AITH: A Post-Quantum Continuous Delegation Protocol for Human-AI Trust Establishment
A proposed cryptographic protocol aims to give AI agents verifiable, revocable permission scopes — and survive future quantum computers breaking today's encryption.
The Thesis
As AI agents begin managing calendars, executing trades, and filing documents autonomously, the question of who authorized what — and whether that authorization can be revoked in real time — becomes a genuine security problem. AITH (AI Trust Handshake) is a proposed protocol that issues a single signed certificate defining what an AI agent is allowed to do, then enforces those boundaries at runtime without re-signing every individual action. The signing uses ML-DSA-87, a post-quantum digital signature scheme standardized by NIST in 2024 that is designed to resist attacks from quantum computers powerful enough to break today's RSA and elliptic-curve cryptography. The paper's claimed advantage is speed: 4.7 million boundary checks per second with no cryptographic overhead on the hot path, plus revocation propagation within one second. The catch is that this is a simulation and formal-verification exercise, not a production deployment — real-world performance against actual AI agent frameworks remains untested.
Catalyst
NIST finalized ML-DSA (Module-Lattice-based Digital Signature Algorithm, also called CRYSTALS-Dilithium) as FIPS 204 in August 2024, giving engineers a stable post-quantum signature standard to build on for the first time. Simultaneously, the explosion of autonomous AI agent frameworks — tools that let language models take actions in external systems — has created a concrete, urgent need for authorization infrastructure that existing protocols like OAuth 2.0 were never designed to handle. The combination of a new cryptographic primitive and a new class of software actors arriving at the same moment is what makes this paper timely.
What's New
Existing authorization protocols such as TLS (Transport Layer Security, which encrypts web traffic), OAuth 2.0 (the standard that lets apps act on your behalf with a token), and Macaroons (a flexible token scheme from Google) all assume the authorized party is deterministic software that behaves identically every run. They also typically require a cryptographic operation — a signature check or token validation — on every individual action, which is expensive at the throughput modern AI agents can generate. AITH replaces per-operation signing with a single upfront Continuous Delegation Certificate and then enforces boundaries through a lightweight rule engine, trading cryptographic overhead for a structured constraint system. The authors also add a three-tier audit chain and machine-verified security proofs using Tamarin Prover, a formal verification tool that checks protocol security under the Dolev-Yao model (a standard threat model that assumes an attacker can intercept and replay any network message).
The Counter
Everything in this paper is either a simulation or a formal model — there is no integration with a real AI agent framework, no benchmark against a real OAuth or Macaroon deployment, and no measurement of latency under realistic network conditions. The 4.7 million operations-per-second figure comes from a simulated boundary engine, not from software running inside something like LangChain or an OpenAI tool-calling loop, where the bottlenecks are entirely different. Formal verification via Tamarin Prover is valuable, but it proves the protocol is correct given its own model — it says nothing about whether the implementation will be correct, or whether the threat model captures what real adversaries will actually attempt against agentic systems. The adversarial auditing conducted by 'multi-model' AI reviewers is a novel methodology with no established track record, and using AI to audit an AI trust protocol creates a circularity the paper does not fully resolve. Most importantly, the problem space is real but the adoption path is unclear: getting AI agent platforms, enterprise identity providers, and auditors to converge on a new protocol standard is a years-long standards-body problem, not a research one.
Longs
- PQDT (no direct ETF) — consider CIBR (cybersecurity ETF) for post-quantum security exposure
- IDEX — identity and access management infrastructure adjacent to agent authorization
- OKTA — OAuth/identity incumbent that would need to absorb or build this capability
- IONQ — quantum computing progress is the threat model that makes post-quantum crypto urgent
- CRWD — endpoint and identity security vendors that will need to integrate agent authorization layers
Shorts
- OAuth 2.0 SaaS identity vendors (Okta, Auth0) — their token model is architecturally mismatched for continuous probabilistic agents; they would need significant re-engineering to compete
- Legacy PKI certificate authorities — if AI agent trust moves to purpose-built delegation certificates, traditional cert issuance becomes less central
- Classical-crypto-only security vendors — any firm whose product roadmap does not include post-quantum migration faces growing obsolescence as quantum hardware matures
Enablers (Picks & Shovels)
- NIST FIPS 204 (ML-DSA) standardization — the post-quantum signature primitive the entire protocol depends on
- Tamarin Prover — open-source formal verification tool used to machine-check the five security theorems
- LangChain / AutoGen / OpenAI Assistants API — agent frameworks that would need to adopt or integrate such a protocol
- Hardware Security Modules (HSMs) from Thales or Entrust — the likely hardware anchor for the delegation certificate in enterprise deployments
Private Watchlist
- Nillion (private) — decentralized trust and privacy infrastructure for AI
- Absurd Security (private) — agentic AI security tooling
- SEAL (SandboxAQ, private) — post-quantum cryptography consulting and implementation
Resources
The Paper
The rapid deployment of AI agents acting autonomously on behalf of human principals has outpaced the development of cryptographic protocols for establishing, bounding, and revoking human-AI trust relationships. Existing frameworks (TLS, OAuth 2.0, Macaroons) assume deterministic software and cannot address probabilistic AI agents operating continuously within variable trust boundaries. We present AITH (AI Trust Handshake), a post-quantum continuous delegation protocol. AITH introduces: (1) a Continuous Delegation Certificate signed once with ML-DSA-87 (FIPS 204, NIST Level 5), replacing per-operation signing with sub-microsecond boundary checks at 4.7M ops/sec; (2) a six-check Boundary Engine enforcing hard constraints, rate limits, and escalation triggers with zero cryptographic overhead on the critical path; (3) a push-based Revocation Protocol propagating invalidation within one second. A three-tier SHA-256 Responsibility Chain provides tamper-evident audit logging. All five security theorems are machine-verified via Tamarin Prover under the Dolev-Yao model. We validate AITH through five rounds of multi-model adversarial auditing, resolving 12 vulnerabilities across four severity layers. Simulation of 100,000 operations shows 79.5% autonomous execution, 6.1% human escalation, and 14.4% blocked.