Merkle Tree Certificates: Ready for Browsers and Beyond?
· 10:45 – 11:40 Amsterdam time · Blue hall
The transition to post-quantum cryptography creates a practical challenge for certificate-based systems: post-quantum signatures are substantially larger than the signatures used today, potentially increasing certificate chains beyond what TLS and other constrained protocols can comfortably carry. Merkle Tree Certificates (MTCs) offer a different model built around append-only logs, batched signatures, and compact inclusion proofs.
This moderated panel will examine whether MTCs are ready for the browser use case for which they were originally designed—and whether the same model can work across the many public key infrastructures that operate beyond the Web PKI.
Panelists will discuss the architecture and security properties of MTCs, implementation and interoperability considerations, certificate issuance and lifecycle management, and the operational changes required for relying parties, certificate authorities, browsers, servers, ACME clients, and enterprise PKI operators. The discussion will also consider how MTCs could apply to qualified trust services, device identity, telecommunications, government credentials, code and document signing, IoT environments, and other regulated or specialized trust infrastructures.
The panel will explore both the potential and the limitations of the approach. Can MTCs materially reduce the bandwidth and performance impact of post-quantum certificate chains? What new dependencies and trust assumptions do they introduce? How would existing PKI systems need to change, and which use cases may not fit the browser-oriented model?
Bringing together implementation, practitioner, qualified-trust-service, and non-Web-PKI perspectives, this session will give attendees a practical understanding of where Merkle Tree Certificates stand today, what work remains, and whether they can become a broadly useful foundation for post-quantum certificate ecosystems.
Speakers
Alexander Truskovsky
Panelist- CISO · EigenQ
Alexander Truskovsky is CISO at EigenQ, leading security strategy, governance, and risk management. He brings more than 25 years of experience in cybersecurity, applied cryptography, software engineering, and technology commercialization. At AWS, he launched post-quantum certificate support in AWS Private CA and helped advance its adoption in the Matter smart home ecosystem. He led Nokia’s quantum-safe key distribution product line and helped commercialize post-quantum cryptography at ISARA. Earlier, he contributed to security protocols and platform capabilities at BlackBerry and developed enterprise software at Oracle. His standards contributions include work with ITU, ETSI, and CSA. He holds a master’s degree in Computer Science and an MBA and is a named inventor on 30 patents.
Shane Kelly
Panelist- Principal Crypto Architect · Digicert
Shane Kelly has worked on solving various software security problems for his customers, from bespoke embedded systems to large-scale cloud-based deployments. He has spent over eight years implementing, integrating, and optimizing post-quantum algorithms.
At DigiCert, He provides secure, robust, customer-oriented post-quantum cryptography solutions. His focus is on making the transition from current cryptographic solutions to post-quantum solutions as simple as possible given the enormous challenges involved.
Kim Nguyen
Panelist- SVP Innovations · D-Trust
Kim Nguyen studied mathematics and physics at the universities of Göttingen, Cambridge (UK) and Essen. In 2001 he was awarded a Ph.D. for his work on the connections between algebraic number theory and the security of discrete logarithms on elliptic curves.
His first job was with the Crypto Competence Center of Philips Semiconductors (later NXP). In 2004 he joined the Bundesdruckerei (German Federal Print) in Berlin, Germany, where he took over responsibility as the project lead for the digital part of the new digital passport and ID card. From 2012-2023 he headed D-Trust, the QTSP of the Bundesdruckerei Group, as Managing Director, from 2018-23 he also headed the Business Unit Trusted Services. In 2015 he was awarded the titel "Fellow". As of 2024, he is now heading the Innovations department of Bundesdruckerei, focusing on Digital Identity, Quantum Technologies, Cryptography and AI and Data.
John Gray
Moderator- Principal Software Developer · Entrust
John Gray is a Principal Software Developer at Entrust, specializing in PKI architecture, cryptographic protocol implementation, and post-quantum migration strategies. He facilitates the PQC Interoperability project at the IETF and has contributed to post-quantum cryptography standards, including composite signatures and composite key encapsulation mechanisms (KEMs), and authored 5 RFCs with more in process. John also participates in the OASIS PKCS#11 Technical Committee and NIST NCCoE initiatives focused on real-world PQC adoption.
Attendance
Open session · first come, first served
Saving interest does not reserve a seat. Admission remains first come, first served.
Save favorite
