BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//PKI Consortium//Conference Agenda//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:Post-Quantum Cryptography Conference
X-WR-TIMEZONE:Europe/Amsterdam
BEGIN:VEVENT
UID:agenda-e7212627-e45d-44ff-a5fa-29a95fd9eb8a@ics.pkic.org
SEQUENCE:1
DTSTAMP:20261025T183315Z
DTSTART:20261201T130000Z
DTEND:20261201T132500Z
STATUS:CONFIRMED
SUMMARY:The Other End of the Handshake: Cryptographic Dependency Mapping fo
 r PQC Migration
DESCRIPTION:Two years into the post-quantum readiness era\, aligning on the
  algorithms is the easy part - NIST has standardized them. The hard part\, 
 that quietly derails migration programs\, is the wiring: knowing what crypt
 ography you run\, where it lives\, and\, critically\, what is connected to 
 what and more importantly what communicates with what.\nThis session makes 
 the case that PQC remediation is fundamentally a dependency problem\, not s
 imply discovery and visibility. A weak protocol or a quantum-vulnerable key
  almost never affects only a single endpoint\; it affects the relationship 
 between 2 entities. Disable TLS 1.1 on one side of a handshake while the pe
 er can only speak the old protocol\, and you don't harden the channel\, ins
 tead you break it\, often a production-critical one. Fix the wrong end firs
 t and you simply relocate the weakness. Remediation must be enforced on bot
 h ends of every cryptographic relationship\, at the same time.\nDrawing on 
 real enterprise migration experience - including the realities of large fin
 ancial-sector estates\, this session will walk through a dependency-first m
 ethod any organization can start with as a foundation. We start with a simp
 le example: a single scanner finding of TLS 1.1 on a payments endpoint\, an
 d how mapping it’s peer communication set\, turns the remediation ticket 
 into much more than just remediating a single endpoint. We will look at how
  organizations can lay the foundation to building and maintaining a cryptog
 raphic dependency graph from layered telemetry.\nWe go deep on the hardest 
 dependency tree of all: certificate hierarchies and machine identities. A q
 uantum-vulnerable root doesn't invalidate a service\; it invalidates a trus
 t fabric. PKI and the exploding population of non-human identities must be 
 mapped first and then migrated\, a Cryptographic Bill of Materials (CBOM)\,
  which is dependency-aware by design\, becomes a living source of truth rat
 her than a one-time inventory.\nWe aim to have attendees leave with a concr
 ete\, vendor-neutral playbook: how to assemble the dependency graph\, how t
 o compute remediation clusters and surface blockers before a change window\
 , how to sequence coordinated "add-then-remove" cutovers\, and how to prior
 itize by secrecy lifetime based on the harvest-now-decrypt-later attack vec
 tor.\n\nSpeakers: Revathi Chandrasekaran\, Rohan Ramesh
LOCATION:Room D (9)
CATEGORIES:Room D (9)
URL:https://pkic.org/events/2026/pqc-conference-amsterdam-nl/agenda/
END:VEVENT
END:VCALENDAR