BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//PKI Consortium//Conference Agenda//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Post-Quantum Cryptography Conference
X-WR-TIMEZONE:Europe/Amsterdam
BEGIN:VEVENT
UID:agenda-c67b6192-5c12-4782-b625-fa9a799702da@ics.pkic.org
SEQUENCE:1
DTSTAMP:20261028T163318Z
DTSTART:20261202T084000Z
DTEND:20261202T091500Z
STATUS:CONFIRMED
SUMMARY:PQC-ready is not PQC-verified: ML-DSA downgrade and interoperabilit
 y failures across two independent software verifiers
DESCRIPTION:Standardization is not the end of assurance. An algorithm can b
 e standardized\, shipped\, and still have to be replaced or re-verified on 
 short notice\, and a hybrid signature can pass its own unit tests and still
  fail the first independent implementation that receives it. We encountered
  the second problem while adding ML-DSA-65 to a public offline evidence for
 mat: a development signer and verifier using the same JavaScript library ag
 reed with each other\, while an independent Python FIPS 204 implementation 
 rejected the signature. That failure changed both our dependency baseline a
 nd our working definition of "PQC-ready."\n\nThis deep dive presents the re
 sulting reproducible artifact: a signer that covers the same canonical byte
 s with RSA-4096 and ML-DSA-65\, an RFC 9881 SubjectPublicKeyInfo\, and inde
 pendent TypeScript and Python verification paths. The shared public corpus 
 now contains thirteen conformance packages: five accepted packages and eigh
 t deliberate rejection controls. A separate six-package downgrade lab is re
 played under two relying-party policies by both implementations\, producing
  twenty-four verifier-policy observations with no verdict or first-failure-
 code mismatch.\n\nThe session concentrates on three implementation boundari
 es.\n\n1. Self-interoperability is not cross-implementation evidence. We sh
 ow the cross-implementation probe that exposed the dependency-version failu
 re and explain why a positive FIPS 204 vector belongs in continuous integra
 tion.\n2. ML-DSA key bytes are not yet a deployable certificate interface. 
 We encode id-ml-dsa-65 according to RFC 9881\, require absent AlgorithmIden
 tifier parameters\, and retain the earlier raw-key convention only for read
  compatibility.\n3. Downgrade resistance has two layers. Removing the PQC e
 ntries from a hybrid package is rejected because a signed witness still nam
 es them. A legitimately created classical-only transition package\, however
 \, remains acceptable unless the relying party selects an explicit require-
 pqc policy. Before the result is shown\, attendees choose which layer they 
 expect to reject each package.\n\nThe announced program addresses interoper
 ability at the level of cryptographic modules and hardware. This session wo
 rks one layer up\, where two independent software verifiers read the same b
 ytes and disagree about them\; nothing in the announced program yet puts tw
 o independent verifiers on one signature and reports where they part compan
 y.\n\nAttendees leave with a concrete test matrix for their own hybrid form
 ats: positive cross-implementation verification\, one-bit signature control
 s\, key-encoding checks\, structural stripping tests\, and an explicit rule
  for when classical-only evidence must stop being accepted. The code\, prep
 ared packages\, expected results\, and continuous-integration workflow are 
 public under Apache-2.0 at https://github.com/tyche-institute/eatf-verifier
 /releases/tag/v0.6.1 . This is an interoperability report and research refe
 rence implementation\, not a product or trust service.\n\nSpeakers: Anton S
 okolov
LOCATION:Blue hall
CATEGORIES:Blue hall
URL:https://pkic.org/events/2026/pqc-conference-amsterdam-nl/agenda/
END:VEVENT
END:VCALENDAR