Agenda

Welcome to the 2026 PQC Conference. The chairs open the conference, set the agenda for the three days ahead, and invite some attending sponsors for a one-minute pitch (the only commercial message allowed at this conference).

Quantum computing has made substantial progress over the past few years, but it has also become increasingly difficult to tell which developments really matter. More qubits, better fidelities, demonstrations of error correction, new architectures, and increasingly sophisticated software all point toward a maturing field. At the same time, large-scale, fault-tolerant quantum computing remains an engineering challenge rather than an accomplished fact.

This talk takes stock of where quantum computing stands in 2026, with a focus on the developments that are most relevant for scaling towards useful quantum computation. It looks at how recent progress fits into the broader trajectory of the field and where the main technical limitations still lie.

AI has also entered this discussion. There are already meaningful ways in which machine learning and AI can help us design, control, compile, and operate quantum systems. The opposite direction, using quantum computers to improve AI, is much less settled. Separating these two directions is important for understanding where there is tangible progress and where expectations still run ahead of evidence.

Many enterprises have now begun cryptographic discovery and built Cryptographic Bills of Materials (CBOMs), only to find themselves facing a new problem: a list of tens of thousands, sometimes millions, of cryptographic artifacts with no clear way to decide what to remediate first. Inventory answers "what do we have?" but it doesn't answer "where do we start?" This session presents a practical, risk-based scoring model for prioritizing post-quantum migration at enterprise scale, developed and applied in a large organizational environment. Rather than treating all inventoried artifacts as equally urgent, the model scores each one against a set of factors: exposure (internet-facing vs. internal-only), data sensitivity classification (e.g., PCI, PII, PHI), the harvest-now-decrypt-later (HNDL) risk window based on data longevity relative to projected quantum timelines, the availability of a non-invasive remediation path, business criticality, and environmental readiness (including whether the underlying platform even supports the protocols required for migration, since gaps here can mean a hardware refresh rather than a configuration change). Attendees will see how these factors combine into a composite priority score, walk through worked examples showing how superficially similar systems can land in very different priority tiers, and examine the model's limits, which will include a deliberate, defensible "cost exceeds risk, do not migrate yet" decision point and how to document that decision for auditors and leadership rather than treating it as an oversight. The session will also cover the organizational friction this approach surfaces in practice: who owns the scoring process, how it integrates with existing GRC and risk functions, and what changes as quantum timelines and remediation costs shift over time. Attendees will leave with an adaptable scoring rubric, a set of questions to apply to their own CBOM data, and a framework for prioritizing migration work that can be defended to stakeholders, not just executed against a spreadsheet.

Anduril's post-quantum cryptography (PQC) migration is well underway. Our particular focus is on the most constrained, most possibly complicated signals environments in which to establish secure, modern communications infrastructure. In this talk, I survey the technical roadmap of Anduril Industries from no-PQC to full-PQC, with special emphasis on DDIL (Denied, Disrupted, Intermittent, and Limited) communication scenarios. This talk discusses organizational challenges, engineering roadblocks (and successes), ranging from early planning and implementation, to simulation testing, live field testing, and deployment roll-out. A special emphasis is on interoperability of protocols and cryptographic primitives, and how to effectively handle various international regulation jurisdictions, as well as a call for further, future collaboration in this space, especially on common standards across various standardization bodies.

Aircraft, rolling stock, vehicles, and vessels stay in service for decades, so the cryptography designed into them today must hold well into the quantum era. Transportation systems also depend on long and complex supply chains: tier-one suppliers, chip vendors, onboard and backend PKI, charging and ground infrastructure, and standards set by many different bodies. Industry and regulators are now beginning to set expectations for the post-quantum transition. The open question is how to plan migrations for systems that cannot simply be patched.

This roundtable brings together people from aviation, rail, automotive, mobility, shipping, and EV charging for a working discussion rather than a series of presentations. After a short introduction from the moderator, participants will compare where their organizations are starting in practice: cryptographic inventory across fleets and onboard systems, in-vehicle and onboard PKI, V2X and charging infrastructure, over-the-air and software updates, and the long-lived assets that will outlive today's algorithms.

The discussion will give particular attention to the dependencies no single operator or manufacturer can resolve alone, from suppliers and chip vendors to certification and the timing of standards, and to what the sector needs from regulators to keep migration aligned across borders.

The main conclusions will feed into a brief recap during the conference's closing session.

The transition to quantum security in the financial sector is not only a technological undertaking, but also a coordination challenge for a highly interconnected global ecosystem. Misaligned transition efforts may create operational risks, including interoperability tensions across markets, infrastructures, and jurisdictions, prolonged reliance on quantum-vulnerable cryptography, inefficient duplication of effort, and ecosystem fragmentation.

To address these risks, the Europol Quantum Safe Financial Forum, in collaboration with FS-ISAC and CFDIR, has proposed an operational framework for coordinated action. The framework focuses on identifying and prioritising critical use cases, structuring the transition through shared implementation waves, and defining three use-case-specific milestones to align sequencing and execution.

This session examines that prioritisation framework and provides an update on the state of quantum security in the financial sector, relevant not only to financial sector professionals, but to the wider community as an early example of ecosystem-wide coordination and its associated challenges.

IKEv2 is the key exchange protocol that drives IPsec, the enterprise workhorse VPN. In this talk, I will recap the standardization of extensions that allow us to use IPsec with post-quantum key exchange, and explain what features you need to turn on (or make sure to ask your suppliers for) to be secure against post-quantum adversaries, both for harvest-now decrypt-later and fully post-quantum adversaries. I will support these claims through a security analysis of IKEv2 and its extensions that we submitted to a major academic security conference.

This talk is based on joint work with Benedikt Auerbach, Keitaro Hashimoto, and Shuichi Katsumata.

This panel session will discuss the next phase of migration to Post Quantum Cryptography (PQC). As organizations move from discovery and strategy into their respective (but interconnected!) transition journeys, it is important that business continuity and interoperability be maintained throughout. This session will discuss strategic business factors that are important to consider for this transition and how industries can stay aligned.

The NIST 2030 deprecation deadline for quantum-vulnerable public-key algorithms is 1,386 days away as of March 2026. Every PKI operator, certificate authority, and security team needs to know how the software supply chain they depend on is responding. No cross-ecosystem measurement existed. We built one. This session presents findings from the first cross-ecosystem cryptographic census, scanning 2,809,479 packages across 11 package ecosystems including npm, PyPI, Go, Maven, crates.io, NuGet, and others. The results reveal the actual state of PQC adoption in the open-source supply chain that PKI infrastructure depends on. Of the 2.8 million packages scanned, 108,145 use cryptographic libraries. Among those, 21,332 depend on weak or deprecated algorithms such as MD5, SHA-1, DES, and RC4. Only 188 packages, or 0.17 percent of crypto-using packages, have any post-quantum cryptography dependency. PQC adoption is concentrated in 5 of 11 ecosystems, with crates.io accounting for 58 percent of all PQC-dependent packages. Six ecosystems show zero PQC adoption. Maven has the worst weak crypto rate at 51.6 percent.

Beyond the headline numbers, the talk addresses the migration gap that matters most for PKI operators. Dependency-level scanning, the foundation of most software composition analysis tools, misses approximately 4 times the cryptographic surface area visible to source-level analysis. We validated this gap on 20 production projects and found that 30 percent of projects with active cryptographic code show zero dependency-level signal. For PKI operators conducting cryptographic inventories under NIST IR 8547 or OMB M-23-02, this means current tooling systematically undercounts exposure.

Attendees leave with three actionable outcomes: the current state of PQC adoption in their language ecosystem with named libraries and migration paths; a reproducible census methodology they can apply to internal package registries and vendor assessments; and a clear understanding of why dependency scanning alone fails for cryptographic inventory and what to do about it.

All scanning tools, the 357-library classification catalog, the full scan dataset, and a live dashboard are released open source.

Most PQC migration advice stops at the roadmap. This session picks up where the roadmap meets production, drawing on assessment and migration work across many organizations in different sectors and at different levels of maturity. The recurring lesson is that the same failure points show up again and again, and that the gap is between a clean assessment, a practical roadmap, and successful implementation.

The talk follows the real arc of a program. It starts with discovery and assessment, including what cryptographic inventory consistently misses: statically linked libraries, keys embedded in firmware, proprietary protocols on operational networks, and cryptography buried inside third-party appliances. It then moves to the migration attempt and the things that broke in production. Hybrid and composite certificates issued into mutual TLS meshes triggered chain validation errors in older OpenSSL and JSSE clients. Handshake sizes grew large enough to fail through middleboxes and load balancers. Hardware security module gaps for composite key generation surfaced only under load. The session walks through the rollback decision and the redesign that held, which was a parallel PQC hierarchy rather than swapping roots in place.

The second half connects engineering reality to assurance reality, because the same programs hit a second wall: producing evidence auditors accept. It maps what examiners actually request against NIS2, DORA, and the CRA, including CBOMs as Article 21 documentation, certificate lifecycle reports for ICT risk testing, module attestations, and the supplier readiness evidence chain. The practical takeaway is to structure discovery and inventory output so it doubles as audit evidence from day one, rather than rebuilding it under deadline.

Attendees will leave with the failure modes that recur regardless of sector, a clear signal for when to abandon in-place hybrid roots, and a sequence that links assessment, migration, and assurance so the three are not rebuilt separately. The content is experience-led and vendor-neutral, framed entirely around what was observed in the field.

Post-quantum cryptography (PQC) migration is accelerating, but it also exposes a deeper reality: cryptography can no longer be treated as a one-time design choice embedded in protocols. As standards evolve, organizations must prepare for a future where multiple cryptographic assumptions coexist and continuously change, while advances in automation and AI shrink the window to respond to emerging cryptographic risks.

This talk introduces Out-of-Band (OOB) Key Agreement as a practical way to enhance PKI, establishing an independent cryptographic control layer that complements existing protocols such as TLS and IPsec. Rather than replacing in-band key exchange, OOB mechanisms derive additional authenticated symmetric keys through a separate, policy-governed channel rooted in PKI identity, enabling organizations to introduce new cryptographic methods, rotate algorithms, and respond to emerging threats without requiring changes to application or transport layers.

In this model, PKI evolves from a foundational trust anchor into a central orchestrator of cryptographic policy and lifecycle management across multiple key establishment channels, enabling both resilience through diversity and operational simplicity in a post-quantum world.

European agencies such as ANSSI and BSI recommend the hybrid use of post-quantum cryptographic algorithms alongside traditional schemes, driven by concerns regarding the maturity and long-term security assurance of purely post-quantum solutions. This talk focuses on two prominent approaches to fulfilling this requirement through compound algorithms: the IETF's composite signatures and KEMs, as well as Intelligent Composed Algorithms.

The original motivations behind each approach and their respective design decisions will be presented in detail, including the cryptographic construction and the security properties they aim to achieve. The advantages and drawbacks of both approaches will be examined, highlighting how they can contribute to crypto agility and how they differ from other hybridization concepts such as hybrid certificates or multiple signatures. The talk also addresses current interoperability considerations and implementation challenges. Finally, the state of standardization within the IETF and other relevant bodies will be reviewed, alongside existing support and an outlook on future work in the field of hybrid algorithms.

Many post-quantum migration discussions focus on TLS, certificates, and enterprise PKI. A different but increasingly important case is wallet-based transaction infrastructure, where long-lived accounts, public-key exposure, signature verification, hardware constraints, recovery flows, and user experience all interact with cryptographic migration.

This session presents practical lessons from designing and implementing a migration path from ECDSA-based transaction signing toward post-quantum signatures in an EVM-like blockchain environment. It focuses on architecture and engineering trade-offs rather than product claims: key generation and storage, address derivation, signature-size impact, transaction encoding, verification cost, backward compatibility, testnet strategy, smart-account and vault-based migration models, and how to avoid creating unsafe hybrid systems that merely add complexity without reducing risk.

The talk also examines the relationship between blockchain wallet infrastructure and traditional PKI concepts: identity binding, certificate-like assertions, key lifecycle management, recovery, revocation, policy enforcement, auditability, and hardware-backed key protection. Special attention is given to migration patterns that allow existing assets or accounts to gain post-quantum authorization controls without assuming an overnight replacement of legacy systems.

Attendees will leave with a concrete checklist for evaluating post-quantum readiness in transaction-signing systems: where classical signatures remain a dependency, which components need cryptographic agility, what must be measured before migration, and which design decisions can create operational or security risks during the transition.

Post-quantum migration guidance is largely written for systems that can be patched in place: swap a TLS library, rotate a certificate authority, roll out a firmware update to a fleet of servers. Automotive embedded systems break almost every one of those assumptions, and this talk is a practitioner's account of what actually happens when you run a real PQC risk and migration assessment against an in-vehicle HSM and AUTOSAR crypto stack instead of a data center.

Three constraints define the problem. First, SecOC authenticates every CAN and CAN-FD frame in real time, inside payloads that top out around 64 bytes — ML-DSA signatures and ML-KEM ciphertexts run into the kilobytes, so the real-time authentication path cannot simply be re-signed with a post-quantum primitive; the migration has to happen somewhere else in the chain. Second, the HSM is fixed-function silicon soldered into a vehicle that will still be on the road in fifteen to twenty years, with no OTA path to add lattice-math acceleration after the fact — so "harvest now, decrypt later" isn't an abstract future risk, it's a clock already running against hardware that shipped years ago. Third, the AUTOSAR crypto stack (CSM, CryIf, KeyM) was built around parameter assumptions that classical algorithms never forced anyone to question, which turns crypto-agility into a real integration problem rather than a configuration flag.

This talk walks through where post-quantum primitives map cleanly today (OTA backend TLS, V2X certificate issuance, secure boot signing), what has to stay symmetric and why, and how an ISO 21434-aligned risk assessment was used to decide which ECUs and assets get migrated first when neither silicon nor budget allow migrating everything at once.

Key Takeaways

Attendees will leave with:

• A concrete picture of what does and doesn't map onto NIST's PQC primitives in a real-time embedded authentication path, and why
• A working model for why "harvest now, decrypt later" timelines look different for fixed-lifecycle hardware than for patchable infrastructure
• A risk-based method, grounded in ISO 21434 clause 8, for sequencing PQC migration across an ECU portfolio under real budget and silicon constraints
• Open questions the automotive supply chain hasn't answered yet — useful for anyone assessing vendor or supplier readiness in this sector

Two years into the post-quantum readiness era, aligning on the algorithms is the easy part - NIST has standardized them. The hard part, that quietly derails migration programs, is the wiring: knowing what cryptography you run, where it lives, and, critically, what is connected to what and more importantly what communicates with what. This session makes the case that PQC remediation is fundamentally a dependency problem, not simply discovery and visibility. A weak protocol or a quantum-vulnerable key almost never affects only a single endpoint; it affects the relationship between 2 entities. Disable TLS 1.1 on one side of a handshake while the peer can only speak the old protocol, and you don't harden the channel, instead you break it, often a production-critical one. Fix the wrong end first and you simply relocate the weakness. Remediation must be enforced on both ends of every cryptographic relationship, at the same time. Drawing on real enterprise migration experience - including the realities of large financial-sector estates, this session will walk through a dependency-first method any organization can start with as a foundation. We start with a simple example: a single scanner finding of TLS 1.1 on a payments endpoint, and how mapping it’s peer communication set, turns the remediation ticket into much more than just remediating a single endpoint. We will look at how organizations can lay the foundation to building and maintaining a cryptographic dependency graph from layered telemetry. We go deep on the hardest dependency tree of all: certificate hierarchies and machine identities. A quantum-vulnerable root doesn't invalidate a service; it invalidates a trust fabric. PKI and the exploding population of non-human identities must be mapped first and then migrated, a Cryptographic Bill of Materials (CBOM), which is dependency-aware by design, becomes a living source of truth rather than a one-time inventory. We aim to have attendees leave with a concrete, vendor-neutral playbook: how to assemble the dependency graph, how to compute remediation clusters and surface blockers before a change window, how to sequence coordinated "add-then-remove" cutovers, and how to prioritize by secrecy lifetime based on the harvest-now-decrypt-later attack vector.

This interactive, hands-on workshop is centred around Post-Quantum Trails, an educational board game designed to demystify the complexities of migrating to post-quantum cryptography (PQC), a joint project brought to life by Cybernetica and the OpenSSL Foundation.

As quantum computing advances, the transition to quantum-safe cryptographic standards is no longer optional; it has become urgent. Yet for many developers and stakeholders, the migration process feels overwhelming and too abstract. The game brings this journey to life, guiding players through the real-world challenges of developing, standardizing, and deploying PQC solutions, and highlighting both the technical problems and the strategic trade-offs involved.

Participants will learn about the PQC landscape, understand the risks of delayed migration, and engage in a collaborative simulation that reflects actual industry challenges. Earlier versions of this workshop have been run at the OpenSSL Conference and NordSec 2025, and the facilitators will introduce the game, explain the rules, and be on hand throughout to help players, answer questions, and discuss the awareness aspect of PQC migration.

As the transition to Post-Quantum Cryptography (PQC) accelerates, organizations face a challenge that extends far beyond algorithm replacement. Success depends on understanding cryptographic dependencies, coordinating multiple stakeholders, managing supplier readiness, and establishing a sustainable model for cryptographic agility. The PKI Consortium's Post-Quantum Cryptography Maturity Model (PQCMM) provides a structured framework for assessing the quantum readiness of products and services within the supply chain. At Siemens Trust Centre, we examine how this vendor-centric model can be expanded into an enterprise-wide governance and transformation framework.

This session presents Siemens' approach to adapting the PQCMM for one of the world's largest industrial and technology environments, spanning enterprise IT, public key infrastructure, product security, and operational technology. We describe how PQCMM was integrated into a broader cryptographic governance strategy, enabling consistent assessment of suppliers, internal platforms, PKI services, smart card technologies and virtual smart card solutions.

The presentation shares practical lessons learned while building a cryptographic inventory, establishing quantum-readiness assessment criteria, evaluating strategic vendors, and defining measurable maturity targets across diverse technology domains. Particular emphasis is placed on translating technical PQC requirements into actionable governance mechanisms, supplier management processes, and migration roadmaps. We will present findings and obstacles from the implementation from HSMs, CAs and RAs, as well as governance mechanisms we had to redesign. Attendees will learn why cryptographic visibility and dependency management often represent greater challenges than algorithm adoption itself, and why cryptographic agility must become a core enterprise capability rather than a one-time project outcome.

The session concludes with practical experiences to operationalize PQC readiness, establish common maturity metrics across technology ecosystems, and align supplier management, PKI modernization, and enterprise transformation activities under a single strategic framework.

As a provider of cybersecurity solutions, Stormshield has been working on the post-quantum transition for years, for its products but also for its own IT transition. 2026 is the year when the transition starts to reach production. Focus is put on encryption, because of the store-now-decrypt-later risk, and on the network, for various reasons presented during the talk.

In this session we look at both technical aspects (which protocols, which tools, hints and feedback) and strategic aspects: what to do first, what to delay, and the non-technical issues. The session closes with a first feedback on what was easy, what was not, and what has not been migrated as expected during this year.

As governments and regulatory bodies around the world accelerate guidance and migration timelines for Post-Quantum Cryptography (PQC), mid-to-large enterprises face an increasingly urgent question: how much should we budget, and where do we begin? While the timeline for a cryptographically relevant quantum computer remains uncertain, the need to prepare is becoming a board-level risk management priority.

This session presents a pragmatic approach to building a multi-year PQC budget that balances technical requirements, operational realities, and financial constraints. Attendees will explore the primary cost drivers of a successful migration, including cryptographic discovery and the creation of a Cryptographic Bill of Materials (CBOM), certificate lifecycle modernization, crypto-agility initiatives, HSM and key management upgrades, application remediation, testing, governance, and workforce enablement.

The presentation also discusses how organizations can prioritize investments based on business risk, regulatory obligations, and cryptographic exposure, enabling a phased migration rather than a costly rip-and-replace approach. Participants will leave with a practical budgeting framework, recommended milestones, and executive-level strategies for securing funding and building organizational consensus. The objective is to help enterprises transform PQC readiness from an abstract future concern into a measurable, achievable cybersecurity program with clear business value.

Although the US has been regarded as a frontrunner in the global pursuit of quantum-readiness, distinguished by its top-down approach to the PQC transition, hosting the main institutional venue undertaking PQC standardisation, and producing a considerable amount of technical guidance through its specialist agencies, it has been facing significant domestic implementation challenges. Both executive and legislative bodies have cast a critical light, citing the slow pace of progress, the limited scope of the current US PQC migration strategy (making it mandatory only for federal government) and the lack of appropriate leadership.

The adjustments that have been proposed include, among others, more streamlined governance, performance measurement, and better encouragement for all sectors to embrace this change. New legislative proposals addressing the PQC transition have since proliferated and executive actions have reportedly been in the pipeline. After backsliding from some elements of the previous administration's PQC transition course in June 2025, the current administration released its Cyber Strategy in March 2026, promising to accelerate PQC deployment. Meanwhile CISA, one of the key actors in facilitating this transition, has been exposed to a rather precarious situation, leading to a sizeable reduction of its workforce, which may have some disruptive impact on the governance of this process.

In the EU the PQC migration has been unfolding quite differently. Here, the process has been driven for some time by strong policy entrepreneurship and expertise coming from national cybersecurity authorities in several Member States, which can be viewed as a bottom-up dynamic. The EU-level strategy formulated in 2024 appears to be more comprehensive than the US equivalent, as alongside public administrations it encompasses critical infrastructures. There is also a sound legal base in EU law, consisting of a set of regulatory instruments requiring state-of-the-art cybersecurity measures commensurate with the risks and fulfilment of the principles of privacy-by-design and security-by-design.

Arguably, however, this should be strengthened by making requirements regarding PQC more explicit and by streamlining them across the various existing instruments and guidelines for consistency and legal certainty. There is also a need for the EU to enhance its funding for PQC development and deployment, based on the rationale that it represents the main solution in countering the quantum threat, especially in the near term. Recent EU legislative proposals have generally stressed the increasing urgency of enacting the PQC migration, and although the EU has tangibly contributed to the US-led PQC standardisation endeavours with its scientific excellence in the field of cryptography, these new proposals also signal that the EU might now be set to pursue its own framework.

Attendees of this session will benefit from a granular view of how the PQC transition has been governed in these two jurisdictions and what future projections can be identified.

C509 is a lightweight approach to Public Key Infrastructure (PKI) that brings the established X.509 PKI model to constrained devices and modern applications. Rather than focusing primarily on reducing certificate / CRL / OCSP size, C509 simplifies the certificate structure and avoids much of the complexity traditionally associated with ASN.1-based X.509 implementations. This can reduce code complexity, lower memory consumption, and reduce the attack surface of PKI implementations.

This session presents the ongoing IETF work on C509 as a complete PKI ecosystem, covering certificates and certification requests, algorithm definitions, revocation, and integration with EST for certificate enrollment and lifecycle operations.

The session will also discuss the evolution of C509 for post-quantum cryptography, including the integration of PQC algorithms and the resulting considerations for certificate structures, algorithm identifiers, signatures, and interoperability.

Based on ongoing standardization and implementation experience, the presentation will share design considerations and lessons learned from simplifying PKI data structures and protocols. It will conclude with remaining challenges and opportunities for deploying C509 as a lightweight, interoperable, and crypto-agile PKI for IoT, connected devices, and other modern applications.

As organisations use AI to accelerate PQC migration, they risk creating a new form of crypto sprawl: AI-generated code that embeds algorithms, key references, provider choices, and local policy assumptions. This session shows how policy-bound cryptographic interfaces, CI/CD guardrails, and intent-level APIs can help teams use AI without losing cryptographic control.

As organisations prepare for PQC migration, agentic AI introduces a new governance risk: coding agents can generate cryptographic integrations faster than security teams can review, approve, and manage them. Without clear constraints, AI-generated applications may hard-code algorithms, key references, provider calls, fallback logic, and local policy assumptions across the software estate. The result can be greater crypto sprawl, reduced crypto agility, and new obstacles to controlled PQC migration.

This session presents an architecture and API approach for using AI safely in PQC migration programmes. Instead of allowing AI-generated applications to make cryptographic decisions, applications should express cryptographic intent while policy, key association, provider routing, algorithm selection, audit, and lifecycle management remain centrally governed. The session covers CI/CD guardrails, coding standards, policy-controlled migration from classical to post-quantum algorithms, and evidence collection for CBOM and phased cutover planning. Attendees will leave with a practical model for preventing AI-generated crypto sprawl while still using AI to accelerate PQC readiness.

When it comes to the selection of a PQC signing algorithm the family of hash based signatures pose a valid and highly interesting choice. All of its family members like SLH-DSA, LMS, XMSS provide a very conservative and mature model of security and cover a brought span of parametric options. Hence, they seem to be a natural choice in practice, especially when NIST announced new parameter sets for SLH-DSA (NIST SP800-230). However, due to their extreme diverse parametric options they are discussed most controversial: from super efficient on certain operations vs. challenging on others, super mature in design vs. challenging in handling the state. In numerous projects we gained a large set of experiences how to select the optimal signing algorithm and what are the practical implications. In this talk we want to share our experiences. We give an overview over the different advantages and challenges and provide a decision workflow to select the optimal signing algorithm for dedicated classes of use cases.

The quantum threat is no longer theoretical. Yet moving a large organization from awareness to structured action, systematically and without paralysis, remains genuinely difficult. This talk shares practical insights from two years inside a live post-quantum security transformation, built around four pillars.

Planning despite uncertainty: how hypothesis-based planning keeps long-term strategy adaptable, and how transparency and accountability turn ambiguity into a manageable condition rather than a blocker. Making risk tangible: abstract threats don't move budgets, so we present our framework for prioritizing across a complex IT landscape, including a method for quantifying quantum exposure and translating it into a concrete sense of urgency for decision-makers.

Building awareness that sticks: transformation stalls without broad understanding, so we share what has worked for propagating post-quantum safety awareness internally across all organizational levels, and externally through collaboration with partners and suppliers. Governing what you measure: a real insight into our operative governance model, the KPIs we track, the maturity framework we developed, early results, and an honest outlook on the road ahead.

We offer no definitive answers; quantum readiness is still a work in progress for us, as it is for most. What we can offer is a transparent view into a complex, ongoing transformation and the frameworks that have helped us navigate it.

LMS is a proven post-quantum signature scheme, but its stateful nature creates deployment challenges that are easy to underestimate. This session shares practical lessons from implementing LMS in real-world post-quantum trust scenarios, with a focus on one-time signature key management, constrained environments, firmware-style workflows, verification performance, and operational failure modes. Attendees will learn where LMS fits, where it does not, and what engineering decisions are needed to deploy stateful hash-based signatures safely as part of a quantum-resistant architecture.

Securing Healthcare for the Quantum Era: A PQC Readiness Roundtable

Medical devices approved and deployed today will remain in clinical use for a decade or more, and patient records carry confidentiality obligations measured in decades. Both timelines run past the point at which today's public-key cryptography is expected to fail, yet healthcare has some of the longest certification cycles and the least room for disruptive change of any sector.

This roundtable brings healthcare providers, device manufacturers, life sciences organizations, and their suppliers together for a working discussion rather than a series of presentations. After a short introduction from the moderator, participants will examine what post-quantum readiness looks like in environments where equipment cannot simply be patched, where regulatory approval governs every change, and where availability is a patient safety matter.

The discussion will focus on a small number of practical questions: how post-quantum migration fits into device certification and product lifecycles; what healthcare organizations can reasonably demand from their suppliers and on what timeline; and how to protect long-lived patient data against harvest-now-decrypt-later exposure.

The main conclusions will feed into a brief recap during the conference's closing session.

Cryptographic resilience requires multi-year enterprise transformation, not a technical remediation exercise. Yet many organizations still treat it as one. That is a mistake.

Digital trust depends on a cryptographic estate that is everywhere, used by everyone, yet owned by no one. Its closest organizational parallel is not in technology. It’s data. And that parallel is not reassuring. Data management and governance programs are decades old and rife with failure. Meanwhile, PQC has a hard three- to eight-year deadline.

Like early data initiatives, PQC programs meet nearly every condition for failure: a long-time horizon, lack of business ownership, deep technical complexity, unmapped dependencies, low enterprise literacy, and budget cycles that reward near-term value over invisible risk reduction. Compounding these challenges, uncertain impact timelines mean that those responsible for acting on PQC today may be the ones to suffer tomorrow’s consequences, weakening urgency, ownership, and escalation.

Enterprise transformation is ultimately a complex systems problem. Ashby’s Law of Requisite Variety is clear: the system will defeat any controller that lacks the capacity to manage its complexity. That controller is your PQC program.

Drawing on systems theory, modern data governance principles, and more than 30 years of experience leading complex enterprise transformations, this session demonstrates why inventories, standards, and vendor readiness are necessary but insufficient, and why early board engagement is a determining factor in PQC program success. Participants will leave with a concrete, practice-tested framework for establishing cryptographic governance and securing sustained board engagement.

FIPS is only a suggestion, sortof. Specifically, FIPS only requires "mathematical equivalence" to the listed algorithms, and that gives a surprisingly wide latitude for implementations to play algorithmic games in search of either fast or small implementations.

This talk will explore speed-vs-memory tradeoff techniques applicable to the ML-DSA and ML-KEM algorithms and the results that they obtain within the Bouncy Castle Rust library. We start with a close look at the "default" implementation, then at what you can do to move around the High Speed <--> Low Memory spectrum. In one direction, you can pre-expand intermediate values at key-load time for faster sign, verify, encaps and decaps operations which gives performance increases in the 40% - 60% range (especially valuable if doing multiple operations against the same key). In the other direction, your in-memory private key representation can consist of only intermediate seed values and you can re-derive the active lattice values one entry at a time as they are needed; you pay a penalty for deriving the same intermediate values multiple times for a dramatic reduction in memory footprint. This technique has a particularly pronounced effect on ML-DSA where ML-DSA-87.sign() can be performed in under 30 kb of peak memory usage, which represents roughly a 7.5x decrease in memory usage in exchange for a 6x increase in runtime; which is a win on heavily-loaded servers where parallelism is gated by RAM not by CPU.

Brief closing remarks for the red hall audience and a preview of Day 2.

Brief closing remarks for the blue hall audience and a preview of Day 2.

Welcome and agenda highlights for the red hall audience: a quick look at what is on today and how to get the most out of it.

Parallel welcome and agenda highlights for the blue hall audience.

You have mapped your internal cryptographic assets, you have a migration plan, and you know which algorithms you are moving to. Then you open a ticket with your HSM vendor, your cloud key management provider, your identity platform, your network appliance manufacturer, and the answers range from vague to contradictory to silent. Your suppliers are the gap between your migration plan and your migration reality.

The challenge is not limited to hardware security modules. Every product and service that uses cryptography (software libraries, CAs, signing services, authentication platforms, enterprise SaaS, embedded firmware) is a dependency in your PQC migration. And most of them are somewhere between Level 0 (nothing implemented) and Level 2 (production-ready but no inventory, no agility, no roadmap transparency). This session opens with a ten-minute introduction to how the PKI Consortium's PQC Maturity Model (PQCMM) works in practice, then the panel takes over: what does it actually look like to mandate PQC supplier requirements at a large institution, what do assessors find when they start evaluating products against a structured framework, and what would accelerate adoption of a common standard across the supplier ecosystem.

Attendees leave with a practical starting point: how to introduce the PQCMM into procurement for high-priority suppliers today, what to put in contracts, and how to handle the inevitable exceptions.

At itsme, an eIDAS Level High recognised identity scheme, we explored several post-quantum migration strategies for user authentication. Itsme consists of a mobile application installed on the user's phone and a secure backend. In this context, user authentication means proving that the app is running on the same device the user originally registered with, combined with proof of knowledge and/or inherence (typically a PIN or biometrics) established by the user at registration.

Given the current uncertainty around long-term post-quantum algorithm robustness and ecosystem maturity, we focused primarily on hybrid approaches — combining post-quantum cryptography with classical cryptography — to preserve today's security guarantees while building in resilience against future quantum threats.

Beyond algorithm selection, a key challenge is migrating our existing user base to the new cryptographic scheme without compromising security or disrupting the user experience.

In this talk, we will present the different approaches we implemented, give real numbers, discuss the impact each approach has on the user, and weigh the pros and cons of each.

Standardization is not the end of assurance. An algorithm can be standardized, shipped, and still have to be replaced or re-verified on short notice, and a hybrid signature can pass its own unit tests and still fail the first independent implementation that receives it. We encountered the second problem while adding ML-DSA-65 to a public offline evidence format: a development signer and verifier using the same JavaScript library agreed with each other, while an independent Python FIPS 204 implementation rejected the signature. That failure changed both our dependency baseline and our working definition of "PQC-ready."

This deep dive presents the resulting reproducible artifact: a signer that covers the same canonical bytes with RSA-4096 and ML-DSA-65, an RFC 9881 SubjectPublicKeyInfo, and independent TypeScript and Python verification paths. The shared public corpus now contains thirteen conformance packages: five accepted packages and eight deliberate rejection controls. A separate six-package downgrade lab is replayed under two relying-party policies by both implementations, producing twenty-four verifier-policy observations with no verdict or first-failure-code mismatch.

The session concentrates on three implementation boundaries.

1. Self-interoperability is not cross-implementation evidence. We show the cross-implementation probe that exposed the dependency-version failure and explain why a positive FIPS 204 vector belongs in continuous integration.
2. ML-DSA key bytes are not yet a deployable certificate interface. We encode id-ml-dsa-65 according to RFC 9881, require absent AlgorithmIdentifier parameters, and retain the earlier raw-key convention only for read compatibility.
3. Downgrade resistance has two layers. Removing the PQC entries from a hybrid package is rejected because a signed witness still names them. A legitimately created classical-only transition package, however, remains acceptable unless the relying party selects an explicit require-pqc policy. Before the result is shown, attendees choose which layer they expect to reject each package.

The announced program addresses interoperability at the level of cryptographic modules and hardware. This session works one layer up, where two independent software verifiers read the same bytes and disagree about them; nothing in the announced program yet puts two independent verifiers on one signature and reports where they part company.

Attendees leave with a concrete test matrix for their own hybrid formats: positive cross-implementation verification, one-bit signature controls, key-encoding checks, structural stripping tests, and an explicit rule for when classical-only evidence must stop being accepted. The code, prepared packages, expected results, and continuous-integration workflow are public under Apache-2.0 at https://github.com/tyche-institute/eatf-verifier/releases/tag/v0.6.1 (opens in a new tab) . This is an interoperability report and research reference implementation, not a product or trust service.

As organizations prepare for the transition to post-quantum cryptography, much of the conversation focuses on algorithms, certificates, and PKI infrastructure. Yet the success of any migration ultimately depends on where cryptographic keys are generated, stored, and protected. For billions of enterprise and IoT devices, that foundation is the Trusted Platform Module (TPM).

This session explores the role of TPMs as the hardware root of trust enabling post-quantum migration for device identities and machine credentials. From certificate enrollment and key attestation to secure storage and cryptographic agility, TPMs provide the security foundation that allows PKI ecosystems to evolve without compromising trust.

We will examine the practical challenges PKI teams face when introducing post-quantum algorithms into existing deployments (including the hardware refresh cycle) and describe how TPM capabilities can support the transition while maintaining compatibility with existing enterprise and IoT infrastructures.

Attendees will gain a clearer understanding of how hardware-backed key protection intersects with PQC deployment, why device identity should be part of every migration roadmap, and what steps organizations can take today to prepare for a quantum-resilient future.

NIST has finalized its first working set of post-quantum cryptography standards. The NIST CSWP-39 paper has shifted the enterprise conversation from algorithm selection to cryptographic agility. For application development, PKI, HSM, and machine identity teams, the more challenging issue is no longer which algorithm to choose. Instead, it’s a structural problem: heterogeneous Certificate Authorities, HSMs, certificate lifecycle platforms, and application stacks each independently absorb migration complexity, with no shared abstraction to coordinate the transition.

This session proposes a Common Crypto API: a standardized abstraction layer that separates responsibility across four tiers, ensuring that no single team or vendor owns the entire migration.

• Cryptographers and library maintainers are responsible for the primitive layer, developing, patching, and replacing algorithms and/or libraries without forcing downstream rewrites.
• PKI, HSM, and machine identity teams operationalize transitions through certificate profiles, key protection models, and lifecycle automation.
• Governance boards define and enforce crypto policy centrally, adapting to new threats and regulations without touching every application integration.
• Application developers consume organizations’ approved cryptographic capabilities through a stable interface, insulated from algorithm or entire crypto library updates or changes.

The Common Crypto API will help separate the responsibilities of cryptographic migration and management while simultaneously serving as an interoperability layer connecting all stakeholders to achieve crypto agility.

Attendees will leave with a working model for de-siloing PQC migration responsibility and the opportunity to shape a cross-vendor interoperability blueprint by providing input to extending existing crypto API standards or developing a new one.

The post-quantum transition is widely called "complex," but that word hides what the complexity actually is. PQC migration is both a technical challenge and an organizational one, and it is only when organizations begin cryptographic discovery that the full scope of both becomes visible. Discovery consistently reveals more than teams expect, and what it reveals is far more useful. Grounded in real data from discovery work across many organizations, including large-scale automated discovery, this session shows what discovery actually uncovers: not just the sprawl of keys, certificates, and protocols in use, but the organizational maturity behind them. Consider a pattern we see repeatedly: organizations that worked hard to eliminate SHA-1 from their certificates, while quietly continuing to rely on SHA-1 in SSH. The same weak algorithm, retired where governance was watching and untouched where it was not.

Discovery turns out to be a remarkably honest signal. The state of an organization's crypto policy, the clarity of its roles and responsibilities, and the strength of its day-to-day cryptography management tend to move together, and discovery exposes all of it at once. Attendees will leave able to read their own discovery results not just as a technical inventory, but as an honest measure of how ready they really are. Because cryptographic maturity isn't what you fixed where everyone was looking. It's what you did where no one was.

More than 30 national governments have now published guidance on post-quantum cryptography, ranging from two-page memos to migration handbooks running to hundreds of pages. Sector regulators then translate that guidance for the industries they oversee, and their approaches vary widely: informal supervisory dialogue, procurement requirements, convening and coordination, funded research programs, and formal mandates under financial-sector legislation.

This roundtable brings together government agencies, sector regulators, standards bodies, and the organizations that must implement their guidance for a working discussion rather than a series of presentations. After a short introduction from the moderator, participants will compare approaches across the Americas, Europe, the Middle East and Africa, and Asia-Pacific: what the advantages and disadvantages of each model are, which approaches are working in practice, and where the gaps in global guidance lie.

The discussion will give particular attention to what organizations operating across borders need from governments and regulators to keep their migrations aligned, and to what good practice in PQC guidance looks like.

The main conclusions will feed into a brief recap during the conference's closing session.

In the next few years every enterprise will have to deal with two seismic shifts in digital trust that will redefine all security strategies: the phased reduction of SSL/TLS certificate lifespans to just 47 days by 2029, and the need to adopt quantum-resistant cryptography by 2030. Either mandate on its own is a major challenge. Together they represent an unprecedented technology lift for IT and security teams.

The good news is that the foundational work for each of these initiatives helps the other. Achieving crypto agility starts with certificate agility. Organizations must gain complete visibility and control over their certificate landscape to ensure widespread use of PQC algorithms for data in transit. The coming step-down of maximum TLS server certificate lifespans to monthly renewals over the next three years will necessitate exactly the same thing. Wise enterprises will combine these two initiatives to eliminate redundant technology development and expense, avoid collisions between projects, and ensure overall quality.

This presentation shares original research on enterprise readiness for these trends and describes the opportunity for enterprises to improve the outcomes of both initiatives by working on them together. Attendees will learn how a unified, automated approach to certificate automation and management can eliminate redundant efforts, reduce risk, and build agility for both mandates.

The convergence of post-quantum cryptography, sovereign technology strategies, advanced AI, and accelerating computing power is forcing companies and countries to rethink how trust infrastructure is built and governed, with an evolved PKI at the core. Encryption, identity, communications, and computing are all being reinvented and PKI is as well.

By architecting a Sovereign Quantum Stack that leverages PKI and vertically integrates an architecture of trust that spans silicon, enterprise systems, global communications, and space-based infrastructure we can define the security and stability of the next generation of quantum infrastructure, while future proofing industries and economies.

This talk walks through a national plan to architect a sovereign quantum stack, and highlights the intersection of today's PKI and the requirements for tomorrows', by highlighting four of the most critical architectural layers:

1. Silicon Trust Layer Every secure system begins with hardware, from this anchor point, higher-level security guarantees such as secure boot, encrypted communications, and firmware validation can be established. Hardware roots of trust generate cryptographic keys, store them securely, and perform sensitive cryptographic operations inside protected environments. Hardware can also establish secure device identity for devices, firmware, and components as they move through global manufacturing ecosystems.

2. Identity and Certificate Layer Above the silicon layer sits the infrastructure that transforms hardware trust into operational trust. This layer includes public key infrastructure (PKI), certificate authorities, and identity frameworks. These systems extend trust established in hardware across enterprise systems, cloud platforms, and global communications networks. In the quantum era, this layer must support cryptographic and enterprise agility to transition between cryptographic algorithms at pace.

3. Enterprise Infrastructure Layer The third layer of the Sovereign Quantum Stack is where trust becomes operational inside real organizations, as enterprises deploy encryption across applications, cloud environments, operational technology, and connected devices. Linking the encryption that appears in operating systems, software libraries, network protocols, cloud services, and connected devices starts with certificates and keys often distributed across thousands of systems. Hybrid deployments combining classical and post-quantum cryptography will likely persist for years, making this adaptable enterprise layer essential.

4. Orbital Infrastructure Layer The final layer of the Sovereign Quantum Stack extends beyond the Earth’s surface, as satellite systems are becoming a critical part of global infrastructure. They provide communications, PNT,, and encryption and data services across oceans, deserts, and remote regions. Orbital infrastructure also provides resilience as terrestrial infrastructure can be disrupted through physical damage, network interference, or geopolitical pressure. As quantum technologies mature, space will become a critical platform for establishing and distributing cryptographic keys, verifying identities, and supporting the global architecture of quantum infrastructure.

PKI evolution, extension, and integration will be critical to global success of the future of encryption at scale-- and sovereign quantum stacks are this future.

In discussions around the PQC transition, the technical migration challenge often receives the most attention. In practice, however, organizations face significant barriers before any cryptographic transition can begin: establishing governance, securing funding, aligning stakeholders, and setting up effective program management structures.

This talk builds on a whitepaper currently being developed through hands-on experience from members of two Belgian communities, Quantum Circle and the Belgian Cybersecurity Coalition. It provides practical guidance for the early stages of PQC adoption, focusing on why these initial steps are complex, how organizations can structure the necessary PQC migration engine, and how to justify the scale and urgency of such a transformation. In addition, the talk challenges commonly repeated advice on initial migration preparation and prioritization, offering a more pragmatic alternative approach.

It is time organisations stopped making the mistake of assuming they need to hire a PQC expert. The real challenge has nothing to do with solving cryptography or researching new algorithms. PQC is not a cryptographic research problem anymore. It is a PKI, enterprise and operations problem.

Let's be blunt: hiring PQC experts without fixing PKI operations is like hiring quantum physicists to fix a broken plumbing system. The mathematics is not the problem, the infrastructure is. Most organisations still struggle with the basics: expired certificates, unknown trust relationships, weak crypto visibility, manual certificate processes and poor lifecycle governance.

This session challenges the growing narrative that organisations need dedicated PQC specialists before they can begin preparing for the quantum era. Instead, it argues that PQC migration is fundamentally a PKI operational challenge. Replacing cryptographic algorithms is only one part of the problem; the real challenge is operationalising cryptography at enterprise scale across complex environments, legacy systems, hybrid infrastructures, certificate lifecycles, trust chains and governance models.

This is where the real insight emerges. The people who can actually solve this are not those who understand the deepest mathematics of PQC, but those who understand how trust is built, managed, and sustained across an enterprise. PKI experts (the teams already responsible for certificates, key lifecycles, and trust infrastructure) are the ones who must be empowered.

PQC is not about inventing cryptography anymore. It is about surviving its transformation. The organisations that succeed in the PQC transition will not be the ones with the most theoretical quantum knowledge. They will be the ones with mature PKI foundations, automated certificate management, strong governance and operational discipline. Provocative by design, this talk reframes PQC migration from a research problem into a real-world enterprise execution challenge, and explains why fixing PKI maturity today is the most important step toward becoming quantum ready tomorrow.

This panel explores the differences in the requirements on cryptographic inventory, and how they impact remediation efforts and migration priorities across industry verticals. Chaired by an expert in cryptographic posture management, the panel brings together representatives from finance, telecoms, energy, healthcare and transportation to determine what each sector actually needs.

The panel explores whether a universal inventory model is realistic across such fundamentally different environments, or whether sector-specific approaches to PQC discovery, cryptography information exchange and prioritisation will ultimately emerge. It covers the challenges of on-boarding external inventory tools, mapping cryptographic dependencies, and how to evaluate different tools against the individual needs of each industry.

The topic becomes particularly interesting cross-sector because financial institutions may have mature PKI governance and strong visibility into certificates and identity infrastructure yet still struggle to map cryptographic dependencies within internally developed applications and third-party SaaS ecosystems; OT-heavy sectors such as energy, manufacturing, and transportation may know their physical assets in extraordinary detail while lacking visibility into embedded cryptography within industrial control systems, field devices, firmware, and operational protocols; and telecoms providers face challenges associated with highly distributed network infrastructure, vendor equipment, and complex trust relationships across operational environments.

Stateful hash-based signatures such as LMS are standardised and well understood, but translating them into deployable products involves challenges that are often absent from standards and academic literature.

This talk discusses the practical realities of deploying a stateful hash-based scheme in long-lived hardware-rooted systems. Drawing on experience securing firmware update mechanisms in commercial PCs and printers, it explores how standards guidance, hardware lifecycles, resilience requirements, certification considerations and business constraints influenced key design decisions.

It covers lessons from adopting the LMS standard into security features deployed at scale, including the challenges of balancing security, resilience, certification and operational requirements, and reflects on how later developments in standards, certification programmes and industry guidance reinforced, challenged or reshaped those decisions, and what this means for future quantum-resistant migrations.

Every organization knows cryptography will need to change. New standards arrive, old algorithms age out, compliance requirements shift, and vulnerabilities force urgent decisions. Most systems still make those changes painfully expensive by embedding cryptographic choices deep inside applications and infrastructure.

This talk argues that cryptographic agility is largely a systems design problem. We begin with a component-based assessment framework for evaluating how today’s cryptographic APIs support or hinder agility, and use it to examine widely deployed systems such as OpenSSL, JCA, Tink, AWS KMS, and Vault Transit. The result is a clear diagnosis of why migrations remain slow, expensive, and deeply tied to application code.

We then show what it takes to fix the problem: an abstract cryptographic API built around intent-based operations, policy-driven algorithm selection, explicit key transformation, identity-based governance, and pluggable crypto backends. The payoff is a shift from cryptographic change as a distributed rewrite to cryptographic change as a managed control-plane decision.

Attendees will leave with a practical way to assess their current cryptographic stack, a clearer picture of the architectural gaps blocking cryptographic upgrades, and a concrete API model for building systems that can evolve without breaking applications.

Current post-quantum planning is dominated by one clock, harvest-now-decrypt-later (HNDL), but for signature infrastructure the binding exposure is trust-now-forge-later (TNFL). Once a cryptographically relevant quantum computer arrives, long-validity signing anchors become forgeable, leading to loss of trust. Using the global passport and national identity infrastructure as an empirical model for TNFL exposure analysis and remediation prioritisation, this session shows in a live demonstration exactly how trust could collapse if urgent, globally coordinated action is not put in place.

The dataset is the ICAO Master List: the self-signed country signing certificate authority (CSCA) roots that anchor verification of ICAO 9303 compliant machine-readable travel documents (MRTDs) worldwide, published as a Cryptographic Message Syntax (CMS) structure and cross-checkable against the German Federal Office for Information Security (BSI) list. Both are public and neither requires Public Key Directory (PKD) participation at the CSCA layer.

The demonstration walks through the pipeline end to end, using open tooling only so that anyone can reproduce it: hash and record provenance of the source file; unwrap the CMS encapsulated content and split the CscaMasterList into per-certificate DER with a standard-library walker; extract algorithm, key size and validity fields; then derive three outputs: installed base by algorithm and key-strength band, the share of anchors whose notAfter extends past a set of CRQC scenario years, and a fingerprint-level reconciliation between the two source lists. Every figure regenerates from the script; none is asserted by hand. Findings are reported in aggregate, without singling out individual issuers.

The reusable corollary for your own cryptographic estate is to treat the certificate as the asset-register entry, treat its notAfter field as a stated useful life, and then ask which anchors you are relying on past the point their signatures can be forged. The confidentiality wave of quantum cryptographic exposure, which dominates current attention, concentrates at scannable perimeters. The integrity wave, in contrast, is distributed across every component carrying a verifiable signature, so it surfaces only through inventory, not perimeter scanning.

Attendees leave with a runnable method and an understanding of how to apply this to their own PKI estates.

Post-quantum cryptography (PQC) adoption is mandated for critical EU infrastructure by 2030, yet integration into existing identity document ecosystems presents significant cryptographic and performance constraints. National ID cards with 10-year validity require quantum-resistant protection from issuance, necessitating a pragmatic transition strategy that balances algorithmic security guarantees with hardware resource limitations.

This talk points out high-risk spots in the ID card ecosystem and the key requirements for its operation. Subsequently an approach for a step-by-step PQC migration is presented, including possible scenarios for the underlying Public Key Infrastructure. The solutions employ different NIST-standardized PQC algorithms alongside traditional cryptography using hybrid schemes.

The feasibility of this approach is demonstrated by the realization of a functional demonstrator implementing hybrid cryptographic schemes on a resource-constrained, ISO 7816-compliant smart card, addressing the critical challenges of signature generation and verification time and memory footprint during authentication operations. Finally, the results of the demonstrator are presented along with the identified challenges ahead.

Last year, we examined how hardware security modules can provide cryptographic attestation, i.e., a signed snapshot of the state of an HSM and/or of its keys. Trust in cryptographic infrastructure, however, often requires more than a snapshot; it requires proof of history. This presentation introduces cryptographically verifiable audit logs for hardware security modules, a mechanism that produces a tamper-evident, independently verifiable record of every operation performed on a cryptographic object over its lifetime. Where attestation tells you what a key looks like today, an audit log tells you everything that was done to it and when. Key ceremonies require a verifiable sequence of authorized operations that no snapshot can reconstruct; key migration requires a temporary export, so the destination device's attestation cannot prove the process was correct, but the combined audit logs of both devices can. The cryptographic architecture behind this relies on event chaining and attested log state, with tooling that runs entirely outside the HSM so that an auditor can verify the record without device access. For long-term validity, all of this must rest on quantum-safe roots of trust provisioned at manufacturing time.

In this work we analyse the qualitative memory and bandwidth efficiency properties of the currently standardised post-quantum signatures as such, and of their protocol integrations mainly in the X.509 context. The term qualitative in this respect refers to how memory and bandwidth requirements scale with the size of the signed message.

Specifically, we address the question of how far the algorithms support online computations, also known as streaming, with respect to the signed message in the signing and verification operations. Further, we review the possibilities for the pre-computation of a short message representative outside the cryptographic module responsible for the signing or verification operation of the different signature schemes. We also give a preview of the corresponding cryptographic API of the PKCS#11 standard, which introduces numerous PQC signature algorithms in the upcoming version 3.2.

We demonstrate that for specific realistic use cases, the qualitative memory and bandwidth efficiency of the PQC signature schemes in protocol use varies widely and tends to be substantially degraded compared to the traditional signature schemes based on RSA and elliptic curves, which always allow for the pre-computation of a short message representative in the form of a hash value. Our results are relevant to PQC migrations of existing applications using traditional RSA or elliptic curve schemes.

Most organisations approaching post-quantum migration share the same blind spot: they have a roadmap, but no honest way to measure where their PKI actually stands. This session introduces two published outputs of the PKI Consortium's PKIMM Working Group: the PKI Maturity Model Extension Framework, and the PQC Readiness Extension for PKI built on top of it.

The PKI Maturity Model already helps organisations benchmark their PKI programmes against an industry reference structured around four modules and fifteen capability categories. The Extension Framework defines a standardised way to overlay targeted, fast-moving maturity criteria (PQC, automation, cryptographic agility) onto the existing categories, with consistent scoring, weighting, and reporting rules. The PQC Readiness Extension, authored by Kennedy Nwup, is the first published extension, giving PKI owners a defensible answer to questions their CISOs, regulators and auditors are starting to ask.

In this joint session, Roman Cinkais (Chair, PKIMM WG) and Kennedy Nwup (Vice Chair, PKIMM WG, and author of the extension) walk through the design of the Extension Framework, present the PQC Readiness Extension in detail, show how it is intended to be used in practice, and reflect on turning a working group draft into a published, community-endorsed specification.

Attendees will leave with a published framework and a PQC Readiness Extension they can apply to their PKI programme straight away.

PKIs operate on the assumption that trusted credentials remain unforgeable over their lifetime. Advances in quantum computing challenge this premise: credentials trusted today may become forgeable in the future, introducing a "trust now, forge later" risk that directly impacts the integrity of digital identities and trust anchors.

For PKI-dependent ecosystems, migration is not just a cryptographic upgrade problem. Long-lived certificates, complex trust hierarchies, and cross-sector dependencies mean that failures can propagate systemically, affecting entire digital trust ecosystems. Yet progress toward quantum-safe PKI remains fragmented, slowed by uncertainty around standards, timelines, and ownership. The HAPKIDO societal impact assessment shows that compromised PKIs could trigger cascading failures across sectors, from disruption of public services to economic instability in banking systems.

This talk presents the HAPKIDO Handbook, which provides a consolidated, research-based framework to guide organisations and policymakers through the transition to quantum-safe PKI. It combines technical insights, governance perspectives, and societal risk analysis into a unified approach, with two main goals: raising awareness and providing actionable insights to support decision-making.

The handbook presents two key contributions: a societal risk assessment method that translates abstract quantum threats into concrete organisational and societal risks, enabling prioritisation of critical assets and services; and a five-stage growth model guiding organisations from awareness to full ecosystem adaptation, emphasising the need for coordinated action across organisational and sectoral levels. Together, these frameworks position the transition not as a technical upgrade, but as a multi-actor transformation requiring alignment across ecosystems.

The handbook highlights that early action is possible and necessary, including cryptographic inventory and adoption of cryptographic agility practices, as well as jointly testing hybrid solutions. Success depends on coordinated efforts across organisations and policymakers acting within a specific sector to avoid fragmentation and ensure interoperability. Stakeholders should begin risk-based assessment, invest in early experimentation, and actively participate in sector-specific collaboration and standardisation efforts.