The Drill: What a Cryptographic Swap Actually Costs

Abstract

Four drills were run on one reference stack on 5 October 2026: a receipt-signature swap from Ed25519 to ML-DSA-65, an agent-identity rotation with its TLS handshake cost, a channel re-termination and a cascade containment. Each engine signature and verification call, and each handshake, took milliseconds, and whole-ledger operations took seconds, mostly the engine's process start-up. The failures came from rules and settings that no component of the stack held, from a verifier policy to the definition of isolation. The paper reports the measurements, frames each drill as an exercise a regulated firm can run on a copy of its estate, and publishes the runbook template. Paper #2 of the Running Regulated Agents Series.