BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//PKI Consortium//Conference Agenda//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Post-Quantum Cryptography Conference
X-WR-TIMEZONE:Europe/Amsterdam
BEGIN:VEVENT
UID:agenda-98f51fb9-d947-41a3-9991-49519145a4fd@ics.pkic.org
SEQUENCE:1
DTSTAMP:20261025T183315Z
DTSTART:20261202T133000Z
DTEND:20261202T140000Z
STATUS:CONFIRMED
SUMMARY:Email Reborn: Post-Quantum encryption over the mailbox you already 
 have
DESCRIPTION:End-to-end encrypted email has existed for thirty years and is 
 barely used. PGP puts key management on the user\; S/MIME puts a CA and an 
 enrolment process on the organisation and still stops at its border\; the m
 odern alternatives require both parties to move to the same provider. Subst
 ituting ML-KEM for RSA in any of those changes the algorithm and not the de
 ployment. At the same time\, mail is the workload where harvest-now-decrypt
 -later is least hypothetical: it is archived for years by both parties and 
 by everything in between.\n\nThis talk covers the engineering of Eon Phoeni
 x Mail\, a client that encrypts over an existing mailbox — IMAP/SMTP\, in
 cluding hosted consumer and enterprise providers — with no new address an
 d no server-side change\, and what that constraint forced. It is free softw
 are under AGPL-3.0: clients\, message envelope and directory server are all
  in the open\, and the cryptographic claims in this talk can be read back i
 n the source.\n\nCryptographic construction. A hybrid envelope: ML-KEM-1024
  with X25519 for key establishment\, ML-DSA-87 with Ed25519 verified under 
 logical AND for authenticity\, AES-256-GCM for content. The KEK derives fro
 m HKDF-SHA256 over both shared secrets plus the KEM ciphertext and ephemera
 l public key\, with domain separation per use\; sign-then-encrypt\, one con
 tent key wrapped per recipient\, so multi-recipient and group conversations
  fall out of the same structure.\n\nImplementation decisions. Two independe
 nt implementations of the same wire format — one on OpenSSL 3.5\, one pur
 e-Go — with byte-identical key encodings and a cross-implementation inter
 op test\, because the FIPS story and the cgo-free mobile and Windows builds
  pull in opposite directions. FIPS 203/204 known-answer vectors run in CI. 
 One build-tag collision with the Go standard library silently disabled AES 
 hardware acceleration: 115 MB/s against 1976 MB/s\, with every test still g
 reen.\n\nDesign decisions worth arguing about. Protection is chosen per mes
 sage rather than per product\, across five levels from ordinary mail to a r
 ead requiring a second party's cooperation\, with self-erase and metadata s
 uppression as separate stackable switches from a single registry both user 
 interfaces derive from. Recipients without the client get ordinary mail ins
 tead of a blocked send. Metadata is treated as its own axis\, with an expli
 cit list of what the design does not hide: the domain pair\, the gateways t
 hemselves\, and traffic volume.\n\nFailures\, in detail\, because they are 
 the transferable part: SRV-based key discovery that resolved on every deskt
 op and never on mobile\; key rotation that destroyed previously received ma
 il\; an in-band key header large enough to push short messages into spam cl
 assification\; and a directory lookup that queried the sender's domain inst
 ead of the recipient's.\n\nAudience: implementers migrating a deployed prot
 ocol to post-quantum primitives\, where key distribution\, graceful degrada
 tion and metadata are harder than the KEM. Everything shown is running code
  under an open licence\, so any part of it can be taken and reused.\n\nSpea
 kers: Dimitri van Esch
LOCATION:Room E (10)
CATEGORIES:Room E (10)
URL:https://pkic.org/events/2026/pqc-conference-amsterdam-nl/agenda/
END:VEVENT
END:VCALENDAR