BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//PKI Consortium//Conference Agenda//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Post-Quantum Cryptography Conference
X-WR-TIMEZONE:Europe/Amsterdam
BEGIN:VEVENT
UID:agenda-a70d76ed-02c2-4bd0-8d4b-11c6d935b09b@ics.pkic.org
SEQUENCE:0
DTSTAMP:20261023T000842Z
DTSTART:20261201T104500Z
DTEND:20261201T113000Z
STATUS:CONFIRMED
SUMMARY:Where the PQC Migration Actually Stands: A Cross-Ecosystem Census o
 f 2.8 Million Packages
DESCRIPTION:The NIST 2030 deprecation deadline for quantum-vulnerable publi
 c-key algorithms is 1\,386 days away as of March 2026. Every PKI operator\,
  certificate authority\, and security team needs to know how the software s
 upply chain they depend on is responding. No cross-ecosystem measurement ex
 isted. We built one. This session presents findings from the first cross-ec
 osystem cryptographic census\, scanning 2\,809\,479 packages across 11 pack
 age ecosystems including npm\, PyPI\, Go\, Maven\, crates.io\, NuGet\, and 
 others. The results reveal the actual state of PQC adoption in the open-sou
 rce supply chain that PKI infrastructure depends on. Of the 2.8 million pac
 kages scanned\, 108\,145 use cryptographic libraries. Among those\, 21\,332
  depend on weak or deprecated algorithms such as MD5\, SHA-1\, DES\, and RC
 4. Only 188 packages\, or 0.17 percent of crypto-using packages\, have any 
 post-quantum cryptography dependency. PQC adoption is concentrated in 5 of 
 11 ecosystems\, with crates.io accounting for 58 percent of all PQC-depende
 nt packages. Six ecosystems show zero PQC adoption. Maven has the worst wea
 k crypto rate at 51.6 percent.\n\nBeyond the headline numbers\, the talk ad
 dresses the migration gap that matters most for PKI operators. Dependency-l
 evel scanning\, the foundation of most software composition analysis tools\
 , misses approximately 4 times the cryptographic surface area visible to so
 urce-level analysis. We validated this gap on 20 production projects and fo
 und that 30 percent of projects with active cryptographic code show zero de
 pendency-level signal. For PKI operators conducting cryptographic inventori
 es under NIST IR 8547 or OMB M-23-02\, this means current tooling systemati
 cally undercounts exposure.\n\nAttendees leave with three actionable outcom
 es: the current state of PQC adoption in their language ecosystem with name
 d libraries and migration paths\; a reproducible census methodology they ca
 n apply to internal package registries and vendor assessments\; and a clear
  understanding of why dependency scanning alone fails for cryptographic inv
 entory and what to do about it.\n\nAll scanning tools\, the 357-library cla
 ssification catalog\, the full scan dataset\, and a live dashboard are rele
 ased open source.\n\n\nSpeakers: Abdel Fane
LOCATION:Blue hall
CATEGORIES:Blue hall
URL:https://pkic.org/events/2026/pqc-conference-amsterdam-nl/agenda/
END:VEVENT
END:VCALENDAR