The PKI Consortium successfully hosted its fourth Post-Quantum Cryptography (PQC) Conference from Tuesday, October 28 to Thursday, October 30, 2025, at the Connexion Conference & Event Centre in Kuala Lumpur, Malaysia.
This premier three-day event featured hands-on workshops, followed by two days of expert-led talks, panels, and breakout sessions. It attracted top executives, technical leaders, and practitioners from both the public and private sectors, all focused on shaping the future of cryptography.
The conference was open to all individuals interested in Post-Quantum Cryptography and was not limited to PKI Consortium members.
Want to sponsor the PKI Consortium and/or our next event? Please visit our sponsorship page or contact us at contact (at) pkic.org.
Agenda
The conference featured a balanced program with strategic, informational, and educational sessions in the Plenary room, and technical deep dives in the Breakout room. Attendees enjoyed keynote speeches, interactive sessions, and panel discussions led by Post-Quantum Cryptography (PQC) experts. To ensure a focus on education, speakers were not permitted to promote products or services during presentations.
Event agenda
No locations found.
No locations found.
No locations found.
Event time · Kuala LumpurYour time
Agenda for 2025-10-28, times in Asia/Kuala_Lumpur
Time
Kuala Lumpur
TimeKuala LumpurYour time
Room 1
Room 2
Room 3
Room 4
Room 5
Room 6
Room 7
Room 8
GMT+8
Registration 30 min
GMT+8
Room 1Workshop
The Linux Foundation CBOM with CycloneDX
The CBOM workshop will help participants understand and become familiar with the upcoming extensions to the CycloneDX CBOM standard v1.7. In particular new extensions targeted at reporting PKI certificates. We are actively talking to industry vendors who have expressed interest in collaborating on this workshop.
We will explore:
Welcome & Introductions (15 min)
Introduction to Linux Foundation PQCA
CBOM Fundamentals (30 min)
Overview of CBOMs and their purpose
Progress of international standardization
Relationship between SBOMs and CBOMs
An update on the new CycloneDX standard, including PKI
CBOM Use Cases (45 min)
Telco Example (GSMA)
Product Use Cases
Open Source Software Use Case
Break (20 min)
Open-Source Tooling (70 min)
SCANOSS Open Source
Introduction
Software demonstration
Linux Foundation CBOM Toolkit
Source Code / End Point
Findings Analysis
Integration into CI/CD pipelines
Discussion and Next Steps (30 min)
Other contributions
Contributing to the Linux Foundation
Alignment with SPDX
To get the most out of this interactive experience, attendees are strongly encouraged to bring a laptop. Hands-on activities and guided tooling demonstrations will be included throughout the session.
Room 2Roundtable
This session is held under Chatham House Rules.
Welcome (20 min)
Setting the stage: Why PQC matters for healthcare
Objectives of the discussion
Deployment scenarios and technical considerations (40 min)
PQC in medical devices and IoMT (Internet of Medical Things)
Integration challenges: legacy systems, interoperability, and vendor ecosystems
Protecting patient data and secure communications in clinical environments
Industry and Standards Landscape (30 min)
Relevant standards: HL7, FHIR, ETSI, NIST
Vendor readiness and certification pathways
Regulation and Compliance Implications (30 min)
HIPAA, GDPR, and PQC implications
Role of regulators and international coordination
Strategic planning and investment (40 min)
Building the PQC business case for healthcare organizations
Cost modelling and procurement considerations
Collaboration models: hospitals, vendors, and consortia
Wrap up and Actions (20 min)
Summary of key insights
Actionable next steps
Close and feedback collection
Room 3Workshop
As quantum computing threatens modern cryptography, organizations must prepare their infrastructure for a post-quantum world. Hardware security modules (HSMs) — key to digital trust — must evolve. This workshop covers the strategic and technical foundations of quantum-safe security, focusing on Crypto4A’s 5th-generation QxHSM™.
We will explore:
Part 1: Business Imperatives (2 hrs) - Explore drivers behind PQC adoption, including regulations, risk mitigation, and use cases like harvest-now-decrypt-later. Learn what defines a quantum-safe HSM and how QxHSM™ supports crypto-agility, reduces complexity, and ensures trust and compliance.
Part 2: Technical Foundations (1.5 hrs) - Dive into PQC integration, key management, and secure HSM architecture. A live demo of QxHSM™ highlights key creation, usage, policy control, and agility.
Join us to learn how to future-proof your cryptographic systems using quantum-safe security that’s built in — not bolted on.
Note: This session is offered twice: once in the morning at 9:00 AM, and again in the afternoon at 2:00 PM, both in Room 3.
Room 4Workshop
Today's Internet of Things (IoT) relies on a variety of protocols and communications technologies…CoAP, LwM2M, LoRaWAN, NB-IoT, Wi-Fi, Thread … many of which are not quantum-safe.
While large-scale quantum computers capable of breaking current encryption aren't yet available, the concept of ""harvest now, decrypt later"" is a significant concern. Now that NIST has released final versions of its first three Post-Quantum Cryptography (PQC) standards the race is on to make IoT quantum-safe.
We will explore:
Learn what it takes to make an MQTT-based IoT solution quantum safe.
Implement and transmit data between a device and an MQTT broker using MQTT with TLS 1.3, ML-KEM, and ML-DSA using open-source tools.
In order to fully participate in this workshop you will need a Ubuntu 22.04 (arm64 or x64) virtual machine capable of running Mosquitto MQTT broker, Wireshark and some client tools (2-4GB RAM, 15-20GB disk).
Room 5Workshop
This workshop is from a collaborative effort between TNO and Zynyo. Standards are now established and libraries are being released, the integration of Post-Quantum Cryptography into products is increasing. However, the adoption of PQC is not yet universal across all scenarios and use-cases. This workshop provides a unique opportunity for participants to create signed PDF documents with hybrid PQC. DSS is a software supported by the European commission, whose functionality is the creation of digital signatures based on ETSI standards in line with European legislation such as the eIDAS regulation. TNO and Zynyo adapted DSS to support different types of hybrid certification to increase quantum-readiness.
In this workshop we will:
Explore three different types of hybrid certificates (Catalyst, Composite, Chameleon),
Have an interactive workshop on the construction and validation of hybrid certificates,
Sign PDF documents using different types of hybrid certificates,
Validate signatures to confirm their authenticity and integrity,
Visualize signed PDFs and have tangible proof of their validity.
To get the most out of this interactive experience, attendees are strongly encouraged to bring a laptop. Hands-on activities and guided tooling demonstrations will be included throughout the session.
Room 6
Module 1: Verifiable everything - Trust solutions built on trustworthy crypto
Module 2: PQC Key Generation and Hardware Root of Trust
Securing the Foundation: The critical role of Hardware Security Modules (HSMs) as the trusted root of all cryptographic operations.
PQC-Enabled HSMs: A technical deep-dive into Thales Luna HSMs and how they securely generate, store, and manage PQC private keys.
Use Case: Secure PQC Key Generation: A live or simulated demonstration of generating a new PQC private key (e.g., using ML-DSA) within a Thales HSM, ensuring it never leaves the hardware boundary. This segment would highlight the FIPS validation of the hardware.
Module 3: PQC Certificate Lifecycle Management
The PQC Discovery Challenge: Using Cyberark's platform to discover and inventory all existing cryptographic assets (certificates, keys, etc.) across an enterprise, identifying which ones are vulnerable.
Managing Certificates Today and Tomorrow: A walkthrough of how Cyberark's control plane manages the full lifecycle of certificates, from issuance to revocation, for today's certificates and tomorrow's PQC certificate.
Use Case: Automated PQC Certificate Issuance: A hands-on demonstration of Cyberark's platform orchestrating the creation of a new certificate to replace any vulnerable certificate.
Module 4: PQC-Ready Digital Signatures & Trust Services
Use Case: Signing a file with Digital Signature using ML-DSA (Dilithium) algorithm and a PQC-Ready Certificate. A live demo using CMS signature (ML-DSA algorithm) & a PQC-Ready Certificate to sign a file. The demonstration will show signature creation using ADSS Server's Signing Service and signature validation using ADSS Server's Verification Service. The signature format, validity and integrity are checked and displayed.
Module 5: Wrapping up
The PQC Migration Journey: A high-level overview of the PQC migration phases: Discovery, Planning, Remediation, and Execution.
Q&A: An open forum for participants to ask questions about real-world deployment challenges, performance impacts, and best practices.
Room 7Roundtable
This session is held under Chatham House Rules.
Welcome (20 min)
What problem are we solving? Why PQC policy and regulation matter now
Objectives and expected outcomes (cross-sector takeaways, commitments)
Policy & Guidance Landscape (30 min)
Survey of national and regional PQC guidance and timelines; convergence and gaps
Alignment on standards (e.g., NIST/ETSI/IETF) and sector regulators’ roles
Implications for government systems vs. regulated private sectors
The Good, the Bad, and the Necessary: Regulatory Approaches (40 min)
The Good: clarity, urgency, funding, and public–private coordination
The Bad: fragmentation, ambiguous mandates, over-prescription, vendor lock-in
The Necessary: harmonized milestones (e.g., high-risk first), crypto-agility, credible metrics
Balancing mandates vs. incentives; avoiding “checkbox compliance”
Implementation Realities in Government & Critical Sectors (30 min)
Discovery and inventory of cryptography; long-lived data & HNDL risk
Legacy/OT constraints, cross-border data flows, and data classification
Key management/roots of trust, certification, and supply chain considerations
Mobilizing Industry Action (40 min)
Playbooks and maturity models that sectors can adopt quickly
Procurement levers (crypto-agility requirements, CBOM/SBOM), audits, and reporting
Testbeds, pilots, and lighthouse programs; conformance and interoperability
Public–private partnerships, consortia, and regulator engagement strategies
Wrap up and Actions (20 min)
Summary of key insights and areas of consensus
Actionable next steps (owners, milestones, metrics)
Close and feedback collection
Room 8Workshop
With NIST setting a clear 2030 deadline for the deprecation of RSA and ECC in favor of quantum-safe algorithms, organizations face an urgent need to assess and modernize their cryptographic landscape. This workshop offers a practical, end-to-end session on post-quantum cryptography (PQC) migration—starting with cryptographic asset discovery and inventory, through quantum risk assessment, and culminating in the replacement of legacy algorithms with NIST-approved PQC standards.
We will explore:
Create a PQC PKI and hybrid PKI using EJBCA.
Issue a signing certificate to SignServer, and demonstrate how to integrate with a hardware security module (HSM) to secure cryptographic keys and operations—bridging the gap between proof of concept and real-world deployment.
Demonstrate cryptographic asset monitoring and automatic cryptographic migration using Keyfactor solutions.
Highlight the key steps for PQC transition at scale and with agility.
This session will equip you with the tools and strategies needed to future-proof your quantum safe cryptographic infrastructure.
To get the most out of this interactive experience, attendees are strongly encouraged to bring a laptop. Hands-on activities and guided tooling demonstrations will be included throughout the session.
Building and Monitoring Your Cryptographic Inventory with PCert
This workshop offers a deep dive into cryptographic discovery and inventory practices essential for organizations aiming to establish robust CBOM (Cryptographic Bill of Materials) and SBOM (Software Bill of Materials). Participants will learn how to identify and catalog all cryptographic assets across complex environments, laying the foundation for a comprehensive and actionable cryptographic inventory.
We will explore:
What needs to be discovered and collected to ensure full cryptographic visibility,
How to build a universal cryptographic inventory that supports ongoing operational and compliance needs,
Automation strategies for cryptographic management processes, including analysis, risk assessment, and prioritization aligned with the organizational context.
Additionally, we will address the challenges of managing systems of systems and intricate network topologies. The workshop will compare agent-based and agentless approaches to cryptographic discovery, including real-world implementation examples highlighting trade-offs and success factors.
Importantly, this session is designed to empower both technical teams and decision-makers. By reframing cryptographic challenges as data and asset management problems, the workshop reduces complexity and enables strategic engagement with existing technological capabilities.
To get the most out of this interactive experience, attendees are strongly encouraged to bring a laptop. Hands-on activities and guided tooling demonstrations will be included throughout the session.
Room 2Roundtable
This session is held under Chatham House Rules.
Welcome (20 min)
Frame the discussion (Aligning standards, strategy, and compliance)
Objectives of the workshop
Deployment scenarios and technical considerations (40 min)
The road to PQC adoption: Technology integration
Challenging scenarios: IoT, NTN, legacy
CBOM in Telco
Supporting other sectors
Industry and Standards Landscape (30 min)
Beyond the algorithms-IETF, ETSI, 3GPP, etc
Product readiness
Regulation and Compliance Implications (30 min)
Regulation landscape
Role of regulators and discussion on the international dimension
Strategic planning and investment (40 min)
PQC business case for Telcos
Cost modelling: capex vs opex for PQC migration
Implications for procurement / supply chain management
Collaboration models: industry consortia and partnerships
Wrap up and Actions (20 min)
Summary of key insights
Actionable next steps
Close and feedback collection
Room 3Workshop
As quantum computing threatens modern cryptography, organizations must prepare their infrastructure for a post-quantum world. Hardware security modules (HSMs) — key to digital trust — must evolve. This workshop covers the strategic and technical foundations of quantum-safe security, focusing on Crypto4A’s 5th-generation QxHSM™.
We will explore:
Part 1: Business Imperatives (2 hrs) - Explore drivers behind PQC adoption, including regulations, risk mitigation, and use cases like harvest-now-decrypt-later. Learn what defines a quantum-safe HSM and how QxHSM™ supports crypto-agility, reduces complexity, and ensures trust and compliance.
Part 2: Technical Foundations (1.5 hrs) - Dive into PQC integration, key management, and secure HSM architecture. A live demo of QxHSM™ highlights key creation, usage, policy control, and agility.
Join us to learn how to future-proof your cryptographic systems using quantum-safe security that’s built in — not bolted on.
Note: This session is offered twice: once in the morning at 9:00 AM, and again in the afternoon at 2:00 PM, both in Room 3.
Room 4Workshop
As organizations worldwide prepare for the quantum threat anticipated by 2030, the resilience of Public Key Infrastructure (PKI) will depend on a critical capability: crypto agility. This workshop presents Utimaco’s comprehensive strategy for quantum-safe PKI deployment, anchored around the Quantum Protect application suite for the u.trust General Purpose Hardware Security Module (HSM) Se Series.
We will explore:
Strategic Landscape of Post-Quantum Cryptography (PQC): A concise overview of key global developments, including NIST standardization efforts and emerging cryptographic mechanisms.
Seamless Transition to PQC: Learn how to migrate from classical algorithms like RSA and ECC to NIST-recommended schemes such as ML-KEM, ML-DSA, LMS, and XMSS - delivered as downloadable modules with no hardware replacement required.
Accelerating PQC Adoption with Quantum Protect Simulator: Discover how Utimaco’s free simulator - emulating a physical HSM - enables rapid prototyping and testing of PQC algorithms under real-world conditions, streamlining development and scaling across teams.
Real-World Use Cases and Ecosystem Integrations: Explore practical implementations and industry collaborations, including Utimaco’s partnerships with Keyfactor and InfoSec Global, to deliver scalable PKI and cryptographic inventory solutions across regulated sectors.
Attendees - both technical and executive - will leave equipped with actionable strategies to embed crypto agility into their PKI roadmaps. The session will cover cryptographic discovery, secure key lifecycle management, and concrete steps for future-proof PQC deployment to safeguard trust infrastructures in the quantum era.
Room 5Workshop
Implementing post-quantum cryptography shouldn’t feel like a leap into the unknown. In this workshop, you’ll see how Luna HSM enables a smooth transition to PQC through hands-on exercises and real-world scenarios. Together, we’ll explore why crypto agility matters, how to generate and manage PQC and hybrid keys, and what it takes to integrate with PKI, code signing, and key lifecycle management systems. By the end, you’ll understand not just that it works, but how and why it works.
The transition to post-quantum cryptography (PQC) is one of the most significant challenges facing security architects and PKI professionals today. It’s not just about adopting new algorithms, it’s about ensuring interoperability, crypto agility, and operational resilience in real-world environments.
This workshop offers a practical, interactive experience where participants will explore how hardware security modules (HSMs) can simplify and secure the PQC migration journey. Through live demonstrations and guided exercises, attendees will learn:
How to generate and manage PQC and hybrid keys inside an HSM (Shaun Chen, Thales)
Best practices for integrating PQC into PKI, code signing, and key lifecycle management systems (Chris Hickman, Keyfactor)
Using standard APIs (PKCS#11, KMIP, JCE) for seamless application compatibility
Secure backup, restore, and key wrapping for PQC keys in compliance with emerging standards
Rather than just telling you “it works”, this session shows you how and why it works. Giving you the confidence to start prototyping PQC-enabled solutions today.
This workshop will be presentation, demo, and open discussion in format.
Room 6
Moving to post-quantum cryptography isn’t just about swapping algorithms - it’s about evolving the entire trust infrastructure. In this interactive workshop, you’ll learn how to build a quantum-ready environment from the ground up using Entrust’s PQ Secure Solutions. From policy and compliance to PKI and HSM operations, participants will experience the full migration lifecycle in one setting.
Participants will:
Explore migration strategies, including pure ML-DSA and composite approaches, and when to use each.
Set up PQC-enabled PKI environments and replace RSA certificates with ML-DSA certificates on a live web server.
Generate and manage PQC keys within an Entrust HSM, then sign documents and transactions with quantum-safe assurance.
Use Compliance Manager to inventory crypto assets, monitor adoption, and demonstrate policy alignment.
Benchmark PQC performance (e.g., ML-DSA signing throughput) in a real environment.
This workshop provides a rare opportunity to gain hands-on experience with the cryptographic foundation for a quantum-safe future - PKI, HSM, and compliance - all in one platform. You’ll leave with practical knowledge and tools to start your organization’s PQC migration today.
Room 7Roundtable
This session is held under Chatham House Rules.
Welcome (20 min)
Setting the stage: Status of PQC in the financial sector
Objectives of the discussion
Collaboration initiatives and overview of latest recommendations
Summary of workgroups in the financial sectors and their activities
Recommendations and timelines published. How they influence the financial sector. Overview of FS-ISAC’s publication.
Assessing Migration Priorities
A methodology to assess migration priority of business use cases
Hands-on workshop: Analysis of business use cases
Identification of business use cases
Prioritization analysis
Wrap up and Actions
A prioritized list of business use cases
Selection of immediate actions
Next steps
Room 8Workshop
The world of cryptography is at a pivotal moment with the advent of Post-Quantum Cryptography (PQC). This is your chance to engage in a truly technical, interactive session with the minds behind two of the most critical open-source projects in the field.
This workshop is specifically designed for technical professionals and is structured to be driven by your questions and your challenges. We will not be delivering a pre-canned lecture. Instead, the agenda will be a dynamic exploration of multiple topics, shaped by the audience's interests in real-time.
You will have direct access to the founders of the open-source projects Bouncy Castle and EJBCA, as well as other Keyfactor experts. We invite you to bring your toughest questions and real-world scenarios across the entire spectrum of the field, from FIPS and PQC readiness to cryptographic inventory and lifecycle management.
We will kick things off with a brief, high-level overview to spark conversation, then transition into a lively "Ask Me Anything" session. Throughout the workshop, our experts will tackle your questions with live code, demos, and real-time problem-solving. Based on what is most popular, we will collectively select one or more topics for a dedicated deep-dive session.
Whether you're struggling with a specific implementation or simply want to learn more about the future of the industry from the source, this session is for you. Come prepared with your questions, and we will turn them into the content.
To get the most out of this interactive experience, attendees are strongly encouraged to bring a laptop. Hands-on activities and guided tooling demonstrations will be included throughout the session.
The afternoon workshop continues until the end of the day.
GMT+8
End of Day One
Event time · Kuala LumpurYour time
Agenda for 2025-10-29, times in Asia/Kuala_Lumpur
Time
Kuala Lumpur
TimeKuala LumpurYour time
Plenary
Breakout
GMT+8
Registration 30 min
GMT+8
Plenary
Due to a technical issue, the audio quality of the opening session is not great, and the speakers might be hard to follow for the first 18 minutes.
⇄ 5 min
GMT+8
Plenary
Digital trust is the foundation of modern economies and societies, and the arrival of quantum computing will test how ready we are to safeguard it. Post-quantum cryptography (PQC) is more than a technical response, it is a catalyst for rethinking how nations, industries, and communities build resilience and foster innovation in a rapidly changing world. In his opening keynote, Tuan Fabian Bigar, Secretary General of the Ministry of Digital, Malaysia, will welcome participants to the PKI Consortium’s PQC Conference in Kuala Lumpur and share Malaysia’s broader vision for a secure, inclusive, and sustainable digital future.
He will highlight the role of digital trust as a driver of economic growth, the importance of regional leadership within ASEAN to advance quantum readiness, and the need for global cooperation to ensure that no nation is left behind in this transition. By framing PQC as a shared opportunity rather than just a challenge, his address will set the stage for the conference, inviting all participants, governments, industry, academia, and civil society, to engage in shaping a quantum-secure world.
⇄ 5 min
GMT+8
Plenary
As the quantum computing horizon draws nearer, the imperative to secure national critical information infrastructure (NCII) against quantum threats becomes a matter of strategic urgency. In this keynote, Ir. Dr. Megat Zuhairy Bin Megat Tajuddin, Chief Executive of Malaysia’s National Cyber Security Agency (NACSA), will explore the evolving landscape of Post-Quantum Cryptography (PQC) through the lens of national security, policy, and technological leadership.
Drawing from over two decades of experience in ICT, telecommunications, and strategic innovation, including pioneering work in large-scale digital transformation projects and international policy development. Dr. Megat will outline Malaysia’s roadmap for quantum resilience. His address will highlight:
National strategies for PQC adoption across critical infrastructure and government systems.
Public-private collaboration models to accelerate cryptographic agility and secure transitions.
Regulatory and compliance frameworks aligned with global standards and regional priorities.
The role of ASEAN leadership in shaping the future of quantum-safe digital ecosystems.
This keynote will frame Malaysia’s strategic approach to PQC not only as a national imperative but also as a collaborative opportunity, bridging policy, standards, and implementation. Dr. Megat will emphasize the importance of aligning national cybersecurity strategies with global cryptographic transitions, ensuring readiness for secure interoperability in a quantum future.
GMT+8
Break 30 min
GMT+8
Plenary
The transition to post-quantum cryptography (PQC) is not a challenge faced by a single industry—it is a global transformation impacting every sector. In this 30-minute kickoff, we bring together key insights gathered from focused workshops across energy, government, financial services, and healthcare. Each vertical faces unique obstacles—regulatory demands, legacy systems, critical infrastructure dependencies, and high-stakes data protection—yet all share the urgent need for agility and trust in a quantum-ready world. This session distills the highlights from these discussions into a unified perspective: where the sectors stand today, the common themes emerging across industries, and the roadmap ahead. Attendees will walk away with a clear understanding of how PQC adoption is taking shape across the economy and what steps are necessary to drive coordinated, cross-sector progress.
Breakout
The GSMA Post Quantum Telco Network Task Force (PQTN-TF), formed in collaboration with IBM and Vodafone, is a global initiative to prepare the telecommunications sector for the cryptographic challenges posed by quantum computing. With over 60 participating organizations (including network operators, technology providers, regulators, and governments) the PQTN-TF serves as a platform for collaboration, testing, and publishing practical guidance for quantum-safe migration.
This presentation provides a technical update on PQTN-TF’s work, focusing on the implications of post-quantum cryptography (PQC) for mobile networks. It examines how 5G’s service-based architecture, distributed cloud infrastructure, and enhanced identity protection mechanisms reshape the threat landscape, while legacy vulnerabilities such as downgrade attacks and IMSI catchers persist.
We highlight PQTN-TF’s contributions to crypto-agility, including risk assessments, migration strategies, and alignment with global government initiatives and NIST timelines. Special attention is given to PQC integration challenges in telecom environments, such as key management, performance overhead, and interoperability across network functions and devices.
Attendees will gain insight into how PQTN-TF is helping the industry move from awareness to action, ensuring mobile networks remain secure in the post-quantum era.
⇄ 5 min
GMT+8
Plenary
The financial sector has moved decisively from awareness-building into active implementation of quantum-safe strategies. While 2024 primarily focused on raising awareness, 2025 has marked a significant shift towards concrete implementation activities across numerous financial institutions. The industry is now increasingly prioritizing collaboration, coordination, and streamlined efforts to avoid duplication and enhance efficiency in transitioning to quantum-safe operations.
This presentation will outline the latest initiatives that are shaping quantum-safety priorities and timelines within the financial sector. Financial institutions will benefit from practical guidance on building and benchmarking their quantum transition plans, while technology vendors will gain valuable insights into the evolving expectations and specific requirements of financial sector clients.
Breakout
The size of PQC certificate chains has thrown a wrench into plans to migrate to PQC. A full certificate chain using ML-DSA-65 will cause problems for some systems out there however there are alternatives. This talk explores those alternatives and argues that we should be using some PQC in our certificates right now. The talk will also explore what a future PKI could look like at the conclusion of NISTs additional signature competition.
⇄ 5 min
GMT+8
Plenary
Cryptographic agility is often misunderstood as purely a technical problem. This presentation challenges that assumption, arguing that agility requirements are context-dependent, often organizational in nature, and ultimately a subset of broader organizational agility.
We begin by classifying different types of PKI agility according to the need for being agile. This includes replacing the underlying cryptographic algorithms and why size matters, re-issuing certificates, replacing certificates hierarchies, reacting to key compromise and migrating to quantum safety. Through concrete examples, we show how lack of agility impacts dimensions differently. Some of the lessons date back 20 years to the transition from RSA to ECC and the experience gained deploying hybrid systems in sensitive government projects. Other lessons are more recent, for example the hybrid secure-boot mechanism on the IBM mainframe.
Breakout
Cryptography is no longer a "set it and forget it" component of software architecture. With the rapid emergence of post-quantum cryptographic standards and the constant discovery of new vulnerabilities, organizations face a growing need to adapt quickly without rewriting applications every time the cryptographic landscape shifts.
This talk will focus on the practical aspects of designing cryptographic systems that enable organizations to transition to post-quantum cryptography in a crypto-agile manner. By embedding agility into the way cryptography is consumed through abstraction, policy, key lifecycle management, and pluggable backends, organizations can avoid costly re-architecture each time cryptographic standards evolve. The framework is modular and composable, allowing teams to adopt incremental levels of cryptographic agility. This allows organizations to evolve toward a truly agile posture at a pace aligned with their security, performance, and compliance needs.
⇄ 5 min
GMT+8
Plenary
As enterprises prepare for post-quantum cryptography (PQC), the ability to discover, manage, and transition cryptographic assets at scale has become a mission-critical capability. Certificate Lifecycle Management (CLM) is often seen as the answer, but CLM at enterprise scale is more complex than most anticipate. This panel brings together thought leaders from various CLM vendors and industry experts to unpack the strategic lessons learned and operational friction points that organizations face in aligning CLM systems with quantum-resilient architectures.
Breakout
Stateful hash based signatures provide the best ratio of maturity and efficiency but require the handling of the state in a secure manner.
In this talk we show how to leverage the usability and practical efficiency of stateful signature schemes.
We show how to (nearly) close the gap between stateful and stateless signature schemes by a high level of automation built on top of a secure distributed state handling scheme.
Furthermore, we show details and lessons learned of how to increase the efficiency by distributing the key generation process and outsourcing the computation of the public authentication path to trustworthy external modules.
Putting all the pieces together results in a highly agile architecture that provides the maximum of flexibility for the whole life span of the use case by fully preserving the security and maturity of the stateful hash based signatures.
GMT+8
Lunch 60 min
GMT+8
Plenary
As the risk increases for a ‘cryptographically relevant quantum computer’ to appear, the high level of complexity, required time, and the required cost of a migration to adopt quantum-safe cryptography become apparent. Priorities for the quantum-safe migration need to become therefore clear and an organization-wide migration program needs to be set-up. This presentation will describe an approach to migrating to quantum-safe cryptography, drawing on real customer examples from different industries. It will explore the challenges of each stage and discuss some concrete steps taken in both strategic and technical dimensions. This presentation will describe a phased approach, starting with establishing awareness and understanding of the quantum-impact on an organization, as well as the establishment of a structured model for an efficient transformation. It will also focus on where cryptographic monitoring and cryptographic agility elements fit into this journey.
Breakout
Following the initial announcement of three PQC standards by NIST in 2024, and the subsequent announcement of a fourth more recently and a fifth on the way, a global game of catch up has started among standards bodies to lift the protocols and algorithm applications out of the classical era into PQC. The presentation will look at the current state of standards efforts in regards to protocols and applications and provide some thoughts on how things are evolving and why,
⇄ 5 min
GMT+8
PlenaryPanel Discussion
As ASEAN economies surge toward digital evolution. the foundation of secure communications is facing an existential challenge. The rise of quantum computing is an imminent reality that threatens to dismantle traditional encryption, leaving government data, diplomatic channels & commercial transactions vulnerable to unprecedented risks - including 'harvest now, decrypt later' threats. Discuss the profound implications of quantum computing on SEA's cybersecurity landscape and the urgent need for proactive preparation & public-private sector synergy. In a region of diverse technological maturity, escalating cyber threats & heightened geopolitical risk, building quantum-resilient communications is not only a technical necessity, it is fundamental to national security, economic stability & ASEAN’s collective digital sovereignty.
Breakout
"As the web accelerates toward Post-Quantum Cryptography (PQC), many discussions focus on key exchange and signature upgrades in TLS. This session takes a metrics-driven technical lens to argue and accelerate PQC migration and a catalyst for a necessary transformation of the WebPKI HTTPS/TLS stack with QUIC.
We will present a comprehensive analysis of the performance, latency, and security implications of PQC along with recent and upcoming changes to WebPKI in the context of QUIC and HTTP/3, including:
Latency Benchmarks: Comparing TLS 1.3 over TCP vs QUIC, 0-RTT and session resumption and security posture shifts.
Early results from hybrid PQC handshakes (e.g., X25519 + Kyber) over QUIC, with handshake size, CPU & memory footprint,Impact of short-lived certificates and ACME automation on revocation, incident response, and operational risk.
⇄ 5 min
GMT+8
Plenary
This session delivers the latest insights into Post Quantum Cryptography (PQC), beginning with an update on current standards, regulatory developments, and emerging technologies. It continues by connecting these advancements to real-world customer projects, illustrating how PQC is being applied across industries. As PQC moves from theory to deployment, attendees will explore how organizations are securing digital communications, implementing hybrid encryption, and enabling secure firmware updates. The session offers practical knowledge and implementation strategies — providing a clear view of the current state of PQC standardization, industry adoption, and the technical challenges of real-world integration.
Breakout
The migration to quantum safe algorithms have started. Many of the pieces needed to migrate are now there and can be used in practice, but there are still gaps so an organization's full use of PKI is not yet possible to migrate. The depth and width of this algorithmic migration is so vast that it will be continuous work for years to come filling in gaps as we go. This presentation will take a look at a number of practical use cases that has been tested and proven to work, as well as use cases where it is currently not possible to migrate. Standards, software, hardware and other components will be judged depending on their readiness or not, and of course some performance tests. Are you ready to get your hands dirty?
GMT+8
Break 30 min
GMT+8
Plenary
This presentation gives a thorough overview of the Dutch Roadmap and Ambitions concerning a Quantum Safe Society. This roadmap has been established in 2023, but went through various changes as the attention towards the subject of Quantum Computing grew. Besides the involvement of the central government, also knowledge institutions helped in developing the roadmap. The presentation will cover how the roadmap came to be, the various challenges it met along the way and how those challenges were met. The presentation will also include a forecast towards 2026 and beyond, on what the Dutch Government aims to achieve on the national level, not only on the Governmental level, but also for Vital Industries. And how will the European Commissions’ Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography Influence the current Dutch efforts? I’ll address all this during this presentation!
Breakout
In the presentation, we will share how we implemented PQC encryption of emails which can inter-operate between Microsoft Office365 and Google Gmail. We will describe the motivation, requirements, design and architecture of how email encryption can be achieved, and how key management is carried out seamlessly. The outcome is that we can start to protect emails against harvest-now-decrypt-later attacks.
⇄ 5 min
GMT+8
Plenary
This panel discussion isn't just about understanding the quantum threat; it's about charting a clear, actionable course for enterprises to achieve resilience in the quantum era. We'll dissect the impending quantum threat and explore the critical migration strategy to secure enterprises for the quantum era, today and tomorrow.
The panel will commence by contrasting the divergent national and regional strategies being pursued globally. From the collaborative, coordinated model of the European Union to more sovereign, state-driven approaches, the panel will highlight the nuances of each. This deep dive will also dissect the global landscape of Post-Quantum Cryptography (PQC) migration specifically relevant to the EU and Asia Pacific regions. We'll contrast these national strategies – focusing on Collaborative, Sovereign, and Capacity-building efforts – against the NIST standardization baseline, a crucial benchmark for the industry.
The core objective of this panel is to synthesize these divergent paths into a clear, actionable framework for business and technical leaders. We'll move beyond the theoretical to deliberate a practical strategy that transforms PQC migration from a complex technical challenge into a strategic imperative for risk mitigation, operational resilience, and securing a sustainable competitive advantage in the quantum era.
Breakout
New advances in Hardware Security Modules (HSMs) are enabling automation opportunities during certificate issuance. One such advance is the progress on hardware-supported attestation where a CA can ascertain the location and disposition associated with the subject key. This supports enforcing policies such as the ones relating to code signing where subject keys must be generated and held by specialized hardware. The concepts surrounding attestation have been developing quickly within the IETF (RATS working group) and work is underway to bridge the gap to HSMs. Attestation functions within the HSM enable other features such as secure audit, verification of the state of an HSM, origin of keys, and more. It is imperative that this attestation capability be quantum-safe if it is to be relied upon for key management of other quantum-safe assets. Furthermore, as attestation relies on hardware roots of trust, this capability must either be deployed at manufacturing time or with the use of quantum-safe mechanisms. This presentation describes a quantum-safe attestation feature, how it can be employed within a PKI environment, and how it can be securely deployed. It also shows the advances in automation and the improvement in compliance that arises from adopting these techniques.
⇄ 5 min
GMT+8
Plenary
Breakout
GMT+8
Networking 115 min
GMT+8
End of Day Two
Event time · Kuala LumpurYour time
Agenda for 2025-10-30, times in Asia/Kuala_Lumpur
Time
Kuala Lumpur
TimeKuala LumpurYour time
Plenary
Breakout
GMT+8
Registration 30 min
GMT+8
PlenaryPanel Discussion
With the release of NIST’s first set of post-quantum cryptographic standards, the conversation around quantum readiness has moved from research into execution. For organizations relying on hardware-based trust anchors, this shift raises immediate strategic and operational questions: What do these new standards mean for existing HSM deployments? How do performance, certification, and lifecycle planning change in a post-quantum world?
This panel brings together senior leaders from major HSM vendors and PQC experts to provide a clear, business-relevant update on the state of post-quantum integration in hardware cryptographic modules. Building on insights from previous sessions in Austin and Amsterdam, the panel will outline how vendors are approaching the integration of PQC algorithms, what early performance benchmarks indicate, and where the roadblocks lie in certification, customer adoption, and operational interoperability.
Attendees will gain a practical understanding of the timelines, trade-offs, and architectural considerations shaping the next generation of secure hardware, across both on-premises and cloud HSM landscapes. The discussion will also address how to prepare governance and procurement processes to accommodate cryptographic agility and ensure continuity of trust in regulated and high-assurance environments.
This session is essential for CISOs, CTOs, compliance leaders, and architects looking to align their cryptographic infrastructure with emerging quantum-safe mandates, without compromising on performance, reliability, or compliance.
This panel discussion runs for 55 minutes and continues in the next session block.
Breakout
As quantum-safe migration and supply chain security become critical priorities, the Cryptography Bill of Materials (CBOM) is emerging as a foundational concept and standard for cryptographic visibility and assurance. This session explores the standardization of CBOM within OWASP’s CycloneDX 1.6, highlighting its role in cataloging cryptographic assets and their dependencies, including PQC primitives and hybrids. It will also preview upcoming enhancements in CycloneDX 1.7, including standardized algorithm naming and improved interoperability for certificates and keys, both essential for quantum readiness and cryptographic agility. The talk will show how CBOM integrates into the broader xBOM ecosystem - spanning Software, Hardware, SaaS, AI, and Operations - to support unified cryptographic governance across complex environments.
⇄ 5 min
GMT+8
Plenary
This session continues the panel discussion on PQC integration in HSMs, focusing on the evolving landscape from standardization efforts to real-world deployment strategies.
Breakout
The quantum threat demands urgent upgrades to IAM systems, spanning TLS, PKI (encryption and digital signatures), and SSO protocols like SAML and OIDC. This session outlines practical strategies for transitioning to post-quantum cryptography, emphasizing post-quantum TLS (e.g., ML-KEM) and quantum-safe PKI. We highlight hybrid encryption and hybrid digital signatures to enable smooth migration with backward compatibility. Additionally, we provide actionable post-quantum recommendations for organizations to ensure crypto agility and resilience in identity management.
⇄ 5 min
GMT+8
Plenary
Most enterprises are preparing for tighter regulations, certificate renewal challenges, and post-quantum threats — yet few have a complete picture of their cryptographic landscape. Without visibility, automation and resilience remain out of reach.
This session will reveal how organizations can build a robust cryptographic inventory and discovery process, comparing three leading approaches: targeted scanning of cryptographic material, leveraging existing databases, and full enterprise assessments. We’ll map these strategies to US-NIST and CISA use cases, explore their advantages and limitations, and show how they form the foundation for PKI automation and post-quantum readiness.
Attendees will leave with actionable steps to uncover, document, and manage cryptographic assets, tackle the 47‑day certificate renewal challenge, and build a scalable, future-ready security posture.
Breakout
An often overlooked fact about Bouncy Castle's addition of the Round 3 NIST PQC Finalists in 2021/2022 was that, in addition to receiving funding to get assistance with the effort, we also received funding to have the implementations formally reviewed. At the time the review was a mixture of manual techniques and some automated tooling. Research into automated analysis has since continued and recently the Bouncy Castle team was provided access with a newer, more advanced, version of the tooling leading to identification of some issues previously missed. This talk will provide some background history to the Bouncy Castle PQC project as well how this ongoing journey in using research tools to validate the PQC libraries has progressed and what lessons have been learned to date.
GMT+8
Break 30 min
GMT+8
Plenary
The session covers practical priorities in the quantum readiness Journey for financial industry.
This session provides a focused update for C-level leaders on the financial sector’s preparedness for post-quantum cryptography. It covers recent developments across NIST, IETF, PCI DSS, and other regulatory bodies, highlighting their impact on existing architectures and risk postures.
We will examine sector-specific challenges, current sandbox and testing efforts, and practical collaboration options available to institutions. The session concludes with a tactical roadmap that CISOs and senior executives can use to align with upcoming mandates and reduce transition risk.
Breakout
Europe is advancing in EV adoption to combat climate change and support renewable energy. This shift requires redesigning the energy infrastructure for charging demands. The DITM project aims to create a digital infrastructure for automated transport, enhancing safety, efficiency, and sustainability. The EnergyPod, part of DITM, optimizes EV charging and manages grid interaction. To secure against future quantum threats, TNO, NXP, and Infiniot upgraded OCPP with hybrid quantum-safe cryptography (TLS handshake and X.509 certificates). This protocol was tested on the NXP “i.MX 8” board, similar to those in real charging stations, and will be used in the EnergyPod. Various migration scenarios were tested, and a dashboard was developed to monitor real-time quantum-safe communication. In this talk, I will discuss the setup, process, challenges, and key takeaways from migrating a high-level protocol to hybrid PQC.
⇄ 5 min
GMT+8
Plenary
Over the past few years, cybersecurity professionals worldwide have been urged—by security agencies and consultants alike—to kickstart their post-quantum cryptographic transition with a cryptographic inventory. Many have taken that advice to heart, amassing vast amounts of cryptographic data. Now, organizations face the critical question: how do we turn this information into action?
This presentation explores that very question. We’ll examine the next critical steps in the PQC transition from multiple perspectives—technical, strategic, and operational—and offer actionable guidance including prioritizing frameworks, risk-based approaches, and implementation timelines to help organizations turn insight into meaningful progress.
Breakout
We present the strategic vision and technical foundations of Singapore’s National Quantum-Safe Network (NQSN)—a resilient, fully interoperable quantum-safe testbed. Built on production-grade fiber infrastructure in a star-topology layout, the network supports multi-protocol quantum key distribution (QKD) from multiple vendors. A centralized key and network management system ensures interoperability and enables seamless integration across heterogeneous quantum and classical technologies. The testbed also supports diverse reference applications, including data center interconnects, edge computing, hybrid QKD–post-quantum cryptography (PQC) encryption, and multi-layer security across the OSI stack. These efforts demonstrate the feasibility, adaptability, and real-world relevance of deploying quantum-safe technologies in complex network environments.
⇄ 5 min
GMT+8
Plenary
Settling on PQC algorithms is only part of the journey to make our digital systems safe from the Quantum Apocalypse. An essential step is for certificates of various types to support PQC and for the regulations to allow them.
ETSI is the governing body empowered by the European Union to give us the eIDAS standard for digital certificates. In this session you will learn ETSI’s plans for PQC, the status PQC in the standards-making process, and expectations for when PQC-enabled eIDAS certificates will be available.
Breakout
Cryptocurrencies rely on PKI to ensure the authenticity and integrity of transactions through digital signatures. At the heart of this trust model is Public Key Infrastructure (PKI), which underpins the authenticity and integrity of every transaction within a blockchain network. PKI ensures that digital signatures—whether from payers initiating cryptocurrency transfers or validators confirming blocks—are verifiable and tamper-proof. RSA and ECC have long secured this ecosystem, but quantum computing threatens to break these algorithms via Shor’s algorithm, enabling private key recovery. An existing cryptocurrency network has been successfully transitioned to quantum-safety by using NIST finalist post-quantum algorithms, preserving performance, interoperability, and trust. This work demonstrates not only the feasibility but also the urgency of adapting PKI for a secure, post-quantum blockchain future.
⇄ 5 min
GMT+8
Plenary
The time to prepare for the quantum threat is upon us, and the move from traditional crypto to PQC will touch just about every cryptographic system and piece of infrastructure. To make the transition, organizations need visibility into their cryptographic estate (hardware, software, keys, certificates, secrets, etc.) and ensure they have built in crypto-agility. How does one achieve a mature crypto-agile security practice? By defining crypto-agility and understanding what it looks like for your organization. But crypto-agility is much more than moving from one system or algorithm to another. It’s about people, processes and technology. It’s about visualizing your cryptographic assets, implementing policy, driving compliance and more. In this session, we’ll discuss in detail the necessary elements to achieve a mature crypto-agile security practice, and how to overcome the challenges to get there.
Breakout
With the release of standards for Post-Quantum Cryptography (PQC) algorithms, the cryptographic community faces a paradigm shift. Unlike RSA, ECC, and DH, which were often regarded as "silver bullets" due to their efficiency in key size, signature size, and performance, current PQC algorithms introduce significant challenges.
This session will explore the practical obstacles of integrating PQC algorithms into existing products and services. Topics include the use of embedded systems that leverage LMS or ML-DSA signatures to verify component integrity, and the implications for services delivering image signature solutions, particularly with regard to backend HSM operations and compliance with CNSA 2.0. Finally, we examine how open-source PKI management tools, purpose-built for PQC, can help meet these challenges by providing scalable and adaptable infrastructures for orchestrating post-quantum cryptographic operations.
GMT+8
Lunch 60 min
GMT+8
Plenary
This presentation will share the lessons learned during the migration of several real-world systems to post-quantum cryptography and provide performance data. Specifically, we will cover three use cases carried out by two banks and the Dutch tax authority and zoom in on the technical and non-technical challenges that arose during those use cases. Some of the topics that will be discussed are crypto-agility in code, architectural solutions to blocking vendor dependencies and how to involve vendor management. Additionally, we will give an overview of the performance results of some of the migrated systems.
Breakout
Hardware/firmware co-design provides a critical advantage in post-quantum cryptographic deployments by enabling agility against evolving threats. Unlike immutable hardware-only roots of trust-potentially vulnerable to future side-channel attacks and costly remediation-co-designed systems allow field updates to mitigate emerging vulnerabilities. Real-world incidents like Checkm8 highlight the risk of static hardware. In contrast, updateable firmware enables proactive responses, including SCA patching, parameter updates, and crypto migration. This talk explores how co-design enhances security lifecycle resilience, accelerates secure development, and supports crypto agility-vital for PQC in constrained, real-world environments.
⇄ 5 min
GMT+8
Plenary
As the industry accelerates preparations for the post-quantum era, a growing number of organizations are grappling with a practical question: Which PQC deployment strategy is right for us? Should we adopt hybrid certificates, go pure post-quantum, use composite keys, or run dual cryptographic infrastructures? Each approach offers different trade-offs in terms of risk, interoperability, compliance, and operational complexity.
This panel brings together leading experts and implementers to explore real-world use cases, deployment decisions, and the rationale behind them. Panelists will share insights into how organizations are evaluating the threat landscape, aligning cryptographic agility with business needs, and choosing between strategies.
This session is designed for architects, security engineers, and decision-makers who need to answer the increasingly common question: What should we do, and why?
Breakout
As quantum computing advances, the cryptographic integrity of long-lived IoT devices is increasingly at risk. This presentation demonstrates a practical approach to securing Firmware Over-the-Air (FOTA) updates on ESP32-based IoT devices using Post-Quantum Cryptography (PQC).
We explore how NIST-standardized digital signature algorithms-ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) and SLH-DSA (FIPS 205, formerly SPHINCS+)-can be integrated into the ESP32 secure boot process to replace classical RSA/ECDSA schemes. Using the Open Quantum Safe (OQS) library, we implement PQC signing on resource-constrained hardware and evaluate the trade-offs in performance, code size, and interoperability.
The presentation features real-world deployment on ESP32 hardware, and includes practical guidance on hybrid signing approaches (e.g., ECDSA + ML-DSA) for maintaining backward compatibility. Tools such as ESP-IDF, PlatformIO, and custom signing scripts are used throughout.
⇄ 5 min
GMT+8
Plenary
This session continues the panel discussion on PQC in Practice, focusing on which PQC deployment strategy is right for use in real-world deployment strategies.
Breakout
As AI-generated video content becomes increasingly convincing, ensuring the authenticity of video material is more critical than ever. This session presents a novel method for verifying the integrity of video streams or files using post-quantum digital signatures. Designed for deployment on consumer devices, the approach safeguards against tampering and deepfake manipulation, even in a future where quantum computing threatens classical cryptographic schemes. Join us to explore the architecture, implementation, and real-world applications of this quantum-resistant solution for trusted video authentication.
GMT+8
Break 30 min
GMT+8
Plenary
Quantum computing is reshaping the foundations of digital trust, and PKI must be the first to adapt. While NIST-standard algorithms like ML-KEM and ML-DSA progress toward adoption, organizations face a deeper challenge: evolving legacy PKI into a crypto-agile, automated, and future-ready infrastructure. This session presents a blueprint for enabling that transition, without starting from scratch.
We’ll explore three strategic priorities:
Assess cryptographic exposure across TLS, S/MIME, code signing, and device identity.
Embed crypto-agility and automation into certificate lifecycles using hybrid certs (draft-ietf-lamps-x509-slhdsa-09), short-lived certificates, and ACME-based issuance models.
Align PKI governance with emerging standards from NIST(1800-38B), ETSI, CAB Forum, and IETF.
Breakout
This study integrates post-quantum cryptography into mobile IIoT via Cisco Packet Tracer models of Mobile Manufacturing Trucks and a centralized Security Operations Center. Trucks deploy sensors, routers and Quantum Shieldz AX200 modules and the SOC uses AX300DS and AXMS100DS. Hybrid TLS merges ECDHE with the ML-KEM-768 key-encapsulation mechanism (as standardized in NIST FIPS 203) . Node-RED and MQTT simulate real-time sensor streams over channels secured by SHA-3 integrity checks and QRNG keys. Tests show a 1.3× handshake-latency increase, under 300 ms responsiveness and anomaly detection under 1.5 s, meeting IEC 62443. Simulated MITM, DoS and outages yield seamless failover and state restoration. These findings confirm PQC feasibility in resource-constrained mobile IIoT and highlight the need for quantum-safe strategies. Future work will explore AI anomaly prediction, lattice signatures and hardware attestation.
⇄ 5 min
GMT+8
Plenary
Cryptographic inventories in modern enterprises are vast and the resulting alert fatigue often obscures true risk. This talk presents a novel method for automated, context-aware triage of cryptographic vulnerabilities. The technique leverages a large-scale, expert-curated knowledge base of cryptographic objects to enrich an organization's asset inventory.
This enrichment process automates expert-level analysis to distinguish benign issues (e.g., a weak key in sample code) from critical threats (the same key in production). By intelligently filtering informational noise & presenting assets in a structured, explorable format, the method transforms data overload into actionable intelligence. We demonstrate how this context-aware triaging enables security teams to isolate root causes & shift from reactive alert management to a strategy of precise, proactive remediation. The cryptographic clarity achieved through this method will significantly accelerate an organization's migration to PQC.
Breakout
As quantum computing advances, assessing the potential of current architectures to threaten AES encryption is essential. This study evaluates leading quantum processors, IBM, Google, Zuchongzhi 2, Microsoft, Rigetti, IonQ, and Honeywell, focusing on quantum gate complexity, qubit coherence time, and scalability trade-offs. It demonstrates how these systems, when scaled to thousands of qubits with error correction, could compromise AES security. The findings offer clearer insight into the timeline of quantum threats, aiding in strategic planning for mitigation and PQC migration. Enhancing AES robustness through longer key sizes and hybrid models is also explored to strengthen cryptographic readiness.
This conference was made possible through the support of the Post-Quantum Cryptography Working Group and the following organizations:
For more information about the conference, please contact the PKI Consortium at contact (at) pkic.org.
{"/api/v1/members/applications/form":{"categories":[{"code":"A","label":"Certification Authorities and Trust Service Providers","description":"Included on a trust list maintained by the PKI Consortium.","displayOrder":10,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":true,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000007","20000000-0000-4000-8000-000000000008"]},{"code":"B","label":"Trust list supervisory entities","description":"Entities that supervise and maintain a list contained in a PKI Consortium trust list.","displayOrder":20,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":true,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"C","label":"Industry regulators and supervisory bodies","description":null,"displayOrder":30,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":true,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"D","label":"Conformity assessment bodies and auditors","description":null,"displayOrder":40,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":true,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"E","label":"Standards developing organizations","description":null,"displayOrder":50,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":true,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"F","label":"PKI or cryptographic software and device providers","description":null,"displayOrder":60,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":true,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"G","label":"Relying-party software providers","description":null,"displayOrder":70,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":true,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"H1","label":"Government entities with a general PKI or cryptography interest","description":"For entities that do not fall under category C.","displayOrder":80,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":false,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"H2","label":"PKI or cryptography consultancy organizations","description":null,"displayOrder":90,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":false,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"H3","label":"PKI or cryptography research organizations","description":null,"displayOrder":100,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":false,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"H4","label":"Universities with PKI or cryptography programs","description":null,"displayOrder":110,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":false,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"H5","label":"PhD students researching PKI or cryptography","description":"Requires an institutional or university email address.","displayOrder":120,"isIndividual":true,"requiresUniversityEmail":true,"isVoting":false,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"H6","label":"Unaffiliated independent PKI or cryptography consultants","description":"For qualified consultants who are not affiliated with any organization.","displayOrder":130,"isIndividual":true,"requiresUniversityEmail":false,"isVoting":false,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"H7","label":"Unaffiliated independent PKI or cryptography researchers","description":"For qualified researchers who are not affiliated with any organization.","displayOrder":140,"isIndividual":true,"requiresUniversityEmail":false,"isVoting":false,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]},{"code":"H8","label":"Private PKI operators","description":"Organizations operating a private PKI governed by formal policies and practices.","displayOrder":150,"isIndividual":false,"requiresUniversityEmail":false,"isVoting":false,"active":true,"workflowVersionId":"00000000000040008000000000000084","revision":0,"updatedAt":"2026-09-29T15:11:09.977Z","fee":null,"eligibleWorkingGroupIds":["20000000-0000-4000-8000-000000000003","20000000-0000-4000-8000-000000000004","20000000-0000-4000-8000-000000000005","20000000-0000-4000-8000-000000000006","20000000-0000-4000-8000-000000000008"]}],"form":{"id":"14449758bc83687fa53ba7a044717144","title":"PKI Consortium Membership Application","description":"Application form for prospective PKI Consortium members.","fields":[{"id":"bfba8e98f8dbb75a64c09321f7c2715e","key":"job_title","label":"Role / Job Title","fieldType":"text","required":true,"options":[],"optionSource":null,"validation":{},"sortOrder":10,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"8eb31c73f25d9473b4a0c3c1543a2e19","key":"linkedin","label":"Professional profile (e.g., LinkedIn)","fieldType":"url","required":false,"options":[],"optionSource":null,"validation":{"placeholder":"https://www.linkedin.com/in/your-name or your employer's page about you"},"sortOrder":20,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"ba52044954701ba8eb4d533324a5af2b","key":"organization_website","label":"Organization Website","fieldType":"url","required":false,"options":[],"optionSource":null,"validation":{},"sortOrder":30,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"6bb2647786608d79d8a4b189403cce5f","key":"about_yourself","label":"About Yourself","fieldType":"textarea","required":false,"options":[],"optionSource":null,"validation":{},"sortOrder":40,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"426cfe8c2d77ed4d2ea98a629f722802","key":"about_organization","label":"About Your Organization","fieldType":"textarea","required":false,"options":[],"optionSource":null,"validation":{},"sortOrder":50,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"9bd75aaadca3e146fc9bf3c585cd2f0c","key":"reason","label":"Why do you want to join PKI Consortium?","fieldType":"textarea","required":true,"options":[],"optionSource":null,"validation":{},"sortOrder":60,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"d852debb2095ea681dbd9fe3ef4ab5e9","key":"working_groups","label":"Working Groups of Interest","fieldType":"multi_select","required":false,"options":[{"value":"20000000-0000-4000-8000-000000000007","label":"CA Working Group","active":true},{"value":"20000000-0000-4000-8000-000000000008","label":"CBOM Profiles Working Group","active":true},{"value":"20000000-0000-4000-8000-000000000004","label":"Cryptographic Module Working Group","active":true},{"value":"20000000-0000-4000-8000-000000000005","label":"PKI Maturity Model Working Group","active":true},{"value":"20000000-0000-4000-8000-000000000003","label":"Post-Quantum Cryptography Working Group","active":true},{"value":"20000000-0000-4000-8000-000000000006","label":"Training and Certification Working Group","active":true}],"optionSource":"active_working_groups","validation":{"uiWidget":"checkboxes"},"sortOrder":70,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"3106cfa67906e2c6e11e18d09c412289","key":"contribution_type","label":"How do you expect to participate?","fieldType":"select","required":false,"options":[{"value":"active","label":"Actively contribute to the consortium and its mission","active":true},{"value":"observer","label":"Observe without actively contributing","active":true}],"optionSource":null,"validation":{"helpText":"Members are not required to attend every meeting or participate in every activity."},"sortOrder":80,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"0e9be883768b990098f157e45e06b6de","key":"wants_to_present","label":"I would like to introduce myself, my organization, and our participation goals to the consortium","fieldType":"boolean","required":false,"options":[],"optionSource":null,"validation":{},"sortOrder":90,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"50a061744dc94ee9bff527ff5e3d4147","key":"interested_in_sponsoring","label":"I would like to discuss sponsoring or donating to the consortium","fieldType":"boolean","required":false,"options":[],"optionSource":null,"validation":{"helpText":"Membership has no fee; sponsorships and donations support the consortium."},"sortOrder":100,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"acfd0323186b01e715ff79ac75284bf4","key":"agrees_bylaws","label":"I and my organization (if applicable) agree to follow the PKI Consortium Bylaws","fieldType":"boolean","required":true,"options":[],"optionSource":null,"validation":{"referenceLink":{"href":"/bylaws/","label":"Read the PKI Consortium Bylaws"},"requireTrue":true},"sortOrder":110,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"3a3ed756be4b7868f4414eb45246bb78","key":"agrees_code_of_conduct","label":"I and my organization (if applicable) agree to follow the PKI Consortium Code of Conduct","fieldType":"boolean","required":true,"options":[],"optionSource":null,"validation":{"referenceLink":{"href":"/code-of-conduct/","label":"Read the PKI Consortium Code of Conduct"},"requireTrue":true},"sortOrder":120,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"ddc89d688610999892ee862677aa8253","key":"agrees_ipr_policy","label":"I and my organization (if applicable) agree to follow the PKI Consortium IPR Policy","fieldType":"boolean","required":true,"options":[],"optionSource":null,"validation":{"referenceLink":{"href":"/ipr/","label":"Read the PKI Consortium IPR Policy"},"requireTrue":true},"sortOrder":130,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null},{"id":"c8849a91e5f122835d8b8a0f5e64183e","key":"warranted_authority","label":"I represent and warrant that I have authority to submit this application and agree to be bound by these terms","fieldType":"boolean","required":true,"options":[],"optionSource":null,"validation":{"requireTrue":true},"sortOrder":140,"updatedAt":"2026-09-29T15:11:09.977Z","archivedAt":null}],"key":"membership-application"}},"/api/v1/sponsors/tiers?sponsorType=consortium":{"sponsorType":"consortium","tiers":[{"tier":"Bronze"},{"tier":"Silver"},{"tier":"Gold"},{"tier":"Platinum"},{"tier":"Titanium"},{"tier":"Diamond"}],"visibility":"public"},"/api/v1/sponsors/tiers?sponsorType=event":{"sponsorType":"event","tiers":[{"tier":"Ambassador"},{"tier":"Innovator"},{"tier":"Inspirator"},{"tier":"Leader"}],"visibility":"public"}}