BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//PKI Consortium//Conference Agenda//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Post-Quantum Cryptography Conference
X-WR-TIMEZONE:Europe/Amsterdam
BEGIN:VEVENT
UID:agenda-9062ed6b-3fd7-443b-b418-afb435f0cc23@ics.pkic.org
SEQUENCE:1
DTSTAMP:20261025T183315Z
DTSTART:20261203T130000Z
DTEND:20261203T132500Z
STATUS:CONFIRMED
SUMMARY:Trust Me\, I'm Random: Zero Trust Entropy for PQC
DESCRIPTION:Every key your cloud HSM or KMS generates relies on one assumpt
 ion nobody in your SOC can verify: that the RNG feeding it is actually rand
 om. That assumption has failed before\, in certified hardware\, silently\, 
 for years. Taiwan's national ID smartcards were FIPS 140-2 Level 2 and Comm
 on Criteria certified and still shipped factorable RSA keys\, found by outs
 ide researchers factoring the public keys\, not by the devices and not by t
 he auditors. Debian's OpenSSL entropy bug ran undetected for nearly two yea
 rs. Someone edited a constant in Juniper's ScreenOS ‘Dual_EC’ parameter
 s and nothing alerted. Post-quantum migration sharpens this: an ML-KEM or M
 L-DSA private key is exactly as strong as the seed behind it\, and we are r
 e-keying the internet on top of black-box entropy right now.\n\nStatistical
  testing cannot save you. A generator whose output an adversary chose in ad
 vance passes every SP 800-90B health test and every Dieharder suite\, by co
 nstruction. Certification is a point-in-time snapshot of a device that then
  runs unobserved in someone else's datacenter for five years. You have no t
 elemetry\, no detection\, and no forensic trail on the most foundational co
 mponent in your cryptographic stack.\n\nWe have solved this shape of proble
 m before\, just never here. Reproducible builds and SLSA replaced ‘trust 
 the build server’ with evidence. Certificate Transparency accepted that m
 isissuance cannot be prevented and made it publicly detectable and replayab
 le instead. Remote attestation did it for workloads. Each was the same move
 : stop asking operators to be trustworthy\, start requiring them to emit ar
 tifacts anyone can check. Entropy is the last link in the chain still runni
 ng on trust-by-assumption\, and it is the link everything else is built on.
 \n\nThis talk is about what that move looks like for randomness. I present 
 FQR-CSS\, from my peer-reviewed paper in Discover Computing (DOI: 10.1007/s
 10791-026-09994-y)\, staying strictly on the part implementable today. The 
 generator is made to prove its own health. Each QRNG node precommits to a s
 eed before the session\, then publishes a post-quantum zk-STARK over its cl
 assical measurement log asserting that the log satisfies a stated physical 
 predicate: a CHSH score above threshold\, a photon-number distribution pass
 ing chi-square\, measurement bases derived from the pre-committed seed. The
  raw log never leaves the device. An aggregation layer verifies every proof
  and runs BFT consensus\, so only attested contributions reach the mixer. T
 he client receives randomness plus a Merkle-rooted integrity token it verif
 ies itself and an auditor can replay months later against a transparency lo
 g.\n\nNo new quantum hardware is required: the proofs are over classical lo
 gs that commercial QRNGs already emit\, using standard post-quantum ZKPs. I
  walk through reproducible zk-STARK benchmarks and a full latency budget: r
 oughly 396 ms end-to-end for a conservative CHSH attestation over WAN with 
 HotStuff consensus\, of which client verification is sub-millisecond. That 
 fits inside high-assurance key generation and disappears behind a pre-verif
 ied randomness buffer. The scope is deliberate and I will state it plainly:
  this is a cryptographic architecture with benchmarked primitives\, not a h
 ardware product. It attests entropy provenance at generation time\, not tha
 t a key was never exfiltrated afterwards.\n\nKey Takeaways:\n1. Why RNG com
 promise is undetectable in today's cloud HSM/KMS deployments\, and why outp
 ut-side statistical testing structurally cannot catch a chosen-output gener
 ator.\n2. Why the random number generator is the last implicitly trusted co
 mponent in a stack where zero trust has already been applied to networks\, 
 identities\, workloads and machines\, and what ``verify explicitly\, assume
  breach'' means when the subject is a physical entropy source rather than a
  user or a workload.\n3. What to do before any of this ships: entropy prove
 nance in key metadata\, multi-source mixing so no single vendor dominates\,
  transparency-logged precommits\, and fail-closed attestation policy for CA
  and HSM key generation.\n\nSpeakers: Menyhért Pálinkó
LOCATION:Room D (9)
CATEGORIES:Room D (9)
URL:https://pkic.org/events/2026/pqc-conference-amsterdam-nl/agenda/
END:VEVENT
END:VCALENDAR