Trust Now, Forge Later: A Live Exposure Demonstration
· 14:00 – 14:25 Amsterdam time · Red hall
Current post-quantum planning is dominated by one clock, harvest-now-decrypt-later (HNDL), but for signature infrastructure the binding exposure is trust-now-forge-later (TNFL). Once a cryptographically relevant quantum computer arrives, long-validity signing anchors become forgeable, leading to loss of trust. Using the global passport and national identity infrastructure as an empirical model for TNFL exposure analysis and remediation prioritisation, this session shows in a live demonstration exactly how trust could collapse if urgent, globally coordinated action is not put in place.
The dataset is the ICAO Master List: the self-signed country signing certificate authority (CSCA) roots that anchor verification of ICAO 9303 compliant machine-readable travel documents (MRTDs) worldwide, published as a Cryptographic Message Syntax (CMS) structure and cross-checkable against the German Federal Office for Information Security (BSI) list. Both are public and neither requires Public Key Directory (PKD) participation at the CSCA layer.
The demonstration walks through the pipeline end to end, using open tooling only so that anyone can reproduce it: hash and record provenance of the source file; unwrap the CMS encapsulated content and split the CscaMasterList into per-certificate DER with a standard-library walker; extract algorithm, key size and validity fields; then derive three outputs: installed base by algorithm and key-strength band, the share of anchors whose notAfter extends past a set of CRQC scenario years, and a fingerprint-level reconciliation between the two source lists. Every figure regenerates from the script; none is asserted by hand. Findings are reported in aggregate, without singling out individual issuers.
The reusable corollary for your own cryptographic estate is to treat the certificate as the asset-register entry, treat its notAfter field as a stated useful life, and then ask which anchors you are relying on past the point their signatures can be forged. The confidentiality wave of quantum cryptographic exposure, which dominates current attention, concentrates at scannable perimeters. The integrity wave, in contrast, is distributed across every component carrying a verifiable signature, so it surfaces only through inventory, not perimeter scanning.
Attendees leave with a runnable method and an understanding of how to apply this to their own PKI estates.
Speakers
- CTO · ProteQC PQC Advisory Limited
Tim D Williams is a security architect and researcher with over thirty years' experience in applied cryptography, spanning public key infrastructure, digital certificates and signatures, key lifecycle management and hardware security modules across government, banking, energy and healthcare. He holds an MSc in Information Security Testing from Royal Holloway, University of London, an MBA from Quantic School of Business and Technology, is a Fellow of the BCS and Chartered IT Professional, a member of the Chartered Institute of Information Security, volunteer for ISC2 and Ukraine's National Academy of Internal Affairs and holder of certifications including CISSP-ISSAP-ISSEP-ISSMP. His current research, published via IEEE, Springer and SSRN (Elsevier) and catalogued under ORCID 0000-0002-1788-5736, examines the post-quantum transition from cost, lifecycle, architectural and trust-anchor perspectives. He serves on the programme committee of the Cyber Science series of conferences (https://c-mric.org (opens in a new tab)), as CTO of PQC advisory start-up ProteQC (https://ProteQC.com (opens in a new tab)) and is pursuing a PhD by published works.
Attendance
Open session · first come, first served
Saving interest does not reserve a seat. Admission remains first come, first served.
Save favorite
