C509 PKI: A Lightweight PKI for Modern and Post-Quantum Applications
· 14:30 – 15:00 Amsterdam time · Room C (8)
C509 is a lightweight approach to Public Key Infrastructure (PKI) that brings the established X.509 PKI model to constrained devices and modern applications. Rather than focusing primarily on reducing certificate / CRL / OCSP size, C509 simplifies the certificate structure and avoids much of the complexity traditionally associated with ASN.1-based X.509 implementations. This can reduce code complexity, lower memory consumption, and reduce the attack surface of PKI implementations.
This session presents the ongoing IETF work on C509 as a complete PKI ecosystem, covering certificates and certification requests, algorithm definitions, revocation, and integration with EST for certificate enrollment and lifecycle operations.
The session will also discuss the evolution of C509 for post-quantum cryptography, including the integration of PQC algorithms and the resulting considerations for certificate structures, algorithm identifiers, signatures, and interoperability.
Based on ongoing standardization and implementation experience, the presentation will share design considerations and lessons learned from simplifying PKI data structures and protocols. It will conclude with remaining challenges and opportunities for deploying C509 as a lightweight, interoperable, and crypto-agile PKI for IoT, connected devices, and other modern applications.
Speakers
- Security Solution Architect · NIO
Dr. Lijun Liao is a PKI and cybersecurity expert with a PhD from Ruhr University Bochum. He is currently Chief PKI Architect at NIO, having previously held a similar role at Huawei, where he worked on the design and implementation of large-scale public-key infrastructure and security systems. He is the creator and owner of XIPKI, an open-source PKI software project, and an active contributor to the IETF, where his work focuses on C509 PKI, a compact and efficient certificate format designed to address the needs of modern and resource-constrained applications, including emerging post-quantum use cases.
Attendance
Open session · first come, first served
Saving interest does not reserve a seat. Admission remains first come, first served.
Save favorite
