Agenda

This presentation outlines Estonia’s roadmap for transitioning the public sector to post-quantum cryptography (PQC), officially released in April 2026. Given the significant heterogeneity in cryptographic architectures, technical capacity, and operational criticality across public sector organisations, a uniform migration approach is neither feasible nor optimal. Instead, the roadmap introduces a risk-based categorisation framework that divides public sector institutions into four priority categories (Very High, High, Medium, and Low), each associated with distinct migration timelines and tailored implementation guidelines. A particular focus is placed on low-priority organisations, whose transition steps remain underdeveloped in most existing roadmaps.

The talk first presents the developed organisation categorisation approach and the underlying risk-assessment criteria. It then details the migration framework, outlining preparation, cryptographic inventory, implementation, and monitoring steps tailored in their specifics to each priority level. Finally, in a landscape where multiple national and international PQC migration strategies are converging, the session presents a comparison with some of the existing roadmaps, along with lessons learned through the process of constructing Estonia’s PQC migration roadmap.

Over the last years, we have conducted a series of experiments to establish which PQC algorithms would be best suitable for replacing RSA and ECDSA in DNSSEC, the security extension of DNS. As a core internet protocol, it is important that DNS remains working securely when powerful quantum computers exist. DNS contains data that fits in a single small UDP packet, which is fast and reliable, or switches to a slower TCP connection for bigger packets, which uses more resources on the server side. Small signatures and public keys are therefore preferred.

We present insights from our experiments after implementing PQC in the toolchain of DNSSEC, and testing PQC algorithms using real-world data from a top-level-domain operator and a large DNS resolver operator. Using real-world data allows us to measure the real impact of PQC algorithms on both client and server performance.

You have mapped your internal cryptographic assets, you have a migration plan, and you know which algorithms you are moving to. Then you open a ticket with your HSM vendor, your cloud key management provider, your identity platform, your network appliance manufacturer, and the answers range from vague to contradictory to silent. Your suppliers are the gap between your migration plan and your migration reality.

The challenge is not limited to hardware security modules. Every product and service that uses cryptography (software libraries, CAs, signing services, authentication platforms, enterprise SaaS, embedded firmware) is a dependency in your PQC migration. And most of them are somewhere between Level 0 (nothing implemented) and Level 2 (production-ready but no inventory, no agility, no roadmap transparency). This session opens with a ten-minute introduction to how the PKI Consortium’s PQC Maturity Model (PQCMM) works in practice, then the panel takes over: what does it actually look like to mandate PQC supplier requirements at a large institution, what do assessors find when they start evaluating products against a structured framework, and what would accelerate adoption of a common standard across the supplier ecosystem.

Attendees leave with a practical starting point: how to introduce the PQCMM into procurement for high-priority suppliers today, what to put in contracts, and how to handle the inevitable exceptions.

It is time organisations stopped making the mistake of assuming they need to hire a PQC expert. The real challenge has nothing to do with solving cryptography or researching new algorithms. PQC is not a cryptographic research problem anymore. It is a PKI, enterprise and operations problem.

Let’s be blunt: hiring PQC experts without fixing PKI operations is like hiring quantum physicists to fix a broken plumbing system. The mathematics is not the problem, the infrastructure is. Most organisations still struggle with the basics: expired certificates, unknown trust relationships, weak crypto visibility, manual certificate processes and poor lifecycle governance.

This session challenges the growing narrative that organisations need dedicated PQC specialists before they can begin preparing for the quantum era. Instead, it argues that PQC migration is fundamentally a PKI operational challenge. Replacing cryptographic algorithms is only one part of the problem; the real challenge is operationalising cryptography at enterprise scale across complex environments, legacy systems, hybrid infrastructures, certificate lifecycles, trust chains and governance models.

This is where the real insight emerges. The people who can actually solve this are not those who understand the deepest mathematics of PQC, but those who understand how trust is built, managed, and sustained across an enterprise. PKI experts (the teams already responsible for certificates, key lifecycles, and trust infrastructure) are the ones who must be empowered.

PQC is not about inventing cryptography anymore. It is about surviving its transformation. The organisations that succeed in the PQC transition will not be the ones with the most theoretical quantum knowledge. They will be the ones with mature PKI foundations, automated certificate management, strong governance and operational discipline. Provocative by design, this talk reframes PQC migration from a research problem into a real-world enterprise execution challenge, and explains why fixing PKI maturity today is the most important step toward becoming quantum ready tomorrow.

In the next few years every enterprise will have to deal with two seismic shifts in digital trust that will redefine all security strategies: the phased reduction of SSL/TLS certificate lifespans to just 47 days by 2029, and the need to adopt quantum-resistant cryptography by 2030. Either mandate on its own is a major challenge. Together they represent an unprecedented technology lift for IT and security teams.

The good news is that the foundational work for each of these initiatives helps the other. Achieving crypto agility starts with certificate agility. Organizations must gain complete visibility and control over their certificate landscape to ensure widespread use of PQC algorithms for data in transit. The coming step-down of maximum TLS server certificate lifespans to monthly renewals over the next three years will necessitate exactly the same thing. Wise enterprises will combine these two initiatives to eliminate redundant technology development and expense, avoid collisions between projects, and ensure overall quality.

This presentation shares original research on enterprise readiness for these trends and describes the opportunity for enterprises to improve the outcomes of both initiatives by working on them together. Attendees will learn how a unified, automated approach to certificate automation and management can eliminate redundant efforts, reduce risk, and build agility for both mandates.

In discussions around the PQC transition, the technical migration challenge often receives the most attention. In practice, however, organizations face significant barriers before any cryptographic transition can begin: establishing governance, securing funding, aligning stakeholders, and setting up effective program management structures.

This talk builds on a whitepaper currently being developed through hands-on experience from members of two Belgian communities, Quantum Circle and the Belgian Cybersecurity Coalition. It provides practical guidance for the early stages of PQC adoption, focusing on why these initial steps are complex, how organizations can structure the necessary PQC migration engine, and how to justify the scale and urgency of such a transformation. In addition, the talk challenges commonly repeated advice on initial migration preparation and prioritization, offering a more pragmatic alternative approach.

This presentation on behalf of the GSMA PQTN task force will examine the role of a “Cryptographic Bill of Materials” in the telecommunication sector. The session will explore CBOM and its relationship to the Software Bill of Materials (SBOM), review the current standards landscape, identify telecommunications-specific use cases, and outline the regulatory drivers shaping adoption.

The need for industry alignment on CBOM use, format, and content as a means to simplify the management and communication of cryptography between parties will be highlighted. This “CBOM profile” will provide telco operators with a structured way to express cryptographic requirements, plan the migration to post-quantum cryptography, and manage cryptographic assets across their lifecycle, while giving vendors the mechanisms to communicate the cryptographic assets and future roadmap commitments associated with their products and services to operators and other stakeholders. The session concludes with actionable recommendations for telco network operators, vendors, and other relevant stakeholders engaged in the transition to post-quantum cryptography.

The presentation will be of interest to network operators, the entire telecommunications supply chain, and government regulators. It complements other standardization and industry adoption efforts.

Stateful hash-based signatures such as LMS are standardised and well understood, but translating them into deployable products involves challenges that are often absent from standards and academic literature.

This talk discusses the practical realities of deploying a stateful hash-based scheme in long-lived hardware-rooted systems. Drawing on experience securing firmware update mechanisms in commercial PCs and printers, it explores how standards guidance, hardware lifecycles, resilience requirements, certification considerations and business constraints influenced key design decisions.

It covers lessons from adopting the LMS standard into security features deployed at scale, including the challenges of balancing security, resilience, certification and operational requirements, and reflects on how later developments in standards, certification programmes and industry guidance reinforced, challenged or reshaped those decisions, and what this means for future quantum-resistant migrations.

As organizations prepare for the transition to post-quantum cryptography, much of the conversation focuses on algorithms, certificates, and PKI infrastructure. Yet the success of any migration ultimately depends on where cryptographic keys are generated, stored, and protected. For billions of enterprise and IoT devices, that foundation is the Trusted Platform Module (TPM).

This session explores the role of TPMs as the hardware root of trust enabling post-quantum migration for device identities and machine credentials. From certificate enrollment and key attestation to secure storage and cryptographic agility, TPMs provide the security foundation that allows PKI ecosystems to evolve without compromising trust.

We will examine the practical challenges PKI teams face when introducing post-quantum algorithms into existing deployments (including the hardware refresh cycle) and describe how TPM capabilities can support the transition while maintaining compatibility with existing enterprise and IoT infrastructures.

Attendees will gain a clearer understanding of how hardware-backed key protection intersects with PQC deployment, why device identity should be part of every migration roadmap, and what steps organizations can take today to prepare for a quantum-resilient future.

Post-quantum cryptography (PQC) adoption is mandated for critical EU infrastructure by 2030, yet integration into existing identity document ecosystems presents significant cryptographic and performance constraints. National ID cards with 10-year validity require quantum-resistant protection from issuance, necessitating a pragmatic transition strategy that balances algorithmic security guarantees with hardware resource limitations.

This talk points out high-risk spots in the ID card ecosystem and the key requirements for its operation. Subsequently an approach for a step-by-step PQC migration is presented, including possible scenarios for the underlying Public Key Infrastructure. The solutions employ different NIST-standardized PQC algorithms alongside traditional cryptography using hybrid schemes.

The feasibility of this approach is demonstrated by the realization of a functional demonstrator implementing hybrid cryptographic schemes on a resource-constrained, ISO 7816-compliant smart card, addressing the critical challenges of signature generation and verification time and memory footprint during authentication operations. Finally, the results of the demonstrator are presented along with the identified challenges ahead.

In this work we analyse the qualitative memory and bandwidth efficiency properties of the currently standardised post-quantum signatures as such, and of their protocol integrations mainly in the X.509 context. The term qualitative in this respect refers to how memory and bandwidth requirements scale with the size of the signed message.

Specifically, we address the question of how far the algorithms support online computations, also known as streaming, with respect to the signed message in the signing and verification operations. Further, we review the possibilities for the pre-computation of a short message representative outside the cryptographic module responsible for the signing or verification operation of the different signature schemes. We also give a preview of the corresponding cryptographic API of the PKCS#11 standard, which introduces numerous PQC signature algorithms in the upcoming version 3.2.

We demonstrate that for specific realistic use cases, the qualitative memory and bandwidth efficiency of the PQC signature schemes in protocol use varies widely and tends to be substantially degraded compared to the traditional signature schemes based on RSA and elliptic curves, which always allow for the pre-computation of a short message representative in the form of a hash value. Our results are relevant to PQC migrations of existing applications using traditional RSA or elliptic curve schemes.

Most organisations approaching post-quantum migration share the same blind spot: they have a roadmap, but no honest way to measure where their PKI actually stands. This session introduces two published outputs of the PKI Consortium’s PKIMM Working Group: the PKI Maturity Model Extension Framework, and the PQC Readiness Extension for PKI built on top of it.

The PKI Maturity Model already helps organisations benchmark their PKI programmes against an industry reference structured around four modules and fifteen capability categories. The Extension Framework defines a standardised way to overlay targeted, fast-moving maturity criteria (PQC, automation, cryptographic agility) onto the existing categories, with consistent scoring, weighting, and reporting rules. The PQC Readiness Extension, authored by Kennedy Nwup, is the first published extension, giving PKI owners a defensible answer to questions their CISOs, regulators and auditors are starting to ask.

In this joint session, Roman Cinkais (Chair, PKIMM WG) and Kennedy Nwup (Vice Chair, PKIMM WG, and author of the extension) walk through the design of the Extension Framework, present the PQC Readiness Extension in detail, show how it is intended to be used in practice, and reflect on turning a working group draft into a published, community-endorsed specification.

Attendees will leave with a published framework and a PQC Readiness Extension they can apply to their PKI programme straight away.

PKIs operate on the assumption that trusted credentials remain unforgeable over their lifetime. Advances in quantum computing challenge this premise: credentials trusted today may become forgeable in the future, introducing a “trust now, forge later” risk that directly impacts the integrity of digital identities and trust anchors.

For PKI-dependent ecosystems, migration is not just a cryptographic upgrade problem. Long-lived certificates, complex trust hierarchies, and cross-sector dependencies mean that failures can propagate systemically, affecting entire digital trust ecosystems. Yet progress toward quantum-safe PKI remains fragmented, slowed by uncertainty around standards, timelines, and ownership. The HAPKIDO societal impact assessment shows that compromised PKIs could trigger cascading failures across sectors, from disruption of public services to economic instability in banking systems.

This talk presents the HAPKIDO Handbook, which provides a consolidated, research-based framework to guide organisations and policymakers through the transition to quantum-safe PKI. It combines technical insights, governance perspectives, and societal risk analysis into a unified approach, with two main goals: raising awareness and providing actionable insights to support decision-making.

The handbook presents two key contributions: a societal risk assessment method that translates abstract quantum threats into concrete organisational and societal risks, enabling prioritisation of critical assets and services; and a five-stage growth model guiding organisations from awareness to full ecosystem adaptation, emphasising the need for coordinated action across organisational and sectoral levels. Together, these frameworks position the transition not as a technical upgrade, but as a multi-actor transformation requiring alignment across ecosystems.

The handbook highlights that early action is possible and necessary, including cryptographic inventory and adoption of cryptographic agility practices, as well as jointly testing hybrid solutions. Success depends on coordinated efforts across organisations and policymakers acting within a specific sector to avoid fragmentation and ensure interoperability. Stakeholders should begin risk-based assessment, invest in early experimentation, and actively participate in sector-specific collaboration and standardisation efforts.

Current post-quantum planning is dominated by one clock, harvest-now-decrypt-later (HNDL), but for signature infrastructure the binding exposure is trust-now-forge-later (TNFL). Once a cryptographically relevant quantum computer arrives, long-validity signing anchors become forgeable, leading to loss of trust. Using the global passport and national identity infrastructure as an empirical model for TNFL exposure analysis and remediation prioritisation, this session shows in a live demonstration exactly how trust could collapse if urgent, globally coordinated action is not put in place.

The dataset is the ICAO Master List: the self-signed country signing certificate authority (CSCA) roots that anchor verification of ICAO 9303 compliant machine-readable travel documents (MRTDs) worldwide, published as a Cryptographic Message Syntax (CMS) structure and cross-checkable against the German Federal Office for Information Security (BSI) list. Both are public and neither requires Public Key Directory (PKD) participation at the CSCA layer.

The demonstration walks through the pipeline end to end, using open tooling only so that anyone can reproduce it: hash and record provenance of the source file; unwrap the CMS encapsulated content and split the CscaMasterList into per-certificate DER with a standard-library walker; extract algorithm, key size and validity fields; then derive three outputs: installed base by algorithm and key-strength band, the share of anchors whose notAfter extends past a set of CRQC scenario years, and a fingerprint-level reconciliation between the two source lists. Every figure regenerates from the script; none is asserted by hand. Findings are reported in aggregate, without singling out individual issuers.

The reusable corollary for your own cryptographic estate is to treat the certificate as the asset-register entry, treat its notAfter field as a stated useful life, and then ask which anchors you are relying on past the point their signatures can be forged. The confidentiality wave of quantum cryptographic exposure, which dominates current attention, concentrates at scannable perimeters. The integrity wave, in contrast, is distributed across every component carrying a verifiable signature, so it surfaces only through inventory, not perimeter scanning.

Attendees leave with a runnable method and an understanding of how to apply this to their own PKI estates.

The transition to post-quantum cryptography requires more than replacing algorithms. Public-key cryptography is deeply embedded in device identity, secure boot, code signing, certificate issuance, software delivery, and credential lifecycle management. For long-lived connected and industrial devices, immediate hardware replacement is often neither financially nor operationally practical.

This presentation presents a three-stage migration framework for introducing PQC into existing device platforms while preserving current hardware roots of trust. In the first stage, symmetric cryptography and existing protected key storage are used to maintain secure boot and establish a trusted execution environment. In the second stage, that environment is used to generate, provision, and protect PQC credentials on the device. In the third stage, PQC credentials and the established boot chain are used to authenticate and deploy quantum-safe applications and software updates.

The session will examine how this staged approach applies to constrained embedded devices and large, mixed-generation fleets. It will also address the operational challenges that determine whether such a migration can scale, including cryptographic agility, key protection, credential lifecycle management, rollback, code-signing evolution, and coexistence between classical and PQC-capable devices.

The framework is based on practical experience designing PKI, secure boot, code-signing, and device-identity infrastructures for large populations of connected devices. It is intended for organizations that must begin PQC adoption before PQC-optimized hardware is broadly deployed. Attendees will leave with a concrete migration model for using existing hardware security capabilities to bootstrap PQC, introducing PQC credentials without replacing the entire installed base, and evolving PKI, secure boot, and software-signing infrastructures toward fully quantum-ready platforms.

Extracting Cryptographic Bill of Materials (CBOMs) from source code is a foundational pillar of the Post-Quantum Cryptography (PQC) transition. However, traditional security scanning methods fall short.

The limitations of SAST and vulnerability tools include limited support for legacy or proprietary languages where old cryptography often hides; the high friction and overhead of deep Abstract Syntax Tree analysis, which is computationally heavy and slows down CI/CD pipelines; scaling bottlenecks from heavy reliance on DevSecOps teams for onboarding and configuration; and a static, reactive posture that identifies risks but does not facilitate active crypto-agility.

Integrating agentic AI into CI/CD pipelines via the Model Context Protocol introduces a scalable and code-agnostic approach to CBOM management. Beyond inventory, agentic AI enables true crypto-agility in pipelines, verifying pull requests and even fixing obsolete cryptography.

Though NIST finalized ML-KEM and ML-DSA some time ago, the industry is still facing a dilemma: how to secure hardware against future threats without waiting for silicon updates. While the Trusted Computing Group (TCG) released the TPM 2.0 Library Specification v185 in March 2026 with native PQC support, the reality of enterprise deployment is that most existing hardware remains on pre-PQC TPMs.

This session moves beyond theoretical migration paths to dissect a real-world, production-grade implementation of a hybrid Virtual Smart Card architecture. We detail our transition from Microsoft’s Virtual Smart Card ecosystem to a custom, standard TPM-based solution. The core of the discussion focuses on a stop-gap but robust hybrid model: leveraging software-based post-quantum algorithms (ML-KEM and ML-DSA) for cryptographic operations while utilizing the existing TPM for the secure storage of PQC private keys.

We look at why hardware-based key protection is significantly more secure than software-based storage, comparing pure software key storage against TPM-sealed keys and the attack surface each presents (lateral movement, memory scraping, offline extraction), along with honest caveats about where the hybrid model still has gaps compared to fully native TPM computation. We then turn to key lifecycle management across mixed algorithm sets: generation, backup, rotation, and revocation, and what worked smoothly versus where the hybrid model introduces genuine complexity.

The session concludes with a frank assessment of when to wait for native TCG v185 hardware, what it actually brings to the table, and what pitfalls to avoid during the transition. Attendees will leave with a concrete blueprint for implementing crypto-agility in constrained environments and criteria for deciding when to migrate from software-hybrid models to native TPM 2.0 v185 hardware based on threat modeling and resource availability.

Organizations are rushing to inventory certificates, evaluate tooling, and launch discovery projects in preparation for post-quantum cryptography (PQC). But these activities often begin before the organization has answered the architectural and governance questions that determine what should actually change. The biggest obstacle to PQC readiness is no longer the cryptography; it is making the right organizational decisions before technology choices lock in years of unnecessary cost and complexity.

This session presents a practical decision framework built around the seven strategic choices every enterprise should make before investing in PQC tooling or migration efforts. Rather than another discussion of algorithms or migration mechanics, attendees will learn how to establish a clear, executable roadmap using existing PKI investments, governance processes, and technical teams. The result is a strategy that reduces unnecessary spending, avoids premature implementation decisions, and creates a foundation for true cryptographic agility.

Drawing from real-world enterprise PKI modernization engagements, this session demonstrates how organizations can prioritize business risk, define crypto agility objectives, align policy and architecture, and determine where inventories, assessments, and tooling actually fit within an overall PQC strategy. It covers why certificate inventory does not equal PQC readiness and where most programs go wrong, how to align business risk, governance, crypto agility, and PKI architecture before selecting technologies, and how to determine when tooling adds value and when it simply creates additional cost and complexity.

Attendees will leave with a vendor-neutral framework they can immediately apply to reduce unnecessary spending, avoid premature implementation decisions, and build a foundation for long-term cryptographic agility.

This panel explores the differences in the requirements on cryptographic inventory, and how they impact remediation efforts and migration priorities across industry verticals. Chaired by an expert in cryptographic posture management, the panel brings together representatives from finance, telecoms, energy, healthcare and transportation to determine what each sector actually needs.

The panel explores whether a universal inventory model is realistic across such fundamentally different environments, or whether sector-specific approaches to PQC discovery, cryptography information exchange and prioritisation will ultimately emerge. It covers the challenges of on-boarding external inventory tools, mapping cryptographic dependencies, and how to evaluate different tools against the individual needs of each industry.

The topic becomes particularly interesting cross-sector because financial institutions may have mature PKI governance and strong visibility into certificates and identity infrastructure yet still struggle to map cryptographic dependencies within internally developed applications and third-party SaaS ecosystems; OT-heavy sectors such as energy, manufacturing, and transportation may know their physical assets in extraordinary detail while lacking visibility into embedded cryptography within industrial control systems, field devices, firmware, and operational protocols; and telecoms providers face challenges associated with highly distributed network infrastructure, vendor equipment, and complex trust relationships across operational environments.

A year ago at the PQC Conference in Kuala Lumpur, this panel mapped the roadblocks on the path to post-quantum resilience. Twelve months on, the questions have shifted. Certificate lifetimes are collapsing toward 47 days. Post-quantum cryptography has moved from roadmap slide to operational planning under regulator and customer pressure. AI-driven workloads are beginning to demand identity at a scale traditional certificate lifecycle management was never built to support. Conversations inside CISO offices and architecture reviews have moved from strategy to deployment.

This session reconvenes the original panel for an implementation-grounded follow-up. The aim is to move past the vision and into the field: what is actually running in enterprise production today, where the new operational load is causing real failures, and what is getting torn out and rebuilt. Discussion will surface specifics: observed automation maturity across enterprise estates, failure modes under accelerated renewal cadence, and the trade-offs that emerge when crypto agility, hybrid PQC, and machine identity converge inside the same stack.

Most sessions on CLM and PQC remain at the level of strategy, principle, or capability inventory. This panel stays inside the operational reality: what works at scale, what fails first, and what the next architecture looks like once we accept that CLM is no longer an operations function but a control plane for trust. That reframe carries practical consequences: where policy lives, who owns PQC migration, how AI agent identities are issued and revoked at workload speed, and what resilience metrics should replace the older uptime-and-renewal dashboards.

The conversation is structured around four working areas: the breaking point of current approaches in a 47-day world; PQC and crypto agility as an operational discipline rather than a research topic; the architecture of a trust control plane, including how AI and autonomous workloads fit; and the business and risk reframe needed to fund and govern the shift. Attendees will leave with a clearer sense of where peer organizations actually stand on automation, PQC readiness, and machine identity scale, a working definition of what CLM 2.0 demands in practice, and a sharper view of the most expensive blind spots hiding inside today’s deployments.

The integrated master schedule for one large enterprise’s post-quantum migration grew past 120,000 discrete tasks. It was not a count of devices, certificates, or applications to upgrade. If it were, 120,000 would be small. The direct remediation work, the actual cutovers across every device and application, accounted for fewer than 30,000 tasks (a million-plus devices, systems, and apps grouped into upgrade batches).

The remaining 90,000 or so tasks are the enablement system: inventory as a living capability, governance and reporting cadence, vendor lifecycle enforcement, testing and assurance, workforce change, ecosystem and partner alignment, and ongoing operations during the long hybrid period.

Drawing on that 120,000-task plan (illustrative of complexity, not a universal count) and on three decades running high-stakes delivery programs such as national payments systems and federal health-records platforms, the talk turns to what actually governs whether such a program finishes. It is rarely the cryptography. It is the density of interdependencies: vendors waiting on internal teams, shared infrastructure that must be ready before application waves can move, regulatory deadlines colliding with finite engineering capacity. It is ownership, because cryptography is everyone’s problem and therefore no one’s, so the program needs a single accountable lead with authority across security, IT, engineering, procurement, and OT. It is workforce capacity, since the trained people a program needs at its peak in years four to eight cannot be conjured on demand. And it is funding that has to survive several budget cycles and more than one CISO. PKI realities sit inside this frame: certificate migration planned as waves rather than a single flag day, and PKI and HSM procurement and certification lead times treated as hard scheduling constraints.

Attendees leave able to right-size and sequence their own program, separate a credible plan from a wishful timeline, argue for a single accountable owner and the governance to back one, build the board case for multi-year funding, and prioritize by risk so the program delivers measurable security gains in years one to three while the longer effort runs on.

OpenSSH and libssh are 2 mostly widespread implementations of SSH protocol. Real-world requirements for PQ crypto causes writing significant patches to OpenSSH because of difference of the upstream and downstream requirements. libssh upstream is more binded to Fedora maintainers and lands the changes upstream.

The talk covers key downstream changes in OpenSSH: using OpenSSL code, providing extra algorithms support, FIPS compatibility quirks, in OpenSSH, and corresponding changes in libssh.

The transition to quantum security in the financial sector is not only a technological undertaking, but also a coordination challenge for a highly interconnected global ecosystem. Misaligned transition efforts may create operational risks, including interoperability tensions across markets, infrastructures, and jurisdictions, prolonged reliance on quantum-vulnerable cryptography, inefficient duplication of effort, and ecosystem fragmentation.

To address these risks, the Europol Quantum Safe Financial Forum, in collaboration with FS-ISAC and CFDIR, has proposed an operational framework for coordinated action. The framework focuses on identifying and prioritising critical use cases, structuring the transition through shared implementation waves, and defining three use-case-specific milestones to align sequencing and execution.

This session examines that prioritisation framework and provides an update on the state of quantum security in the financial sector, relevant not only to financial sector professionals, but to the wider community as an early example of ecosystem-wide coordination and its associated challenges.

In April 2024, the European Commission issued a Recommendation on Post-Quantum Cryptography (PQC), calling on Member States to adopt a coordinated and harmonized approach to the transition towards quantum-resistant cryptographic systems. This led to the establishment of a dedicated PQC workstream within the NIS Cooperation Group, co-chaired by France, Germany, and the Netherlands. Bringing together representatives from nearly all EU Member States, the workstream developed the European roadmap for the coordinated migration to PQC, published in June 2025.

The workstream continues to support Member States by fostering collaboration, exchanging experiences, and addressing common challenges related to the transition to PQC. In this talk, we will review the progress made since the publication of the roadmap, discuss key developments and lessons learned, and provide an outlook on the remaining priorities and future activities of the workstream.

The post-quantum migration debate routinely flattens “hybrid versus pure PQC” into a security question (one algorithm or two?) when it is really an operational architecture question about which class of failure your organisation is structured to handle.

This talk reframes the choice. Hybrid for key exchange is largely settled: deploy it now. Hybrid for authentication is harder, and the costs depend on construction. Composite signatures buy atomicity by binding two algorithms into one credential, but the same atomicity removes component-wise recovery and undoes two decades of hash-agility infrastructure. Parallel approaches deliver dual-algorithm assurance without the binding, fitting how PKI has handled every previous algorithm migration.

Drawing on a failure-mode analysis across twenty-five operational and cryptographic scenarios, the talk argues that for most enterprise authentication deployments, parallel is the better-fitting hybrid, and the conscious choice rarely defaults to it.

Quantum Safe transformation is emerging as a critical strategic priority for financial institutions, though most organisations are still in relatively early stages of structured execution. This session shares HSBC’s experience in evolving its Quantum Safe journey from a collection of early initiatives into a structured enterprise programme designed for long-term migration.

As a global financial institution operating across complex technology landscapes, HSBC recognised that successful cryptographic transformation requires more than identifying vulnerable algorithms or testing new technologies. It requires alignment across business priorities, technology domains, governance structures, third-party ecosystems, operational processes, and future investment decisions. The session explores how HSBC approached this transition by consolidating existing insights, validating readiness, strengthening alignment across stakeholders, and creating the foundations for the next stage of execution: moving from awareness and experimentation into an enterprise transformation mindset, strengthening board-level visibility, and building the governance, ownership, and execution model needed for a multi-year journey.

Rather than focusing only on technology change, this session highlights the organisational and strategic lessons behind scaling Quantum Safe adoption in a large financial institution.

The intricate web of interbank communications, transaction protocols, and shared infrastructure means no single financial institution can effectively navigate a successful Post-Quantum Cryptography (PQC) migration alone. The Quantum Safe Financial Forum (QSFF) was launched by Europol in 2024 and quickly established itself as the go-to authority for financial institutions grappling with the complexities of quantum-safe migration. The forum comprises experts from leading commercial banks, central banks, regulators and other financial entities.

A dedicated Working Group within QSFF is actively developing an aligned roadmap: precisely defining the scope of each “use-case” for PQC implementation, establishing criteria for evaluating and prioritizing those use-cases, linking business contexts to the CIA triad, identifying concrete milestones, and balancing dependencies to ensure a synchronized rollout.

This talk provides an overview of the Working Group’s structure, its deliverables to date, planned next steps, and practical ways in which the audience can contribute to this vital initiative.

2025 was a year full of preparations for deploying PQC in practice. Standards, software libraries, HSMs, a lot of everything was updated to support PQC algorithms.

PQC 2026 started with a lot of PQC capable components and a statement like, “It’s OK to have not acted YET. 2026 will be the last time this can be said”. At the end of 2025 and the beginning of 2026 was also the time for great confusion. As organizations started to ponder on the next practical steps, they had to make decisions on what algorithms to use, hybrid solutions or not, and in the case of hybrids what type of hybrid PKI. Have companies deployed PQC in production by now? The answer is yes, production deployment have started. Decisions have been made and some earlier thoughts had to be dismissed. This presentation will highlight PQC PKI choices and hierarchies based on some real world decisions.

Architecture, algorithms, and combinations. What has been chosen and why. And maybe even more interesting, what didn’t work and why? The presenters do not claim to have seen all PQC PKI deployments of 2026, but we have seen a few, and this is real world experience from those.

Post-quantum cryptography (PQC) migration is accelerating, but it also exposes a deeper reality: cryptography can no longer be treated as a one-time design choice embedded in protocols. As standards evolve, organizations must prepare for a future where multiple cryptographic assumptions coexist and continuously change, while advances in automation and AI shrink the window to respond to emerging cryptographic risks.

This talk introduces Out-of-Band (OOB) Key Agreement as a practical way to enhance PKI, establishing an independent cryptographic control layer that complements existing protocols such as TLS and IPsec. Rather than replacing in-band key exchange, OOB mechanisms derive additional authenticated symmetric keys through a separate, policy-governed channel rooted in PKI identity, enabling organizations to introduce new cryptographic methods, rotate algorithms, and respond to emerging threats without requiring changes to application or transport layers.

In this model, PKI evolves from a foundational trust anchor into a central orchestrator of cryptographic policy and lifecycle management across multiple key establishment channels, enabling both resilience through diversity and operational simplicity in a post-quantum world.

PQC guidance varies by country and by industry. Some countries publish short policy papers, others provide detailed cryptographic recommendations, and even PQC migration handbooks. We are also seeing the development of sovereign PQC algorithms and standards. This tutorial gives an overview of the PQC and cryptographic guidance that is currently available, highlights common themes, and identifies significant differences.

Designed for managers and technical architects planning for PQC migration, especially those working in multinational organizations. It is also suitable for policy makers and regulators to help them understand the changing global landscape, and developers of cryptographic products and services will also benefit.

This session shares real experience working with MODA and FSC in Taiwan, and DICT and BSP in the Philippines, to understand their guidelines and roadmaps for supporting the Taiwanese and Philippine BFSI sectors in migrating to PQC, starting from helping them become quantum-ready.

It shares real use cases covering how large national banks plan to build a golden inventory, what should be considered when preparing them to start PQC inventory and assessment, and which approach and methodology they adopt to start the assessment and the journey of PQC migration. For example, most of the banks would only adopt an agentless tool for cryptographic asset scanning; the session looks at which areas they usually start with and how they manage the data afterwards, as well as the role of the national cybersecurity authority and the central bank in driving this.

Cryptanalytically Relevant Quantum Computing (CRQC) is approaching increasingly fast, as the latest developments in hardware, software, and the application of decrypting algorithms show. But where would adversaries with a CRQC find their first targets? The public sector, involving many different institutions with huge amounts of confidential information (from monetary and financial, through organizational and strategic, to health and security data) is home to high-value targets with data retention periods that make harvest-now-decrypt-later worth the effort.

The complexity of IT systems, already heterogeneous between the different institutions and even more so between European countries, and the need for reliability and trustworthiness of this backbone of our societies, make migration a highly difficult undertaking. This is a challenge Q-PrEP is here to help tackle, in and with its community of cybersecurity agencies, public sector organizations, their private sector providers, and cybersecurity researchers on PQC and related aspects. A clear strategy, not unguided disruption of safety and secrecy, is needed and advanced by and within Q-PrEP.

To give the audience an impression of the project and its community, the presentation by the Q-PrEP project team covers an introduction to the approach and measures taken by Q-PrEP; the Q-PrEP Community as the centerpiece of the project; integration of Q-PrEP into the European PQC ecosystem; key aspects of the PQC migration in European public organizations and services and how their representatives engage in Q-PrEP; and the direction of Q-PrEP’s PQC roadmap for the public sector, Europe-wide.

The rapid growth of the IoT has transformed critical sectors such as healthcare, transportation, manufacturing, energy, and smart cities. However, IoT security is deeply dependent on public key infrastructures (PKI) for device identity, authentication, certificate management, secure onboarding, key establishment, and firmware validation. The emergence of quantum computing threatens many of the public-key algorithms underpinning today’s PKI, creating a long-term security risk for IoT deployments with constrained resources and long operational lifetimes.

This talk focuses on the transition of IoT PKI towards PQC. It examines the implications of PQC for certificates, certificate chains, device provisioning, authentication protocols, secure updates, and lifecycle management at scale. Particular attention is given to the practical challenges of deploying larger post-quantum keys and signatures on constrained IoT devices and bandwidth-limited networks. The talk also covers hybrid certificates, crypto-agile PKI architectures, migration strategies, and interoperability with existing IoT security standards.

The transition to Post-Quantum Cryptography (PQC) presents a significant challenge for organizations operating large-scale Public Key Infrastructures (PKIs). While PQC standards are becoming available, replacing vast numbers of deployed hardware tokens such as smart cards remains operationally expensive and time-consuming.

In this session, we present our implementation experience with the IETF LAMPS draft “Composite ML-DSA for Use in X.509 Public Key Infrastructure” in a hardware-separated environment for large-scale PKI migration. The approach combines existing smart cards holding traditional signature keys (e.g., RSA) with server-side Hardware Security Modules (HSMs) providing PQC signature capabilities (e.g., ML-DSA), enabling organizations to begin introducing PQC without requiring immediate replacement of end-user hardware. We discuss three representative risks observed during implementation and evaluation: cross-protocol signature composition, unintended reuse of composite-signature keys for single-algorithm signatures, and device impersonation across separated trust domains, and present a device-binding architecture that addresses them while maintaining compatibility with the IETF LAMPS composite signature framework.

We also evaluate the potential operational impact of this approach using a large-scale PKI migration model involving tens of millions of certificates, and share architectural considerations, implementation experiences, and validation results from a prototype built using cloud-based HSM services and commercially available PKI smart cards.