Making ML-DSA Work for Machine-to-Machine mTLS: Field Notes from an End-to-End Post-Quantum PKI
· 15:30 – 16:15 Amsterdam time · Blue hall
Most post-quantum migration programs have done the easy part - hybrid key exchange - and then hit a wall at authentication. Getting ML-DSA certificates working for real machine-to-machine identity, with a PKI that can issue, renew, and revoke them, is where timelines slip: the certificates are large, lifecycle tooling is immature, and almost no one has run mutual TLS where both sides authenticate with post-quantum credentials.
This is a practitioner field report from an organization that has built and now operates exactly that - an end-to-end post-quantum machine-identity stack: an ML-DSA-65 CA hierarchy, post-quantum-only mutual TLS enforced at the edge, automated enrollment and short-lived issuance, and OCSP/CRL revocation that takes effect in real time. We share what it actually took, so teams planning the authentication phase of their own migration know what they are walking into.
Attendees leave with: a realistic picture of the authentication half of PQC migration - what is production-ready today and what is still blocked on standards (IETF LAMPS composite certificates, post-quantum identity tokens); where ML-DSA certificate and signature sizes actually cause problems - handshake payloads, buffers, issuance throughput - measured against classical TLS 1.3; how to tell a genuinely post-quantum-only deployment from a post-quantum key exchange sitting in front of classical certificates, and how to verify it; a certificate-lifecycle model for machine identity - constrained enrollment, automated issuance, real-time revocation - and the operational decisions that matter; and a practical set of questions to put to your CAs, HSM vendors, and platform teams before committing to an approach.
The session is for PKI, platform, and security teams responsible for the machine-identity and mTLS portion of their post-quantum migration. It assumes working knowledge of TLS 1.3 and certificate PKI; no prior post-quantum background is required.
Speakers
- Assistant Professor · Technical University of Sofia
I am an engineer and researcher working at the intersection of mechatronics, telecommunications, and next-generation cybersecurity. My professional focus is bridging the gap between emerging cryptographic standards and their practical application in Industrial IoT (IIoT) and industrial communication systems. With a multidisciplinary foundation in mechatronics, I leverage data collection and information technologies to optimize energy utilization, operational efficiency, and system reliability. Building upon this, my advanced background in telecommunications drives my expertise in modern communication technologies, wireless networks, and the design of intelligent connected systems. Currently, I am actively engaged in research and applied work in Post-Quantum Cryptography (PQC), addressing critical challenges in modern cybersecurity. My focus centers on the real-world deployment of PQC within complex network architectures, including the implementation of hybrid TLS 1.3 and end-to-end post-quantum mutual authentication frameworks. I am committed to designing and implementing secure, scalable, and sustainable solutions that ensure infrastructure resilience in a rapidly evolving technological landscape
I am a software and infrastructure engineer focused on building secure architectures and adapting networks for post-quantum standards. I recently graduated from a specialized technical high school in Bulgaria with a professional degree in System Programming, and I am currently continuing my engineering studies at the Technical University of Sofia (Faculty of Telecommunications).
Attendance
Open session · first come, first served
Saving interest does not reserve a seat. Admission remains first come, first served.
Save favorite
