Post-Quantum Cryptography Conference

Just as post-quantum cryptography (PQC) has presented significant challenges for academic cryptographers, so too has it posed unique challenges for cryptographic engineers. The new PQC primitives, with their distinct characteristics compared to traditional RSA and ECC algorithms, often require substantial protocol and application redesign to accommodate them effectively. Moreover, the need for a relatively abrupt transition to PQC across the Internet’s vast infrastructure has introduced additional complexities.

This presentation will provide a comprehensive overview of the latest developments in PQC standardization within the IETF. We will delve into the challenges and progress made in integrating PQC into common Internet protocols, highlighting key areas where work is still underway. Additionally, we will explore the implications of the newly standardized algorithms (ML-DSA, SLH-DSA, ML-KEM, LMS, XMSS) and discuss the strategies for their successful deployment. Finally, we will share insights from our research on PKI PQ/traditional hybrid modes, which offer a promising approach for enhancing both security and migration flexibility during the transition to a post-quantum world.

ETSI ESI (Electronic Signatures and Trust Infrastructures) develops policies, security, and technical requirements for Trust Service Providers (TSPs), including certification authorities, time-stamping authorities, and providers of remote signature creation, validation, registered e-delivery, and long-term data preservation services. ETSI ESI also maintains Trusted Lists, which enhance confidence in digital certificates and services by indicating TSP compliance with recognized approval schemes.

This presentation will explore how developments in Quantum-Safe Cryptography (QSC) and Post-Quantum Cryptography (PQC) affect ETSI ESI standards. It will highlight areas where changes from other standards development organizations (SDOs) may influence ETSI ESI work, discuss potential impacts on existing frameworks, and provide an estimated timeline for adoption by consumers and organizations.

Protocol ossification delayed the rollout of TLS 1.3 for years, and has once again become a roadblock in the rollout of post-quantum cryptography. In a recent large-scale study of TLS servers, we assessed the deployment compatibility of post-quantum key agreements, uncovering surprising results and insights. Notably, we observed protocol ossification in areas beyond the well-known issue of fragmented ClientHello messages due to large key sizes. We believe more surprises will emerge with post-quantum certificates, making deployment far more complex than a “flip-of-a-switch” transition.

In this talk, we share our findings from the study, and emphasize the importance of testing early to identify potential post-quantum migration challenges rather than making assumptions about where issues may arise. We walk through the subtle deployment complexities and operational issues that can arise when managing the complexities of post-quantum PKI implementations, particularly for end-user connection stability. By offering practical insights, we hope to contribute to a smoother shift to the post-quantum era, enhancing crypto-agility and strengthening the reliability of the Web PKI as a by-product.

In this session, Dr. Alexander Löw from Data-Warehouse will share real-world experiences from the National Cybersecurity Center of Excellence (NCCoE) regarding the implementation of NIST SP 1800-38B. Alexander will delve into the practical application of public key application discovery tools within the context of transitioning to PQC.

Participants will gain insights into the step-by-step process outlined in SP 1800-38B, including identifying public key cryptographic algorithms in use, assessing their vulnerability to quantum attacks, developing a migration strategy, and implementing new PQC algorithms.

By walking through the challenges encountered, attendees gain insights into what to expect during their transition, and learn about the role and benefits of Cryptographic Agility, Cryptographic Inventory, Cryptographic Bill of Material (CBOM), Software Bill of Material (SBOM), and Cryptographic Governance, providing comprehensive insights based on real-world experiences from following the National Cybersecurity Center of Excellence (NCCoE).

As we transition to Post-Quantum Cryptography (PQC), professionals across various sectors, initially in IT, finance, and business, must be retrained to implement the new NIST protocols and prepare for ongoing crypto-agile updates. This shift presents a unique challenge, as much of this retraining will need to occur on the job through workforce development programs rather than in traditional classroom settings.

This talk will focus on identifying effective strategies for developing retraining programs, drawing from past curriculum models in technologies such as High-Performance Computing and Artificial Intelligence. We will present examples of PQC retraining programs from the cybersecurity and finance sectors, demonstrating how to integrate open-source tutorials, training platforms, textbooks, and existing industry programs into a cohesive, customized curriculum that aligns with each professional’s responsibilities and already established long-term development goals.

This session will offer practical guidance to managers, team leaders and developers for designing their own PQC workforce development curricula, highlighting useful pedagogical frameworks, current tools, and available platforms.