Post-Quantum Cryptography Conference

In this presentation, Mr. Andrew Regenscheid, a distinguished expert from the U.S. National Institute of Standards and Technology (NIST), will take you on a deep dive into NIST’s standardization efforts for additional signature schemes.

In October 2024, NIST announced 14 Second-Round candidates chosen from 40 First-Round submissions, including CROSS, LESS, and even MAYO, which might bring a bit of flavor to the new algorithms.

These algorithms were selected based on rigorous evaluations of security, performance, and unique algorithm characteristics, reflecting NIST’s ongoing commitment to diversifying post-quantum cryptographic standards. Dr. Moody will discuss each selected scheme’s potential, addressing key innovations and the next steps in the standardization process.

Just as post-quantum cryptography (PQC) has presented significant challenges for academic cryptographers, so too has it posed unique challenges for cryptographic engineers. The new PQC primitives, with their distinct characteristics compared to traditional RSA and ECC algorithms, often require substantial protocol and application redesign to accommodate them effectively. Moreover, the need for a relatively abrupt transition to PQC across the Internet’s vast infrastructure has introduced additional complexities.

This presentation will provide a comprehensive overview of the latest developments in PQC standardization within the IETF. We will delve into the challenges and progress made in integrating PQC into common Internet protocols, highlighting key areas where work is still underway. Additionally, we will explore the implications of the newly standardized algorithms (ML-DSA, SLH-DSA, ML-KEM, LMS, XMSS) and discuss the strategies for their successful deployment. Finally, we will share insights from our research on PKI PQ/traditional hybrid modes, which offer a promising approach for enhancing both security and migration flexibility during the transition to a post-quantum world.

ETSI ESI (Electronic Signatures and Trust Infrastructures) develops policies, security, and technical requirements for Trust Service Providers (TSPs), including certification authorities, time-stamping authorities, and providers of remote signature creation, validation, registered e-delivery, and long-term data preservation services. ETSI ESI also maintains Trusted Lists, which enhance confidence in digital certificates and services by indicating TSP compliance with recognized approval schemes.

This presentation will explore how developments in Quantum-Safe Cryptography (QSC) and Post-Quantum Cryptography (PQC) affect ETSI ESI standards. It will highlight areas where changes from other standards development organizations (SDOs) may influence ETSI ESI work, discuss potential impacts on existing frameworks, and provide an estimated timeline for adoption by consumers and organizations.

Protocol ossification delayed the rollout of TLS 1.3 for years, and has once again become a roadblock in the rollout of post-quantum cryptography. In a recent large-scale study of TLS servers, we assessed the deployment compatibility of post-quantum key agreements, uncovering surprising results and insights. Notably, we observed protocol ossification in areas beyond the well-known issue of fragmented ClientHello messages due to large key sizes. We believe more surprises will emerge with post-quantum certificates, making deployment far more complex than a “flip-of-a-switch” transition.

In this talk, we share our findings from the study, and emphasize the importance of testing early to identify potential post-quantum migration challenges rather than making assumptions about where issues may arise. We walk through the subtle deployment complexities and operational issues that can arise when managing the complexities of post-quantum PKI implementations, particularly for end-user connection stability. By offering practical insights, we hope to contribute to a smoother shift to the post-quantum era, enhancing crypto-agility and strengthening the reliability of the Web PKI as a by-product.

In this session, Dr. Alexander Löw from Data-Warehouse will share real-world experiences from the National Cybersecurity Center of Excellence (NCCoE) regarding the implementation of NIST SP 1800-38B. Alexander will delve into the practical application of public key application discovery tools within the context of transitioning to PQC.

Participants will gain insights into the step-by-step process outlined in SP 1800-38B, including identifying public key cryptographic algorithms in use, assessing their vulnerability to quantum attacks, developing a migration strategy, and implementing new PQC algorithms.

By walking through the challenges encountered, attendees gain insights into what to expect during their transition, and learn about the role and benefits of Cryptographic Agility, Cryptographic Inventory, Cryptographic Bill of Material (CBOM), Software Bill of Material (SBOM), and Cryptographic Governance, providing comprehensive insights based on real-world experiences from following the National Cybersecurity Center of Excellence (NCCoE).

As we transition to Post-Quantum Cryptography (PQC), professionals across various sectors, initially in IT, finance, and business, must be retrained to implement the new NIST protocols and prepare for ongoing crypto-agile updates. This shift presents a unique challenge, as much of this retraining will need to occur on the job through workforce development programs rather than in traditional classroom settings.

This talk will focus on identifying effective strategies for developing retraining programs, drawing from past curriculum models in technologies such as High-Performance Computing and Artificial Intelligence. We will present examples of PQC retraining programs from the cybersecurity and finance sectors, demonstrating how to integrate open-source tutorials, training platforms, textbooks, and existing industry programs into a cohesive, customized curriculum that aligns with each professional’s responsibilities and already established long-term development goals.

This session will offer practical guidance to managers, team leaders and developers for designing their own PQC workforce development curricula, highlighting useful pedagogical frameworks, current tools, and available platforms.

With advancements in Quantum Computing, the security of our data relies heavily on robust cryptographic solutions.

Hardware Security Modules (HSMs) with integrated Post-Quantum Cryptographic (PQC) algorithms become center stage for securing data in the Quantum Computing Era. Besides providing PQC algorithms, HSMs also secure and automate key distribution for “complex to manage” stateful hash-based signature algorithms and provide hardware acceleration to meet modern applications’ cryptographic needs.

Taking those advancements as starting point, the talk will shift gear and explore how security systems, comprising of software and hardware, use Post Quantum primitives to secure their operation. Important systems include Key Management, PKI, and File & Folder Encryption. The role of each system in the security framework will be discussed, focusing on specific PQC requirements.

The talk continues to move to the solution level, and will provide insights and lessons learned for the needs and challenges of securing an inter-banking system, a project currently at the research stage.

By the end of the session, attendees will have a good overview on the capabilities of cryptographic components, how those capabilities can be used by security solutions and what is needed next, to secure whole “Ecosystems” against Quantum Computer attacks on today’s cryptography.