BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//PKI Consortium//Conference Agenda//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Post-Quantum Cryptography Conference
X-WR-TIMEZONE:Europe/Amsterdam
BEGIN:VEVENT
UID:agenda-a8d54724-afcd-4c8d-a5af-7fad1cae1e87@ics.pkic.org
SEQUENCE:0
DTSTAMP:20261023T000842Z
DTSTART:20261201T130000Z
DTEND:20261201T132500Z
STATUS:CONFIRMED
SUMMARY:What Breaks Between Assessment and Implementation: Lessons from PQC
  Migration Programs Across Organizations
DESCRIPTION:Most PQC migration advice stops at the roadmap. This session pi
 cks up where the roadmap meets production\, drawing on assessment and migra
 tion work across many organizations in different sectors and at different l
 evels of maturity. The recurring lesson is that the same failure points sho
 w up again and again\, and that the gap is between a clean assessment\, a p
 ractical roadmap\, and successful implementation.\n\nThe talk follows the r
 eal arc of a program. It starts with discovery and assessment\, including w
 hat cryptographic inventory consistently misses: statically linked librarie
 s\, keys embedded in firmware\, proprietary protocols on operational networ
 ks\, and cryptography buried inside third-party appliances. It then moves t
 o the migration attempt and the things that broke in production. Hybrid and
  composite certificates issued into mutual TLS meshes triggered chain valid
 ation errors in older OpenSSL and JSSE clients. Handshake sizes grew large 
 enough to fail through middleboxes and load balancers. Hardware security mo
 dule gaps for composite key generation surfaced only under load. The sessio
 n walks through the rollback decision and the redesign that held\, which wa
 s a parallel PQC hierarchy rather than swapping roots in place.\n\nThe seco
 nd half connects engineering reality to assurance reality\, because the sam
 e programs hit a second wall: producing evidence auditors accept. It maps w
 hat examiners actually request against NIS2\, DORA\, and the CRA\, includin
 g CBOMs as Article 21 documentation\, certificate lifecycle reports for ICT
  risk testing\, module attestations\, and the supplier readiness evidence c
 hain. The practical takeaway is to structure discovery and inventory output
  so it doubles as audit evidence from day one\, rather than rebuilding it u
 nder deadline.\n\nAttendees will leave with the failure modes that recur re
 gardless of sector\, a clear signal for when to abandon in-place hybrid roo
 ts\, and a sequence that links assessment\, migration\, and assurance so th
 e three are not rebuilt separately. The content is experience-led and vendo
 r-neutral\, framed entirely around what was observed in the field.\n\n\nSpe
 akers: Parnashree Saha
LOCATION:Red hall
CATEGORIES:Red hall
URL:https://pkic.org/events/2026/pqc-conference-amsterdam-nl/agenda/
END:VEVENT
END:VCALENDAR