NIST-2025-0035

ARIA & NIST Standards Engagement

ARIA was filed with NIST on March 9, 2026 as a response to the call for input on AI agent identity infrastructure and post-quantum cryptographic transitions.

Filing Summary

Filing Reference: NIST-2025-0035
Filed By: TrustLayer Foundation
Date Filed: March 9, 2026
Category: AI Agent Identity Infrastructure
PQC Alignment: NIST FIPS 204 (ML-DSA-65)
Standards Body: NCCoE — National Cybersecurity Center of Excellence

Five Identified Threats

ARIA's NIST filing identifies five critical threats to AI agent security infrastructure that current standards do not adequately address:

Unsigned Agent Actions

AI agents can take consequential actions (purchases, data access, code deployment) with no cryptographic accountability. Any agent can impersonate any other.

Quantum Vulnerability of Current Identity Infrastructure

Existing PKI, OAuth, and JWT systems rely on RSA/ECDSA which are vulnerable to Shor's algorithm. Harvest-now-decrypt-later attacks are already underway.

No Authorization Chain

There is no standard mechanism to verify what an AI agent is authorized to do on behalf of which human principal — creating both security and liability gaps.

No Revocation Infrastructure

When an AI agent is compromised or decommissioned, there is no standard mechanism to instantly revoke its identity and propagate that revocation globally.

Prompt Injection via Identity Spoofing

Malicious agents can inject false identity claims into multi-agent pipelines. Without cryptographic identity verification, agents cannot distinguish legitimate from spoofed principals.

ARIA's Four-Layer Response

1
Cryptographic Identity Layer: ML-DSA-65 + Ed25519 hybrid signatures per NIST FIPS 204
2
DNS Anchoring Layer: TXT record indirection model binding identity to domain ownership
3
Trust Level System: L0-L3 progressive trust from self-signing to legal entity verification
4
Audit & Revocation Layer: Append-only hash-chained audit log + W3C StatusList 2021 revocation

Post-Quantum Cryptography Stance

ARIA is PQC-native from day one — not a migration target. ML-DSA-65 (NIST FIPS 204) is the primary signing algorithm. Ed25519 provides classical backward compatibility during the transition period.

Timeline alignment with NIST IR 8547:
  2026 (ARIA launch):  ML-DSA-65 primary, Ed25519 hybrid companion
  2030 (NIST deadline): Classical-only AIDs rejected by registry
  2035 (NIST disallowed): Hybrid deprecated, PQC-only enforced

Cryptosuite: mldsa65-ed25519-2026
Key sizes:   ML-DSA-65 pubkey = 1,952 bytes
             Ed25519  pubkey = 32 bytes
             Composite = 1,984 bytes
Sig sizes:   ML-DSA-65 = 3,293 bytes
             Ed25519   = 64 bytes
             Composite = 3,357 bytes

Standards Engagement Timeline

March 9, 2026

Filed NIST-2025-0035 response

April 1, 2026

ARIA v1.0 public launch

Q2 2026

W3C DID Method registration

Q3 2026

IETF Internet-Draft (AAIP) submission

2027

NCCoE concept paper engagement

2030

NIST FIPS 180-4 deprecation alignment

Download the Full Filing

The complete NIST submission document is available as a PDF.

Download NIST Filing (PDF)