problem: replacing RSA/ECDSA/DH with lattice-based, hash-based, and code-based alternatives. + +What is missing is the AI-specific quantum attack surface. AI systems introduce cryptographic dependencies that classical PQC frameworks do not address, because classical PQC frameworks were designed before AI agents became the primary execution environment for sensitive operations. + +Five distinct AI-layer quantum risks are not covered in any existing framework: + +--- + +## QS-NEW-01: Model Signature Integrity Under Quantum Threat + +**Classification:** Demonstrated +**Attack surface:** AI model supply chain + +**Description:** +Model weights, checkpoints, and adapters are distributed with cryptographic signatures (Ed25519, ECDSA) that prove provenance and integrity. These signatures are vulnerable to Shor's algorithm on a sufficiently capable quantum computer. + +A harvest-now-decrypt-later (HNDL) adversary collecting signed model distributions today can, with future quantum capability: +- Forge valid model signatures +- Distribute backdoored weights indistinguishable from legitimate releases +- Retroactively invalidate provenance chains for models deployed in regulated environments + +**Existing framework coverage:** None. NIST PQC migration guidance does not address model distribution signing. OWASP LLM Top 10 does not address post-quantum model supply chain integrity. + +**Mitigation:** +- ML-DSA-65 (FIPS 204) model signing at publish time +- Dual signing: Ed25519 (current) + ML-DSA-65 (post-quantum) during transition +- Merkle tree provenance chains over model version history +- Registry-level PQC verification enforcement + +**Red Specter implementation:** AI Shield M103 enforces ML-DSA-65 model signing across AI agent deployments. NIGHTFALL L46 operationalises quantum-era model signature forgery for offensive validation. + +--- + +## QS-NEW-02: Agent Identity Binding Degradation + +**Classification:** Demonstrated +**Attack surface:** AI agent authentication + +**Description:** +AI agents operating in multi-agent environments authenticate to each other and to orchestration infrastructure using asymmetric key pairs (typically Ed25519 or ECDSA). Agent identity tokens, capability certificates, and delegation chains rely on these signatures. + +Under quantum threat: +- Agent identity tokens become forgeable +- Delegation chains — "Agent A is authorised to invoke Agent B on behalf of User C" — become manipulable +- The trust fabric of multi-agent orchestration collapses + +This is distinct from classical identity theft: the attacker does not steal credentials, they forge them with quantum capability. There is no authentication log anomaly. The forged agent identity is cryptographically indistinguishable from legitimate. + +**Existing framework coverage:** None. FIDO2/WebAuthn PQC transition guidance does not address AI agent-to-agent identity. NIST AI RMF does not address post-quantum agent authentication. + +**Mitigation:** +- ML-DSA-65 agent identity certificates +- Short-lived agent tokens (TTL ≤ 1 hour) to limit HNDL window +- CRYSTALS-Kyber key encapsulation for agent session establishment +- Quantum-resistant delegation chain verification + +**Red Specter implementation:** AI Shield M103 covers PQC agent identity enforcement. AI Shield M20 (Agent Identity Verification) implements short-lived token rotation. + +--- + +## QS-NEW-03: Evidence Chain Cryptographic Dependency + +**Classification:** Demonstrated +**Attack surface:** AI forensics and compliance + +**Description:** +AI agent audit trails, forensic evidence packages, and compliance records depend on cryptographic integrity for legal admissibility. RFC 3161 timestamps use RSA. HMAC-SHA256 evidence chains are not quantum-resistant. Ed25519-signed audit logs become forgeable. + +The consequence is specific to regulated industries: an AI system's audit trail — the primary mechanism for proving what an agent did and when — becomes retroactively untrustworthy under quantum capability. Court-admissible AI evidence packages built today may not be admissible in post-quantum litigation environments. + +**Existing framework coverage:** None. RFC 3161 has no post-quantum profile. eIDAS 2.0 PQC provisions do not address AI agent audit trails. ISO 42001 does not specify cryptographic requirements for AI audit logs. + +**Mitigation:** +- ML-DSA-65 dual signing on all audit records (alongside current Ed25519) +- Post-quantum RFC 3161 timestamp profile (IETF draft in progress) +- Merkle tree audit chains with PQC root signatures +- Hybrid signature schemes during transition period + +**Red Specter implementation:** AI Shield BLACK BOX produces Ed25519 + ML-DSA-65 dual-signed evidence chains with RFC 3161 timestamps and Merkle root verification. Hybrid signing ensures forward compatibility. + +--- + +## QS-NEW-04: Inter-Agent Trust Protocol Exposure + +**Classification:** Emerging +**Attack surface:** Multi-agent orchestration + +**Description:** +Agent-to-agent communication protocols — A2A, MCP, custom orchestration — establish trust via key exchange (ECDH) and authenticate messages via digital signatures. Under quantum threat: + +- ECDH key establishment becomes insecure (Shor's algorithm) +- Recorded agent communication sessions become retroactively decryptable +- Man-in-the-middle attacks on agent communication become feasible with quantum capability + +Multi-agent AI systems processing sensitive data (healthcare, finance, defence) are particularly exposed: HNDL adversaries recording agent communication today can decrypt it when quantum capability becomes available. + +**Existing framework coverage:** Partial. NIST PQC migration guidance covers TLS 1.3 but does not specifically address AI agent communication protocols. MCP specification has no cryptographic requirements. A2A (Google) has no PQC provisions. + +**Mitigation:** +- CRYSTALS-Kyber key encapsulation for agent session establishment +- ML-DSA-65 message authentication in agent communication +- Protocol-level PQC requirements in MCP and A2A specifications +- Forward-secret session keys with quantum-resistant KEM + +**Red Specter implementation:** AI Shield M21 (Inter-Agent Communication Security) implements hybrid classical/PQC key establishment. NIGHTFALL L46 operationalises quantum-era inter-agent protocol attacks. + +--- + +## QS-NEW-05: RAG and Vector Database Confidentiality Under Quantum Threat + +**Classification:** Emerging +**Attack surface:** AI retrieval infrastructure + +**Description:** +RAG systems and vector databases store encrypted knowledge bases, semantic embeddings, and retrieved context. Encryption uses AES-256 (symmetric) and RSA/ECDH for key management (asymmetric). + +Symmetric encryption (AES-256) is quantum-resistant to Grover's algorithm with existing key lengths. The vulnerability is in key management: ECDH key exchange for session keys and RSA-encrypted key storage become insecure under quantum capability. An HNDL adversary capturing encrypted RAG retrieval sessions today can obtain session keys — and therefore the retrieved context — when quantum capability becomes available. + +For RAG systems used in intelligence, legal, or medical contexts, this represents a long-term confidentiality risk against sensitive knowledge base content. + +**Existing framework coverage:** None. No existing framework addresses PQC requirements for AI retrieval infrastructure specifically. + +**Mitigation:** +- CRYSTALS-Kyber for RAG session key establishment +- Post-quantum key encapsulation for vector database encryption key management +- Audit trail for all RAG retrievals to enable breach detection +- Data minimisation: limit what is stored in quantum-exposed retrieval systems + +**Red Specter implementation:** AI Shield M42 (RAG Security Monitor) and M43 (Knowledge Base Integrity) cover RAG attack surface. M103 (Quantum AI Security Engine) addresses PQC enforcement across retrieval infrastructure. + +--- + +## Summary Table + +| Risk | Attack Surface | Existing Coverage | Quantum Risk Level | +|------|---------------|-------------------|-------------------| +| QS-NEW-01: Model Signature Integrity | AI supply chain | None | HIGH — Shor's on ECDSA | +| QS-NEW-02: Agent Identity Binding | Multi-agent orchestration | None | HIGH — Shor's on Ed25519 | +| QS-NEW-03: Evidence Chain Integrity | AI forensics/compliance | None | HIGH — RFC 3161/HMAC | +| QS-NEW-04: Inter-Agent Trust Protocol | MCP/A2A protocols | Partial | HIGH — HNDL on ECDH | +| QS-NEW-05: RAG Confidentiality | Retrieval infrastructure | None | MEDIUM — key management | + +--- + +## Offensive Validation + +These risks are not theoretical. Red Specter Security Research operationalises all five attack surfaces: + +- **NIGHTFALL L46** — Post-Quantum AI Cryptography exploitation layer (T148 SPECTER QUANTA) +- **AI Shield M103** — Quantum AI Security Engine (defensive enforcement) + +Findings are available for independent validation. All offensive tooling is gate-controlled and requires signed ROE. + +--- + +## References + +1. NIST FIPS 203 — ML-KEM (CRYSTALS-Kyber) +2. NIST FIPS 204 — ML-DSA (CRYSTALS-Dilithium / ML-DSA-65) +3. NIST FIPS 205 — SLH-DSA (SPHINCS+) +4. RFC 3161 — Internet X.509 PKI Time-Stamp Protocol +5. OWASP LLM Top 10 2025 +6. NIST AI RMF 1.0 +7. Red Specter RS-2026-003 — NIGHTFALL Attack Surface Taxonomy (DOI: 10.5281/zenodo.21462689) +8. ISO/IEC 42001:2023 — AI Management Systems + +--- + +*Red Specter Security Research Ltd | Company No. 17106988 | red-specter.co.uk* +*"While others announce. We ship."* From 216ab925294f702a3dcb0be83f5c03f04f74b22e Mon Sep 17 00:00:00 2001 From: Richard B <27917610+RichardBarron27@users.noreply.github.com> Date: Thu, 6 Aug 2026 06:25:33 +0100 Subject: [PATCH 2/2] Update ai-inference-layer-quantum-risks.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Revise per nmcitra review — TNFL/HNDL taxonomy, HMAC correction, ML-KEM naming, evidence classification, product references stripped --- proposals/ai-inference-layer-quantum-risks.md | 167 +++++++++++------- 1 file changed, 100 insertions(+), 67 deletions(-) diff --git a/proposals/ai-inference-layer-quantum-risks.md b/proposals/ai-inference-layer-quantum-risks.md index 7745431..8453c53 100644 --- a/proposals/ai-inference-layer-quantum-risks.md +++ b/proposals/ai-inference-layer-quantum-risks.md @@ -2,8 +2,8 @@ **Proposed addition to OWASP Quantum Security Top 10** **Contributed by:** Richard Barron, Red Specter Security Research Ltd -**Date:** 29 July 2026 -**Evidence classification:** Demonstrated (operationalised in NIGHTFALL L46 + AI Shield M103) +**Date:** 29 July 2026 (revised 6 August 2026) +**Evidence classification:** Emerging (see evidence note below) --- @@ -13,81 +13,110 @@ Current PQC frameworks — NIST FIPS 203/204/205, OWASP QS draft v0.1 — addres What is missing is the AI-specific quantum attack surface. AI systems introduce cryptographic dependencies that classical PQC frameworks do not address, because classical PQC frameworks were designed before AI agents became the primary execution environment for sensitive operations. -Five distinct AI-layer quantum risks are not covered in any existing framework: +Five distinct AI-layer quantum risks are not covered in any existing framework. + +--- + +## Evidence Classification Note + +QS-NEW-01, 02, and 03 are revised from Demonstrated to Emerging. The offensive tooling is gate-controlled and requires signed ROE, which means external reviewers cannot independently verify the Demonstrated claim against the OWASP evidence standard. A public artifact demonstrating forgery against a test key is in preparation and will be linked when available. + +QS-NEW-04 and 05 remain Emerging, which is an accurate fit. + +--- + +## Taxonomy Note: TNFL vs HNDL + +Following the taxonomy discussion in #11: + +- **QS-NEW-01, 02, 03** are **trust-now-forge-later (TNFL)** risks. An adversary does not need to harvest anything today. When quantum capability arrives, they can forge signatures against any public key they choose — retroactively invalidating provenance built today. Nothing useful is gained by collecting signed artefacts now. +- **QS-NEW-04** is a split: the ECDH session establishment half is **HNDL** (intercept encrypted sessions today, decrypt when quantum capability arrives); the message-signature half is **TNFL**. +- **QS-NEW-05** is genuine **HNDL**: capturing encrypted RAG sessions today yields plaintext when session key exchange (ECDH) breaks. --- ## QS-NEW-01: Model Signature Integrity Under Quantum Threat -**Classification:** Demonstrated +**Classification:** Emerging **Attack surface:** AI model supply chain +**Quantum mechanism:** TNFL **Description:** Model weights, checkpoints, and adapters are distributed with cryptographic signatures (Ed25519, ECDSA) that prove provenance and integrity. These signatures are vulnerable to Shor's algorithm on a sufficiently capable quantum computer. -A harvest-now-decrypt-later (HNDL) adversary collecting signed model distributions today can, with future quantum capability: -- Forge valid model signatures +The risk is retroactive forgeability. When quantum capability arrives, every model distribution signed with a classical key becomes forgeable — regardless of when it was signed or distributed. An adversary can: + +- Forge valid model signatures for any existing public key - Distribute backdoored weights indistinguishable from legitimate releases - Retroactively invalidate provenance chains for models deployed in regulated environments +Provenance built today cannot be relied on tomorrow. + **Existing framework coverage:** None. NIST PQC migration guidance does not address model distribution signing. OWASP LLM Top 10 does not address post-quantum model supply chain integrity. -**Mitigation:** -- ML-DSA-65 (FIPS 204) model signing at publish time -- Dual signing: Ed25519 (current) + ML-DSA-65 (post-quantum) during transition -- Merkle tree provenance chains over model version history +**Mitigation:** + +- ML-DSA-65 (FIPS 204) model signing at publish time +- Dual signing: Ed25519 (current) + ML-DSA-65 (post-quantum) during transition +- Merkle tree provenance chains over model version history - Registry-level PQC verification enforcement -**Red Specter implementation:** AI Shield M103 enforces ML-DSA-65 model signing across AI agent deployments. NIGHTFALL L46 operationalises quantum-era model signature forgery for offensive validation. +*Note on algorithm selection:* ML-DSA-65 is used throughout this proposal as the default. Deployments within scope of CNSA 2.0 (US national security systems) are required to use ML-DSA-87, which is not permitted to be downgraded to ML-DSA-65. --- ## QS-NEW-02: Agent Identity Binding Degradation -**Classification:** Demonstrated +**Classification:** Emerging **Attack surface:** AI agent authentication +**Quantum mechanism:** TNFL **Description:** AI agents operating in multi-agent environments authenticate to each other and to orchestration infrastructure using asymmetric key pairs (typically Ed25519 or ECDSA). Agent identity tokens, capability certificates, and delegation chains rely on these signatures. -Under quantum threat: -- Agent identity tokens become forgeable -- Delegation chains — "Agent A is authorised to invoke Agent B on behalf of User C" — become manipulable -- The trust fabric of multi-agent orchestration collapses +Under quantum threat, the attacker does not steal credentials — they forge them. The critical consequence is the detection gap: + +> There is no authentication log anomaly. The forged agent identity is cryptographically indistinguishable from legitimate. -This is distinct from classical identity theft: the attacker does not steal credentials, they forge them with quantum capability. There is no authentication log anomaly. The forged agent identity is cryptographically indistinguishable from legitimate. +This is categorically worse than classical credential theft. Classical theft leaves traces: unusual access patterns, token reuse, session anomalies. Quantum forgery does not. The usual detection surface — authentication logs, anomaly detection, behavioural monitoring — goes silent at the same time the cryptographic protection fails. + +Delegation chains — "Agent A is authorised to invoke Agent B on behalf of User C" — become manipulable in the same way. **Existing framework coverage:** None. FIDO2/WebAuthn PQC transition guidance does not address AI agent-to-agent identity. NIST AI RMF does not address post-quantum agent authentication. -**Mitigation:** -- ML-DSA-65 agent identity certificates -- Short-lived agent tokens (TTL ≤ 1 hour) to limit HNDL window -- CRYSTALS-Kyber key encapsulation for agent session establishment -- Quantum-resistant delegation chain verification +**Mitigation:** -**Red Specter implementation:** AI Shield M103 covers PQC agent identity enforcement. AI Shield M20 (Agent Identity Verification) implements short-lived token rotation. +- ML-DSA-65 agent identity certificates (ML-DSA-87 for CNSA 2.0 scope) +- Short-lived agent tokens (TTL ≤ 1 hour) to minimise the window of forged token utility +- ML-KEM (FIPS 203) key encapsulation for agent session establishment +- Quantum-resistant delegation chain verification --- ## QS-NEW-03: Evidence Chain Cryptographic Dependency -**Classification:** Demonstrated +**Classification:** Emerging **Attack surface:** AI forensics and compliance +**Quantum mechanism:** TNFL **Description:** -AI agent audit trails, forensic evidence packages, and compliance records depend on cryptographic integrity for legal admissibility. RFC 3161 timestamps use RSA. HMAC-SHA256 evidence chains are not quantum-resistant. Ed25519-signed audit logs become forgeable. +AI agent audit trails, forensic evidence packages, and compliance records depend on cryptographic integrity for legal admissibility. The quantum-fragile components are: -The consequence is specific to regulated industries: an AI system's audit trail — the primary mechanism for proving what an agent did and when — becomes retroactively untrustworthy under quantum capability. Court-admissible AI evidence packages built today may not be admissible in post-quantum litigation environments. +- **RFC 3161 timestamps:** The timestamp protocol uses RSA signatures, which Shor's algorithm breaks. No post-quantum RFC 3161 profile exists (IETF draft in progress). +- **Ed25519-signed audit logs:** Become retroactively forgeable under quantum capability. + +*Note:* HMAC-SHA256 evidence chains are Grover-resistant with full-length keys. The HMAC is not the quantum risk in this entry. The risk is the asymmetric signature layer above it. + +The consequence is specific to regulated industries: an AI system's audit trail — the primary mechanism for proving what an agent did and when — becomes retroactively untrustworthy. Court-admissible AI evidence packages built today may not be admissible in post-quantum litigation environments, because the timestamps and log signatures cannot be verified as unforgeable. **Existing framework coverage:** None. RFC 3161 has no post-quantum profile. eIDAS 2.0 PQC provisions do not address AI agent audit trails. ISO 42001 does not specify cryptographic requirements for AI audit logs. -**Mitigation:** -- ML-DSA-65 dual signing on all audit records (alongside current Ed25519) -- Post-quantum RFC 3161 timestamp profile (IETF draft in progress) -- Merkle tree audit chains with PQC root signatures -- Hybrid signature schemes during transition period +**Mitigation:** -**Red Specter implementation:** AI Shield BLACK BOX produces Ed25519 + ML-DSA-65 dual-signed evidence chains with RFC 3161 timestamps and Merkle root verification. Hybrid signing ensures forward compatibility. +- ML-DSA-65 dual signing on all audit records alongside current Ed25519 +- Post-quantum RFC 3161 timestamp profile when available (track IETF progress) +- Merkle tree audit chains with PQC root signatures +- Hybrid signature schemes during transition period --- @@ -95,25 +124,25 @@ The consequence is specific to regulated industries: an AI system's audit trail **Classification:** Emerging **Attack surface:** Multi-agent orchestration +**Quantum mechanism:** HNDL (session encryption) + TNFL (message authentication) **Description:** -Agent-to-agent communication protocols — A2A, MCP, custom orchestration — establish trust via key exchange (ECDH) and authenticate messages via digital signatures. Under quantum threat: +Agent-to-agent communication protocols — A2A, MCP, custom orchestration — establish trust via key exchange (ECDH) and authenticate messages via digital signatures. -- ECDH key establishment becomes insecure (Shor's algorithm) -- Recorded agent communication sessions become retroactively decryptable -- Man-in-the-middle attacks on agent communication become feasible with quantum capability +These are two distinct quantum risks with different mechanisms: -Multi-agent AI systems processing sensitive data (healthcare, finance, defence) are particularly exposed: HNDL adversaries recording agent communication today can decrypt it when quantum capability becomes available. +**HNDL component (ECDH session establishment):** An adversary recording encrypted agent communication today can decrypt it when quantum capability becomes available. Multi-agent AI systems processing sensitive data in healthcare, finance, or defence are the highest-risk deployments — the confidentiality of recorded sessions is at risk. -**Existing framework coverage:** Partial. NIST PQC migration guidance covers TLS 1.3 but does not specifically address AI agent communication protocols. MCP specification has no cryptographic requirements. A2A (Google) has no PQC provisions. +**TNFL component (message signatures):** Message authentication signatures become forgeable retroactively. An adversary can forge agent messages against any recorded public key. -**Mitigation:** -- CRYSTALS-Kyber key encapsulation for agent session establishment -- ML-DSA-65 message authentication in agent communication -- Protocol-level PQC requirements in MCP and A2A specifications -- Forward-secret session keys with quantum-resistant KEM +**Existing framework coverage:** Partial. NIST PQC migration guidance covers TLS 1.3 but does not specifically address AI agent communication protocols. MCP specification has no cryptographic requirements. A2A has no PQC provisions. + +**Mitigation:** -**Red Specter implementation:** AI Shield M21 (Inter-Agent Communication Security) implements hybrid classical/PQC key establishment. NIGHTFALL L46 operationalises quantum-era inter-agent protocol attacks. +- ML-KEM (FIPS 203) key encapsulation for agent session establishment +- ML-DSA-65 message authentication in agent communication (ML-DSA-87 for CNSA 2.0 scope) +- Protocol-level PQC requirements in MCP and A2A specifications +- Forward-secret session keys with quantum-resistant KEM --- @@ -121,53 +150,56 @@ Multi-agent AI systems processing sensitive data (healthcare, finance, defence) **Classification:** Emerging **Attack surface:** AI retrieval infrastructure +**Quantum mechanism:** HNDL **Description:** -RAG systems and vector databases store encrypted knowledge bases, semantic embeddings, and retrieved context. Encryption uses AES-256 (symmetric) and RSA/ECDH for key management (asymmetric). +RAG systems and vector databases store encrypted knowledge bases, semantic embeddings, and retrieved context. + +AES-256 (symmetric) is Grover-resistant with existing key lengths — this is not the vulnerability. The risk is in key management: ECDH key exchange for session keys and RSA-encrypted key storage become insecure under quantum capability. -Symmetric encryption (AES-256) is quantum-resistant to Grover's algorithm with existing key lengths. The vulnerability is in key management: ECDH key exchange for session keys and RSA-encrypted key storage become insecure under quantum capability. An HNDL adversary capturing encrypted RAG retrieval sessions today can obtain session keys — and therefore the retrieved context — when quantum capability becomes available. +An HNDL adversary capturing encrypted RAG retrieval sessions today can obtain session keys — and therefore the retrieved context — when quantum capability breaks ECDH. The AES-256 encryption of the knowledge base itself is not the target; the asymmetric key exchange protecting the session key is. For RAG systems used in intelligence, legal, or medical contexts, this represents a long-term confidentiality risk against sensitive knowledge base content. **Existing framework coverage:** None. No existing framework addresses PQC requirements for AI retrieval infrastructure specifically. -**Mitigation:** -- CRYSTALS-Kyber for RAG session key establishment -- Post-quantum key encapsulation for vector database encryption key management -- Audit trail for all RAG retrievals to enable breach detection -- Data minimisation: limit what is stored in quantum-exposed retrieval systems +**Mitigation:** -**Red Specter implementation:** AI Shield M42 (RAG Security Monitor) and M43 (Knowledge Base Integrity) cover RAG attack surface. M103 (Quantum AI Security Engine) addresses PQC enforcement across retrieval infrastructure. +- ML-KEM (FIPS 203) for RAG session key establishment +- Post-quantum key encapsulation for vector database encryption key management +- Audit trail for all RAG retrievals to enable breach detection +- Data minimisation: limit what is stored in quantum-exposed retrieval systems --- ## Summary Table -| Risk | Attack Surface | Existing Coverage | Quantum Risk Level | -|------|---------------|-------------------|-------------------| -| QS-NEW-01: Model Signature Integrity | AI supply chain | None | HIGH — Shor's on ECDSA | -| QS-NEW-02: Agent Identity Binding | Multi-agent orchestration | None | HIGH — Shor's on Ed25519 | -| QS-NEW-03: Evidence Chain Integrity | AI forensics/compliance | None | HIGH — RFC 3161/HMAC | -| QS-NEW-04: Inter-Agent Trust Protocol | MCP/A2A protocols | Partial | HIGH — HNDL on ECDH | -| QS-NEW-05: RAG Confidentiality | Retrieval infrastructure | None | MEDIUM — key management | +| Risk | Mechanism | Attack Surface | Existing Coverage | Quantum Risk Level | +|------|-----------|---------------|-------------------|--------------------| +| QS-NEW-01: Model Signature Integrity | TNFL | AI supply chain | None | HIGH | +| QS-NEW-02: Agent Identity Binding | TNFL | Multi-agent orchestration | None | HIGH | +| QS-NEW-03: Evidence Chain Integrity | TNFL | AI forensics/compliance | None | HIGH | +| QS-NEW-04: Inter-Agent Trust Protocol | HNDL + TNFL | MCP/A2A protocols | Partial | HIGH | +| QS-NEW-05: RAG Confidentiality | HNDL | Retrieval infrastructure | None | MEDIUM | --- -## Offensive Validation +## Placement Note -These risks are not theoretical. Red Specter Security Research operationalises all five attack surfaces: +Five entries is a significant ask. QS-NEW-02 and QS-NEW-03 are the strongest and most distinct. If the project leads prefer consolidation, this proposal is absorption-ready: -- **NIGHTFALL L46** — Post-Quantum AI Cryptography exploitation layer (T148 SPECTER QUANTA) -- **AI Shield M103** — Quantum AI Security Engine (defensive enforcement) +- QS-NEW-01 and QS-NEW-02 could consolidate into a single AI agent layer cryptographic dependency entry +- QS-NEW-05 could absorb into the HNDL entry proposed in #11 +- QS-NEW-04 could sit adjacent to existing inter-system trust entries -Findings are available for independent validation. All offensive tooling is gate-controlled and requires signed ROE. +Happy to revise in whatever direction is most useful for the final list. --- ## References 1. NIST FIPS 203 — ML-KEM (CRYSTALS-Kyber) -2. NIST FIPS 204 — ML-DSA (CRYSTALS-Dilithium / ML-DSA-65) +2. NIST FIPS 204 — ML-DSA (CRYSTALS-Dilithium) 3. NIST FIPS 205 — SLH-DSA (SPHINCS+) 4. RFC 3161 — Internet X.509 PKI Time-Stamp Protocol 5. OWASP LLM Top 10 2025 @@ -175,7 +207,8 @@ Findings are available for independent validation. All offensive tooling is gate 7. Red Specter RS-2026-003 — NIGHTFALL Attack Surface Taxonomy (DOI: 10.5281/zenodo.21462689) 8. ISO/IEC 42001:2023 — AI Management Systems +*These risks are operationalised in commercial tooling (details available on request). QS-NEW-02 and QS-NEW-03 public validation artefacts are in preparation.* + --- -*Red Specter Security Research Ltd | Company No. 17106988 | red-specter.co.uk* -*"While others announce. We ship."* +*Red Specter Security Research Ltd | Company No. 17106988 | red-specter.co.uk*