This is a draft agenda and everything on it — including timings and room assignments — may still change as the programme comes together. Keep an eye on this page, or follow us on LinkedIn, for the latest updates.
Abdel Fane
Co-Founder, CryptoServe
Abdel Fane is co-founder of CryptoServe and co-creator of QRAMM, the Quantum Readiness Assurance Maturity Model, presented at DEF CON 2025. He led the cross-ecosystem cryptographic census of 2.8 million packages presented in this session, building the scanning methodology and 357-library classification catalog from the ground up. He has 20 years of security experience across healthcare, financial services, and government, including engagements with Booz Allen Hamilton, Protiviti, Allstate, and the U.S. Department of Veterans Affairs. He holds a Master’s in Cyber Forensics and Security, and is Executive Director of CyberSecurity NonProfit, a 501(c)(3) with 13,000+ members across 16 global chapters.
A
Akane Suzuki
Chief Researcher, Hitachi, Ltd.
Akane Suzuki is a Chief Researcher at Hitachi, Ltd., specializing in information security, electronic authentication, and digital identity. Leveraging hands-on experience in cryptographic migration for public key infrastructure during Japan’s “2010 Cryptographic Algorithm Transition,” Suzuki currently focuses on analyzing post-quantum cryptography (PQC) trends and designing migration approaches, and contributed to the CRYPTREC external evaluation report in FY2025, “Survey on Technical Trends in the Migration to Post Quantum Cryptography.”
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Albert de Ruiter operates the Policy Authority at Logius, the digital government service organization of the Netherlands. He is also a member of the QvC (Quantum Secure Cryptography) working group of the Dutch government, a board member of HAPKIDO, and the Vice Chair of the PKI Consortium.
Alexander Shestakov
Researcher, Technical University of Sofia
Alexander is a software and infrastructure engineer focused on building secure architectures and adapting networks for post-quantum standards. He recently graduated from a specialized technical high school in Bulgaria with a professional degree in System Programming, and continues his engineering studies at the Technical University of Sofia (Faculty of Telecommunications).
Antti Ropponen
Executive Partner, Quantum Safe Transformation Services, IBM
Bruno Couillard
CEO & Co-Founder, Crypto4A
Bruno Couillard is the Co-Founder and CEO of Crypto4A, a leader in quantum-safe cybersecurity and trusted cryptographic infrastructure. He works at the intersection of advanced cryptography, digital trust, and secure infrastructure modernization, helping organizations prepare for the transition to the post-quantum era.
D
Daniel Apon
Director of Cryptography, Anduril Industries
Daniel Apon is the Director of Cryptography at Anduril Industries. He previously was a Lead Cryptographer at the MITRE Corporation, working on advancing the broader industry’s efforts in Post-Quantum Cryptography migration. Prior to that, he was a Cryptographer on the NIST PQC team during its PQC standardization process, where he was the NIST subject matter expert in lattice-based cryptography.
Dmitry Belyavskiy
Principal Software Engineer, Red Hat
Dmitry has worked with OpenSSL code for 20+ years, the last 5+ of them at Red Hat, where he serves as an OpenSSL maintainer and OpenSSH co-maintainer. He is involved in the OpenSSL community as a distribution community representative on the OpenSSL Corporation Technical Advisory Committee.
D
Dustin Moody
Mathematician, NIST
Dr. Dustin Moody is a mathematician in the Computer Security Division of the National Institute of Standards and Technology. Dr. Moody leads the Post-Quantum Cryptography project at NIST. He received his Ph.D. from the University of Washington in 2009. His area of research deals with elliptic curves, and their applications in cryptography.
Evgeny Gervis
CEO, SafeLogic
Evgeny has two decades of experience in the cybersecurity field, spanning startups to large Fortune 500 organizations. Prior to joining SafeLogic, Evgeny spent 15 years at Cigital and then, post-acquisition, at Synopsys, responsible for the firm’s software security solutions practice in the broader Mid-Atlantic region.
F
Fred Roos
Security Architect, ING
Jaime Gómez García
Global Head of Cryptography and Quantum Threat Program, Santander Digital Services
Jaime Gómez García is a recognized expert in quantum security, with an extensive professional background in the financial sector. He is known for advancing strategic awareness, industry coordination, and practical adoption of quantum-safe cryptography, helping organizations and critical infrastructures prepare for the transition to the quantum era. His influence has been recognized through multiple distinctions, including inclusion in Quantum Security 25: The Top 25 Most Influential People in Quantum Security (2026), the 2025 Quantum Leap Award from Keyfactor, and recognition as LinkedIn Top Voice (2024-2025) and Quantum Top Voices (2022-2024). Jaime serves as the Global Head of the Santander Quantum Threat Program and Chair of the Europol Quantum Safe Financial Forum.
Kennedy Nwup
Principal Consultant, Afield AB
Kennedy Nwup is Vice Chair of the PKI Consortium’s PKI Maturity Model Working Group and author of the PQC Readiness Extension for PKI, the first published extension to the PKI Maturity Model Extension Framework.
Marin Ivezic
Founder and CEO, Applied Quantum
Marin Ivezic has spent three decades leading national and large-enterprise IT/OT transformation programs of up to $500M, including turnarounds of failing ones. A former quantum entrepreneur, he has served as a Fortune Global 500 CISO and CTO and led global and regional cybersecurity practices at Accenture, IBM, and Big 4 firms. He is now founder and CEO of Applied Quantum, advising governments and enterprises on post-quantum migration, and writes the personal blog PostQuantum.com, which draws more than a million unique visitors a month.
Michael Osborne
CTO IBM Quantum Safe
Michael Osborne is an IBM Distinguished Engineer and the global CTO for IBM Quantum Safe. He leads the cryptographic research activities at the IBM Research Center in Rüschlikon, Switzerland. His current focus includes advancing new generations of advanced cryptography, such as those selected by NIST as the next generation of PQC algorithms. He also leads the development of methods and technologies to help organizations migrate to use new Quantum-Safe standards.
Michele Mosca
CEO, evolutionQ Inc.
Michele Mosca is a co-founder and CEO of evolutionQ and a Professor of Mathematics at the University of Waterloo. He is widely recognized as a pioneer in quantum computing and a leading voice on the cybersecurity implications of quantum technologies. He is a co-founder of the Institute for Quantum Computing and a founding member of the Perimeter Institute for Theoretical Physics, and has helped lead international initiatives in quantum-safe security including the Open Quantum Safe project and the ETSI-IQC Quantum-Safe Cryptography Conference. He holds a doctorate in quantum computer algorithms from the University of Oxford.
Mike Ounsworth
Open source maintainer, Bouncy Castle / OpenSSL
Mike Ounsworth is a software security architect, cryptographer, and cryptographic protocol designer. He is deeply involved in the Post-Quantum transition, particularly in re-designing IETF networking protocols to accommodate the new PQC algorithms, dual-algorithm hybrids, and mechanisms to ease migration barriers. Mike is the founder of Cryptic Forest Software, Adjunct Professor at the Pôle d’expertises en cybersécurité (Cybersecurity Expertise Centre) at the université de Sherbrooke, and lead maintainer of the Bouncy Castle Rust cryptographic library.
Olivier Couillard
Technical Product Manager, Crypto4A Technologies Inc.
Olivier joined Crypto4A eight years ago and has since contributed to nearly every facet of the HSM platform. His work spans from RNG design and entropy assessment to firmware development, key management applications, and even web UI implementation. In addition to his technical expertise, Olivier has collaborated with a wide range of customers and has been actively involved in the FIPS 140-2 and 140-3 certification processes.
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Paul van Brouwershaven is a distinguished leader in cybersecurity with over two decades of experience specializing in Public Key Infrastructure (PKI). He is the owner and CEO of Digitorus and chairs the PKI Consortium and leads its Post-Quantum Cryptography (PQC) Working Group, driving collaboration and innovation in digital trust and cryptographic agility.
Rieck Manfred
Head of Quantum Tech / Co-Founder, Deutsche Bahn / Federal Quantum Alliance
Manfred Rieck is Co-founder of the German Federal Quantum Alliance, a partnership of government-owned organizations and federal authorities including Deutsche Bahn/DB Systel, Bundesdruckerei, the Federal Office for Information Security (BSI), the German Federal Intelligence Service (BND), the Federal Employment Agency (BA), the German pension insurance, and BWI, the IT service provider for the German Armed Forces. The group focuses on the progress of quantum computing, quantum sensing, and quantum cybersecurity (PQC, QKD), acting as a think tank for the German government and supporting the structured introduction of PQC in government and industry. Manfred has worked in IT departments for more than 20 years in senior management positions at Deutsche Bahn, IBM, and BASF.
Roman Cinkais
SVP Enterprise Products, OmniTrust
Roman holds a master’s degree in Mathematical Methods of Information Security from Charles University in Prague. He has over 15 years of professional experience in information security across financial, retail, banking, telco, and postal industries. Roman is a co-founder of 3Key Company — now OmniTrust Security following its 2026 merger with ISS — where he serves as SVP Enterprise Products. In 2021 he founded the open-source project originally named CZERTAINLY, today known as ILM, a cloud-native trust lifecycle management platform. Roman chairs the PKI Maturity Model Working Group at the PKI Consortium, where he leads work on the PKIMM Extension Framework.
R
Rumen Doynov
Assistant Professor, Technical University of Sofia
Rumen is an engineer and researcher working at the intersection of mechatronics, telecommunications, and next-generation cybersecurity, focused on bridging emerging cryptographic standards and their practical application in Industrial IoT (IIoT) and industrial communication systems. He is currently engaged in applied work on Post-Quantum Cryptography, centered on the real-world deployment of PQC within complex network architectures, including hybrid TLS 1.3 and end-to-end post-quantum mutual authentication frameworks.
S
Sarah McCarthy
SVP Cryptography, Citi
Sudha Iyer
Chief Engineer - PKI & Cryptography, Citi
Sudha Iyer is Chief Engineer - PKI & Cryptography at Citi, an international expert and project leader for ISO smart contract security, a member of the ASC X9 Board of Directors, lead of the QSFF Prioritization stream, and a founding member of the FS-ISAC PQC Working Group.
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
Sven is an award-winning cybersecurity consultant with over 18 years of experience in PKI, automation of PKI and signing solutions, and containerized deployments, currently International PKI Man of Mystery at Keyfactor. His career has spanned both the private sector and federal government, helping organizations design, modernize, and secure their digital trust infrastructure. Recognized for his subject matter expertise in PKI and DevSecOps, he serves as Vice Chair of the PKI Consortium’s Post-Quantum Cryptography (PQC) Working Group and hosts The Key Master series by Keyfactor on the Keyfactor Developers YouTube channel.
Ted Shorter
Chief Technology Officer, Keyfactor
Ted Shorter is Chief Technology Officer at Keyfactor. Ted has worked in the security arena for over 24 years, in the fields of cryptography, application security, public key infrastructure, and software vulnerability analysis, including 10 years with the U.S. Department of Defense.
Thalia Laing
Principal Cryptographer and Security Researcher, HP Security Lab
Thalia Laing is a Principal Cryptographer and Security Researcher in HP Security Lab, where her work focuses on applying cryptography to security-critical systems and the migration of products to quantum-resistant cryptography. She has played a leading role in the design and deployment of quantum-resistant firmware integrity protections for commercial endpoint devices. Thalia holds a PhD in Cryptography from the Information Security Group at Royal Holloway, University of London.
Tomas Gustavsson
Chief PKI Officer, Keyfactor
Tomas Gustavsson is the chief public key infrastructure (PKI) officer at Keyfactor. He pioneered open-source public key infrastructure with EJBCA, now embraced by thousands of organizations. With a background in computer science, Tomas established EJBCA to fortify trusted digital identities globally. He advocates for cybersecurity through innovation, collaboration, and open-source principles.
William Newhouse
Cybersecurity Engineer & Migration to PQC Project Lead, NIST NCCoE
Bill Newhouse is a cybersecurity engineer at NIST’s National Cybersecurity Center of Excellence (NCCoE), where he leads the Migration to Post-Quantum Cryptography (PQC) project — a collaboration with industry and government that shares insights on practices easing the migration to PQC algorithms. Mr. Newhouse has been with the U.S. federal government since 1986, focused initially on telecommunications, then information assurance, and now cybersecurity.
Z
Zygmunt Lozinski
Quantum Safe Networks, IBM
08:00
Registration 60 min
09:00
Plenary
Opening
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Welcome to the 2026 PQC Conference. The chairs open the conference, set
the agenda for the three days ahead, and invite some attending sponsors for
a one-minute pitch (the only commercial message allowed at this conference).
30 min
09:30
Plenary
The state of quantum computing and cryptographic threats
An overview of where quantum computing stands today and what it means
for cryptographic security. Speaker to be confirmed.
45 min
10:15
Break 30 min
10:45
Plenary
A Quantum Leap: The NIST PQC Standardization Project
D
Dustin Moody
Mathematician, NIST
The impending arrival of cryptographically relevant quantum computers poses a transformative threat to current public-key infrastructure, necessitating an urgent transition to post-quantum cryptography (PQC). This talk provides a comprehensive update on the National Institute of Standards and Technology PQC Standardization Project, following the landmark finalization of the first three NIST PQC Standards—FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). It also covers the ongoing standardization work of Falcon and HQC. We discuss the technical foundations of these algorithms, the ongoing work to standardize additional signature schemes to diversify the portfolio, and future directions. Crucially, the talk addresses some of the practicalities of migration discussed in NISTIR 8547, in light of the recent Executive Order on “Securing the Nation Against Advanced Cryptographic Attacks,” which establishes ambitious deadlines for federal agencies and critical infrastructure.
55 min
Blue hall
Hybrid is a Redistribution of Risk, Not a Removal of It
Michael Osborne
CTO IBM Quantum Safe
The post-quantum migration debate routinely flattens “hybrid versus pure PQC” into a security question — one algorithm or two? — when it is really an operational architecture question about which class of failure your organisation is structured to handle.
This talk reframes the choice. Hybrid for key exchange is largely settled: deploy it now. Hybrid for authentication is harder, and the costs depend on construction. Composite signatures buy atomicity by binding two algorithms into one credential, but the same atomicity removes component-wise recovery and undoes two decades of hash-agility infrastructure. Parallel approaches deliver dual-algorithm assurance without the binding, fitting how PKI has handled every previous algorithm migration.
Drawing on a failure-mode analysis across twenty-five operational and cryptographic scenarios, the talk argues that for most enterprise authentication deployments, parallel is the better-fitting hybrid — and the conscious choice rarely defaults to it.
55 min
Room a
Roundtable (topic to be announced)
A smaller, single-room roundtable — capped at ~30 participants,
running longer than the standard breakout format to allow for a
deeper, off-the-record conversation.
105 min
11:45
Plenary
PQC PKI: The Good, the Broken, and the Hybrid
Tomas Gustavsson
Chief PKI Officer, Keyfactor
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
2025 was a year full of preparations for deploying PQC in practice. Standards, software libraries, HSMs, a lot of everything was updated to support PQC algorithms.
PQC 2026 started with a lot of PQC capable components and a statement like, “It’s OK to have not acted YET. 2026 will be the last time this can be said”. At the end of 2025 and the beginning of 2026 was also the time for great confusion. As organizations started to ponder on the next practical steps, they had to make decisions on what algorithms to use, hybrid solutions or not, and in the case of hybrids what type of hybrid PKI. Have companies deployed PQC in production by now? The answer is yes, production deployment have started. Decisions have been made and some earlier thoughts had to be dismissed. This presentation will highlight PQC PKI choices and hierarchies based on some real world decisions.
Architecture, algorithms, and combinations. What has been chosen and why. And maybe even more interesting, what didn’t work and why? The presenters do not claim to have seen all PQC PKI deployments of 2026, but we have seen a few, and this is real world experience from those.
45 min
Blue hall
Gaming the Speed-vs-Memory Tradeoff for ML-DSA and ML-KEM
Mike Ounsworth
Open source maintainer, Bouncy Castle / OpenSSL
FIPS is only a suggestion, sortof. Specifically, FIPS only requires “mathematical equivalence” to the listed algorithms, and that gives a surprisingly wide latitude for implementations to play algorithmic games in search of either fast or small implementations.
This talk will explore speed-vs-memory tradeoff techniques applicable to the ML-DSA and ML-KEM algorithms and the results that they obtain within the Bouncy Castle Rust library. We start with a close look at the “default” implementation, then at what you can do to move around the High Speed <–> Low Memory spectrum. In one direction, you can pre-expand intermediate values at key-load time for faster sign, verify, encaps and decaps operations which gives performance increases in the 40% - 60% range (especially valuable if doing multiple operations against the same key). In the other direction, your in-memory private key representation can consist of only intermediate seed values and you can re-derive the active lattice values one entry at a time as they are needed; you pay a penalty for deriving the same intermediate values multiple times for a dramatic reduction in memory footprint. This technique has a particularly pronounced effect on ML-DSA where ML-DSA-87.sign() can be performed in under 30 kb of peak memory usage, which represents roughly a 7.5x decrease in memory usage in exchange for a 6x increase in runtime; which is a win on heavily-loaded servers where parallelism is gated by RAM not by CPU.
45 min
12:30
Lunch 90 min
14:00
Plenary
Where the PQC Migration Actually Stands: A Cross-Ecosystem Census of 2.8 Million Packages
Abdel Fane
Co-Founder, CryptoServe
The NIST 2030 deprecation deadline for quantum-vulnerable public-key algorithms is 1,386 days away as of March 2026. Every PKI operator, certificate authority, and security team needs to know how the software supply chain they depend on is responding. No cross-ecosystem measurement existed. We built one. This session presents findings from the first cross-ecosystem cryptographic census, scanning 2,809,479 packages across 11 package ecosystems including npm, PyPI, Go, Maven, crates.io, NuGet, and others. The results reveal the actual state of PQC adoption in the open-source supply chain that PKI infrastructure depends on. Of the 2.8 million packages scanned, 108,145 use cryptographic libraries. Among those, 21,332 depend on weak or deprecated algorithms such as MD5, SHA-1, DES, and RC4. Only 188 packages, or 0.17 percent of crypto-using packages, have any post-quantum cryptography dependency. PQC adoption is concentrated in 5 of 11 ecosystems, with crates.io accounting for 58 percent of all PQC-dependent packages. Six ecosystems show zero PQC adoption. Maven has the worst weak crypto rate at 51.6 percent.
Beyond the headline numbers, the talk addresses the migration gap that matters most for PKI operators. Dependency-level scanning, the foundation of most software composition analysis tools, misses approximately 4 times the cryptographic surface area visible to source-level analysis. We validated this gap on 20 production projects and found that 30 percent of projects with active cryptographic code show zero dependency-level signal. For PKI operators conducting cryptographic inventories under NIST IR 8547 or OMB M-23-02, this means current tooling systematically undercounts exposure.
Attendees leave with three actionable outcomes: the current state of PQC adoption in their language ecosystem with named libraries and migration paths; a reproducible census methodology they can apply to internal package registries and vendor assessments; and a clear understanding of why dependency scanning alone fails for cryptographic inventory and what to do about it.
All scanning tools, the 357-library classification catalog, the full scan dataset, and a live dashboard are released open source.
25 min
Blue hall
Making ML-DSA Work for Machine-to-Machine mTLS: Field Notes from an End-to-End Post-Quantum PKI
R
Rumen Doynov
Assistant Professor, Technical University of Sofia
Alexander Shestakov
Researcher, Technical University of Sofia
Most post-quantum migration programs have done the easy part - hybrid key exchange - and then hit a wall at authentication. Getting ML-DSA certificates working for real machine-to-machine identity, with a PKI that can issue, renew, and revoke them, is where timelines slip: the certificates are large, lifecycle tooling is immature, and almost no one has run mutual TLS where both sides authenticate with post-quantum credentials.
This is a practitioner field report from an organization that has built and now operates exactly that - an end-to-end post-quantum machine-identity stack: an ML-DSA-65 CA hierarchy, post-quantum-only mutual TLS enforced at the edge, automated enrollment and short-lived issuance, and OCSP/CRL revocation that takes effect in real time. We share what it actually took, so teams planning the authentication phase of their own migration know what they are walking into.
Attendees leave with: a realistic picture of the authentication half of PQC migration - what is production-ready today and what is still blocked on standards (IETF LAMPS composite certificates, post-quantum identity tokens); where ML-DSA certificate and signature sizes actually cause problems - handshake payloads, buffers, issuance throughput - measured against classical TLS 1.3; how to tell a genuinely post-quantum-only deployment from a post-quantum key exchange sitting in front of classical certificates, and how to verify it; a certificate-lifecycle model for machine identity - constrained enrollment, automated issuance, real-time revocation - and the operational decisions that matter; and a practical set of questions to put to your CAs, HSM vendors, and platform teams before committing to an approach.
The session is for PKI, platform, and security teams responsible for the machine-identity and mTLS portion of their post-quantum migration. It assumes working knowledge of TLS 1.3 and certificate PKI; no prior post-quantum background is required.
25 min
Room a
To be announced
Session details will be announced soon.
25 min
Room b
To be announced
Session details will be announced soon.
25 min
Room c
To be announced
Session details will be announced soon.
25 min
Room d
To be announced
Session details will be announced soon.
25 min
14:30
Plenary
To be announced
Session details will be announced soon.
30 min
Blue hall
To be announced
Session details will be announced soon.
30 min
Room a
To be announced
Session details will be announced soon.
30 min
Room b
To be announced
Session details will be announced soon.
30 min
Room c
To be announced
Session details will be announced soon.
30 min
Room d
To be announced
Session details will be announced soon.
30 min
15:00
Break 30 min
15:30
Plenary
To be announced
Session details will be announced soon.
40 min
Blue hall
To be announced
Session details will be announced soon.
40 min
16:15
Plenary
120,000 Tasks: The Cryptography Was the Easy Part
Marin Ivezic
Founder and CEO, Applied Quantum
The integrated master schedule for one large enterprise’s post-quantum migration grew past 120,000 discrete tasks. It was not a count of devices, certificates, or applications to upgrade. If it were, 120,000 would be small. The direct remediation work, the actual cutovers across every device and application, accounted for fewer than 30,000 tasks (a million-plus devices, systems, and apps grouped into upgrade batches).
The remaining 90,000 or so tasks are the enablement system: inventory as a living capability, governance and reporting cadence, vendor lifecycle enforcement, testing and assurance, workforce change, ecosystem and partner alignment, and ongoing operations during the long hybrid period.
Drawing on that 120,000-task plan (illustrative of complexity, not a universal count) and on three decades running high-stakes delivery programs such as national payments systems and federal health-records platforms, the talk turns to what actually governs whether such a program finishes. It is rarely the cryptography. It is the density of interdependencies: vendors waiting on internal teams, shared infrastructure that must be ready before application waves can move, regulatory deadlines colliding with finite engineering capacity. It is ownership, because cryptography is everyone’s problem and therefore no one’s, so the program needs a single accountable lead with authority across security, IT, engineering, procurement, and OT. It is workforce capacity, since the trained people a program needs at its peak in years four to eight cannot be conjured on demand. And it is funding that has to survive several budget cycles and more than one CISO. PKI realities sit inside this frame: certificate migration planned as waves rather than a single flag day, and PKI and HSM procurement and certification lead times treated as hard scheduling constraints.
Attendees leave able to right-size and sequence their own program, separate a credible plan from a wishful timeline, argue for a single accountable owner and the governance to back one, build the board case for multi-year funding, and prioritize by risk so the program delivers measurable security gains in years one to three while the longer effort runs on.
40 min
Blue hall
To be announced
Session details will be announced soon.
40 min
17:00
Plenary
Closing (Day 1)
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Brief closing remarks and a preview of Day 2.
5 min
Blue hall
Closing (Day 1)
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Brief closing remarks for the blue hall audience and a preview of Day 2.
5 min
17:05
End of day one
08:00
Registration 60 min
09:00
Opening
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Welcome to the 2026 PQC Conference. The chairs open the conference, set
the agenda for the three days ahead, and invite some attending sponsors for
a one-minute pitch (the only commercial message allowed at this conference).
30 min
09:30
Keynote
The state of quantum computing and cryptographic threats
An overview of where quantum computing stands today and what it means
for cryptographic security. Speaker to be confirmed.
45 min
10:15
Break 30 min
10:45
A Quantum Leap: The NIST PQC Standardization Project
D
Dustin Moody
Mathematician, NIST
The impending arrival of cryptographically relevant quantum computers poses a transformative threat to current public-key infrastructure, necessitating an urgent transition to post-quantum cryptography (PQC). This talk provides a comprehensive update on the National Institute of Standards and Technology PQC Standardization Project, following the landmark finalization of the first three NIST PQC Standards—FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). It also covers the ongoing standardization work of Falcon and HQC. We discuss the technical foundations of these algorithms, the ongoing work to standardize additional signature schemes to diversify the portfolio, and future directions. Crucially, the talk addresses some of the practicalities of migration discussed in NISTIR 8547, in light of the recent Executive Order on “Securing the Nation Against Advanced Cryptographic Attacks,” which establishes ambitious deadlines for federal agencies and critical infrastructure.
55 min
Hybrid is a Redistribution of Risk, Not a Removal of It
Michael Osborne
CTO IBM Quantum Safe
The post-quantum migration debate routinely flattens “hybrid versus pure PQC” into a security question — one algorithm or two? — when it is really an operational architecture question about which class of failure your organisation is structured to handle.
This talk reframes the choice. Hybrid for key exchange is largely settled: deploy it now. Hybrid for authentication is harder, and the costs depend on construction. Composite signatures buy atomicity by binding two algorithms into one credential, but the same atomicity removes component-wise recovery and undoes two decades of hash-agility infrastructure. Parallel approaches deliver dual-algorithm assurance without the binding, fitting how PKI has handled every previous algorithm migration.
Drawing on a failure-mode analysis across twenty-five operational and cryptographic scenarios, the talk argues that for most enterprise authentication deployments, parallel is the better-fitting hybrid — and the conscious choice rarely defaults to it.
55 min
Roundtable
Roundtable (topic to be announced)
A smaller, single-room roundtable — capped at ~30 participants,
running longer than the standard breakout format to allow for a
deeper, off-the-record conversation.
105 min
11:45
PQC PKI: The Good, the Broken, and the Hybrid
Tomas Gustavsson
Chief PKI Officer, Keyfactor
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
2025 was a year full of preparations for deploying PQC in practice. Standards, software libraries, HSMs, a lot of everything was updated to support PQC algorithms.
PQC 2026 started with a lot of PQC capable components and a statement like, “It’s OK to have not acted YET. 2026 will be the last time this can be said”. At the end of 2025 and the beginning of 2026 was also the time for great confusion. As organizations started to ponder on the next practical steps, they had to make decisions on what algorithms to use, hybrid solutions or not, and in the case of hybrids what type of hybrid PKI. Have companies deployed PQC in production by now? The answer is yes, production deployment have started. Decisions have been made and some earlier thoughts had to be dismissed. This presentation will highlight PQC PKI choices and hierarchies based on some real world decisions.
Architecture, algorithms, and combinations. What has been chosen and why. And maybe even more interesting, what didn’t work and why? The presenters do not claim to have seen all PQC PKI deployments of 2026, but we have seen a few, and this is real world experience from those.
45 min
Gaming the Speed-vs-Memory Tradeoff for ML-DSA and ML-KEM
Mike Ounsworth
Open source maintainer, Bouncy Castle / OpenSSL
FIPS is only a suggestion, sortof. Specifically, FIPS only requires “mathematical equivalence” to the listed algorithms, and that gives a surprisingly wide latitude for implementations to play algorithmic games in search of either fast or small implementations.
This talk will explore speed-vs-memory tradeoff techniques applicable to the ML-DSA and ML-KEM algorithms and the results that they obtain within the Bouncy Castle Rust library. We start with a close look at the “default” implementation, then at what you can do to move around the High Speed <–> Low Memory spectrum. In one direction, you can pre-expand intermediate values at key-load time for faster sign, verify, encaps and decaps operations which gives performance increases in the 40% - 60% range (especially valuable if doing multiple operations against the same key). In the other direction, your in-memory private key representation can consist of only intermediate seed values and you can re-derive the active lattice values one entry at a time as they are needed; you pay a penalty for deriving the same intermediate values multiple times for a dramatic reduction in memory footprint. This technique has a particularly pronounced effect on ML-DSA where ML-DSA-87.sign() can be performed in under 30 kb of peak memory usage, which represents roughly a 7.5x decrease in memory usage in exchange for a 6x increase in runtime; which is a win on heavily-loaded servers where parallelism is gated by RAM not by CPU.
45 min
12:30
Lunch 90 min
14:00
Where the PQC Migration Actually Stands: A Cross-Ecosystem Census of 2.8 Million Packages
Abdel Fane
Co-Founder, CryptoServe
The NIST 2030 deprecation deadline for quantum-vulnerable public-key algorithms is 1,386 days away as of March 2026. Every PKI operator, certificate authority, and security team needs to know how the software supply chain they depend on is responding. No cross-ecosystem measurement existed. We built one. This session presents findings from the first cross-ecosystem cryptographic census, scanning 2,809,479 packages across 11 package ecosystems including npm, PyPI, Go, Maven, crates.io, NuGet, and others. The results reveal the actual state of PQC adoption in the open-source supply chain that PKI infrastructure depends on. Of the 2.8 million packages scanned, 108,145 use cryptographic libraries. Among those, 21,332 depend on weak or deprecated algorithms such as MD5, SHA-1, DES, and RC4. Only 188 packages, or 0.17 percent of crypto-using packages, have any post-quantum cryptography dependency. PQC adoption is concentrated in 5 of 11 ecosystems, with crates.io accounting for 58 percent of all PQC-dependent packages. Six ecosystems show zero PQC adoption. Maven has the worst weak crypto rate at 51.6 percent.
Beyond the headline numbers, the talk addresses the migration gap that matters most for PKI operators. Dependency-level scanning, the foundation of most software composition analysis tools, misses approximately 4 times the cryptographic surface area visible to source-level analysis. We validated this gap on 20 production projects and found that 30 percent of projects with active cryptographic code show zero dependency-level signal. For PKI operators conducting cryptographic inventories under NIST IR 8547 or OMB M-23-02, this means current tooling systematically undercounts exposure.
Attendees leave with three actionable outcomes: the current state of PQC adoption in their language ecosystem with named libraries and migration paths; a reproducible census methodology they can apply to internal package registries and vendor assessments; and a clear understanding of why dependency scanning alone fails for cryptographic inventory and what to do about it.
All scanning tools, the 357-library classification catalog, the full scan dataset, and a live dashboard are released open source.
25 min
Making ML-DSA Work for Machine-to-Machine mTLS: Field Notes from an End-to-End Post-Quantum PKI
R
Rumen Doynov
Assistant Professor, Technical University of Sofia
Alexander Shestakov
Researcher, Technical University of Sofia
Most post-quantum migration programs have done the easy part - hybrid key exchange - and then hit a wall at authentication. Getting ML-DSA certificates working for real machine-to-machine identity, with a PKI that can issue, renew, and revoke them, is where timelines slip: the certificates are large, lifecycle tooling is immature, and almost no one has run mutual TLS where both sides authenticate with post-quantum credentials.
This is a practitioner field report from an organization that has built and now operates exactly that - an end-to-end post-quantum machine-identity stack: an ML-DSA-65 CA hierarchy, post-quantum-only mutual TLS enforced at the edge, automated enrollment and short-lived issuance, and OCSP/CRL revocation that takes effect in real time. We share what it actually took, so teams planning the authentication phase of their own migration know what they are walking into.
Attendees leave with: a realistic picture of the authentication half of PQC migration - what is production-ready today and what is still blocked on standards (IETF LAMPS composite certificates, post-quantum identity tokens); where ML-DSA certificate and signature sizes actually cause problems - handshake payloads, buffers, issuance throughput - measured against classical TLS 1.3; how to tell a genuinely post-quantum-only deployment from a post-quantum key exchange sitting in front of classical certificates, and how to verify it; a certificate-lifecycle model for machine identity - constrained enrollment, automated issuance, real-time revocation - and the operational decisions that matter; and a practical set of questions to put to your CAs, HSM vendors, and platform teams before committing to an approach.
The session is for PKI, platform, and security teams responsible for the machine-identity and mTLS portion of their post-quantum migration. It assumes working knowledge of TLS 1.3 and certificate PKI; no prior post-quantum background is required.
25 min
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
14:30
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
15:00
Break 30 min
15:30
To be announced
Session details will be announced soon.
40 min
To be announced
Session details will be announced soon.
40 min
16:15
120,000 Tasks: The Cryptography Was the Easy Part
Marin Ivezic
Founder and CEO, Applied Quantum
The integrated master schedule for one large enterprise’s post-quantum migration grew past 120,000 discrete tasks. It was not a count of devices, certificates, or applications to upgrade. If it were, 120,000 would be small. The direct remediation work, the actual cutovers across every device and application, accounted for fewer than 30,000 tasks (a million-plus devices, systems, and apps grouped into upgrade batches).
The remaining 90,000 or so tasks are the enablement system: inventory as a living capability, governance and reporting cadence, vendor lifecycle enforcement, testing and assurance, workforce change, ecosystem and partner alignment, and ongoing operations during the long hybrid period.
Drawing on that 120,000-task plan (illustrative of complexity, not a universal count) and on three decades running high-stakes delivery programs such as national payments systems and federal health-records platforms, the talk turns to what actually governs whether such a program finishes. It is rarely the cryptography. It is the density of interdependencies: vendors waiting on internal teams, shared infrastructure that must be ready before application waves can move, regulatory deadlines colliding with finite engineering capacity. It is ownership, because cryptography is everyone’s problem and therefore no one’s, so the program needs a single accountable lead with authority across security, IT, engineering, procurement, and OT. It is workforce capacity, since the trained people a program needs at its peak in years four to eight cannot be conjured on demand. And it is funding that has to survive several budget cycles and more than one CISO. PKI realities sit inside this frame: certificate migration planned as waves rather than a single flag day, and PKI and HSM procurement and certification lead times treated as hard scheduling constraints.
Attendees leave able to right-size and sequence their own program, separate a credible plan from a wishful timeline, argue for a single accountable owner and the governance to back one, build the board case for multi-year funding, and prioritize by risk so the program delivers measurable security gains in years one to three while the longer effort runs on.
40 min
To be announced
Session details will be announced soon.
40 min
17:00
Closing (Day 1)
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Brief closing remarks and a preview of Day 2.
5 min
Closing (Day 1)
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Brief closing remarks for the blue hall audience and a preview of Day 2.
5 min
17:05
End of day one
08:00
Registration 60 min
09:00
Plenary
Welcome back — Day 2
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
A quick look at what is on today and how to get the most out of it.
5 min
Blue hall
Welcome back — Day 2
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
Parallel welcome and agenda highlights for the blue hall audience.
5 min
09:05
Plenary
To be announced
Session details will be announced soon.
25 min
Blue hall
To be announced
Session details will be announced soon.
25 min
09:35
Plenary
To be announced
Session details will be announced soon.
40 min
Blue hall
To be announced
Session details will be announced soon.
40 min
10:15
Break 30 min
10:45
Plenary
Your Suppliers Aren't Ready: PQC Supply Chain Readiness
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
F
Fred Roos
Security Architect, ING
Rieck Manfred
Head of Quantum Tech / Co-Founder, Deutsche Bahn / Federal Quantum Alliance
You have mapped your internal cryptographic assets, you have a migration plan, and you know which algorithms you are moving to. Then you open a ticket with your HSM vendor, your cloud key management provider, your identity platform, your network appliance manufacturer — and the answers range from vague to contradictory to silent. Your suppliers are the gap between your migration plan and your migration reality.
The challenge is not limited to hardware security modules. Every product and service that uses cryptography — software libraries, CAs, signing services, authentication platforms, enterprise SaaS, embedded firmware — is a dependency in your PQC migration. And most of them are somewhere between Level 0 (nothing implemented) and Level 2 (production-ready but no inventory, no agility, no roadmap transparency). This session opens with a ten-minute introduction to how the PKI Consortium’s PQC Maturity Model (PQCMM) works in practice, then the panel takes over: what does it actually look like to mandate PQC supplier requirements at a large institution, what do assessors find when they start evaluating products against a structured framework, and what would accelerate adoption of a common standard across the supplier ecosystem.
Attendees leave with a practical starting point: how to introduce the PQCMM into procurement for high-priority suppliers today, what to put in contracts, and how to handle the inevitable exceptions.
60 min
Blue hall
Lightning talk 1
Speaker and topic to be announced.
15 min
Room a
Post-Quantum Migration at Anduril
D
Daniel Apon
Director of Cryptography, Anduril Industries
Anduril’s post-quantum cryptography (PQC) migration is well underway. Our particular focus is on the most constrained, most possibly complicated signals environments in which to establish secure, modern communications infrastructure. In this talk, I survey the technical roadmap of Anduril Industries from no-PQC to full-PQC, with special emphasis on DDIL (Denied, Disrupted, Intermittent, and Limited) communication scenarios. This talk discusses organizational challenges, engineering roadblocks (and successes), ranging from early planning and implementation, to simulation testing, live field testing, and deployment roll-out. A special emphasis is on interoperability of protocols and cryptographic primitives, and how to effectively handle various international regulation jurisdictions, as well as a call for further, future collaboration in this space, especially on common standards across various standardization bodies.
45 min
11:00
Blue hall
Lightning talk 2
Speaker and topic to be announced.
15 min
11:15
Blue hall
Lightning talk 3
Speaker and topic to be announced.
15 min
11:30
Blue hall
Lightning talk 4
Speaker and topic to be announced.
15 min
11:45
Plenary
To be announced
Session details will be announced soon.
45 min
Blue hall
Lessons Learned from Deploying LMS at Scale
Thalia Laing
Principal Cryptographer and Security Researcher, HP Security Lab
Stateful hash-based signatures such as LMS are standardised and well understood, but translating them into deployable products involves challenges that are often absent from standards and academic literature.
This talk discusses the practical realities of deploying a stateful hash-based scheme in long-lived hardware-rooted systems. Drawing on experience securing firmware update mechanisms in commercial PCs and printers, it explores how standards guidance, hardware lifecycles, resilience requirements, certification considerations and business constraints influenced key design decisions.
It covers lessons from adopting the LMS standard into security features deployed at scale, including the challenges of balancing security, resilience, certification and operational requirements, and reflects on how later developments in standards, certification programmes and industry guidance reinforced, challenged or reshaped those decisions — and what this means for future quantum-resistant migrations.
45 min
12:30
Lunch 90 min
14:00
Plenary
To be announced
Session details will be announced soon.
25 min
Blue hall
To be announced
Session details will be announced soon.
25 min
Room a
Quantum-Safe Audit Log Relying on Attestation Procedures
Olivier Couillard
Technical Product Manager, Crypto4A Technologies Inc.
Last year, we examined how hardware security modules can provide cryptographic attestation, i.e., a signed snapshot of the state of an HSM and/or of its keys. Trust in cryptographic infrastructure, however, often requires more than a snapshot; it requires proof of history. This presentation introduces cryptographically verifiable audit logs for hardware security modules, a mechanism that produces a tamper-evident, independently verifiable record of every operation performed on a cryptographic object over its lifetime. Where attestation tells you what a key looks like today, an audit log tells you everything that was done to it and when. Key ceremonies require a verifiable sequence of authorized operations that no snapshot can reconstruct; key migration requires a temporary export, so the destination device’s attestation cannot prove the process was correct, but the combined audit logs of both devices can. The cryptographic architecture behind this relies on event chaining and attested log state, with tooling that runs entirely outside the HSM so that an auditor can verify the record without device access. For long-term validity, all of this must rest on quantum-safe roots of trust provisioned at manufacturing time.
25 min
Room b
Adding PQ Capabilities to SSH Protocol: The Fedora Approach
Dmitry Belyavskiy
Principal Software Engineer, Red Hat
OpenSSH and libssh are 2 mostly widespread implementations of SSH protocol. Real-world requirements for PQ crypto causes writing significant patches to OpenSSH because of difference of the upstream and downstream requirements. libssh upstream is more binded to Fedora maintainers and lands the changes upstream.
The talk covers key downstream changes in OpenSSH: using OpenSSL code, providing extra algorithms support, FIPS compatibility quirks, in OpenSSH, and corresponding changes in libssh.
25 min
Room c
Measuring PQC Readiness for PKI: Introducing the PKI Maturity Model Extension Framework and Its First Extension
Roman Cinkais
SVP Enterprise Products, OmniTrust
Kennedy Nwup
Principal Consultant, Afield AB
Most organisations approaching post-quantum migration share the same blind spot: they have a roadmap, but no honest way to measure where their PKI actually stands. This session introduces two published outputs of the PKI Consortium’s PKIMM Working Group: the PKI Maturity Model Extension Framework, and the PQC Readiness Extension for PKI built on top of it.
The PKI Maturity Model already helps organisations benchmark their PKI programmes against an industry reference structured around four modules and fifteen capability categories. The Extension Framework defines a standardised way to overlay targeted, fast-moving maturity criteria — PQC, automation, cryptographic agility — onto the existing categories, with consistent scoring, weighting, and reporting rules. The PQC Readiness Extension, authored by Kennedy Nwup, is the first published extension, giving PKI owners a defensible answer to questions their CISOs, regulators and auditors are starting to ask.
In this joint session, Roman Cinkais (Chair, PKIMM WG) and Kennedy Nwup (Vice Chair, PKIMM WG, and author of the extension) walk through the design of the Extension Framework, present the PQC Readiness Extension in detail, show how it is intended to be used in practice, and reflect on turning a working group draft into a published, community-endorsed specification.
Attendees will leave with a published framework and a PQC Readiness Extension they can apply to their PKI programme straight away.
25 min
Room d
To be announced
Session details will be announced soon.
25 min
14:30
Plenary
To be announced
Session details will be announced soon.
30 min
Blue hall
To be announced
Session details will be announced soon.
30 min
Room a
To be announced
Session details will be announced soon.
30 min
Room b
To be announced
Session details will be announced soon.
30 min
Room c
To be announced
Session details will be announced soon.
30 min
Room d
To be announced
Session details will be announced soon.
30 min
15:00
Break 30 min
15:30
Plenary
To be announced
Session details will be announced soon.
40 min
Blue hall
To be announced
Session details will be announced soon.
40 min
16:15
Plenary
To be announced
Session details will be announced soon.
40 min
Blue hall
Practical Implementation of Hardware-Separated Composite Signatures for Large-Scale PKI During the PQC Migration Period
A
Akane Suzuki
Chief Researcher, Hitachi, Ltd.
The transition to Post-Quantum Cryptography (PQC) presents a significant challenge for organizations operating large-scale Public Key Infrastructures (PKIs). While PQC standards are becoming available, replacing vast numbers of deployed hardware tokens such as smart cards remains operationally expensive and time-consuming.
In this session, we present our implementation experience with the IETF LAMPS draft “Composite ML-DSA for Use in X.509 Public Key Infrastructure” in a hardware-separated environment for large-scale PKI migration. The approach combines existing smart cards holding traditional signature keys (e.g., RSA) with server-side Hardware Security Modules (HSMs) providing PQC signature capabilities (e.g., ML-DSA), enabling organizations to begin introducing PQC without requiring immediate replacement of end-user hardware. We discuss three representative risks observed during implementation and evaluation: cross-protocol signature composition, unintended reuse of composite-signature keys for single-algorithm signatures, and device impersonation across separated trust domains, and present a device-binding architecture that addresses them while maintaining compatibility with the IETF LAMPS composite signature framework.
We also evaluate the potential operational impact of this approach using a large-scale PKI migration model involving tens of millions of certificates, and share architectural considerations, implementation experiences, and validation results from a prototype built using cloud-based HSM services and commercially available PKI smart cards.
40 min
17:00
Plenary
Closing (Day 2)
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
Brief closing remarks and a preview of Day 3.
5 min
Blue hall
Closing (Day 2)
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Brief closing remarks for the blue hall audience and a preview of Day 3.
5 min
17:05
Networking & drinks 85 min
18:30
End of day two
08:00
Registration 60 min
09:00
Welcome back — Day 2
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
A quick look at what is on today and how to get the most out of it.
5 min
Welcome back — Day 2
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
Parallel welcome and agenda highlights for the blue hall audience.
5 min
09:05
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
09:35
To be announced
Session details will be announced soon.
40 min
To be announced
Session details will be announced soon.
40 min
10:15
Break 30 min
10:45
Panel discussion
Your Suppliers Aren't Ready: PQC Supply Chain Readiness
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
F
Fred Roos
Security Architect, ING
Rieck Manfred
Head of Quantum Tech / Co-Founder, Deutsche Bahn / Federal Quantum Alliance
You have mapped your internal cryptographic assets, you have a migration plan, and you know which algorithms you are moving to. Then you open a ticket with your HSM vendor, your cloud key management provider, your identity platform, your network appliance manufacturer — and the answers range from vague to contradictory to silent. Your suppliers are the gap between your migration plan and your migration reality.
The challenge is not limited to hardware security modules. Every product and service that uses cryptography — software libraries, CAs, signing services, authentication platforms, enterprise SaaS, embedded firmware — is a dependency in your PQC migration. And most of them are somewhere between Level 0 (nothing implemented) and Level 2 (production-ready but no inventory, no agility, no roadmap transparency). This session opens with a ten-minute introduction to how the PKI Consortium’s PQC Maturity Model (PQCMM) works in practice, then the panel takes over: what does it actually look like to mandate PQC supplier requirements at a large institution, what do assessors find when they start evaluating products against a structured framework, and what would accelerate adoption of a common standard across the supplier ecosystem.
Attendees leave with a practical starting point: how to introduce the PQCMM into procurement for high-priority suppliers today, what to put in contracts, and how to handle the inevitable exceptions.
60 min
Lightning talk
Lightning talk 1
Speaker and topic to be announced.
15 min
Post-Quantum Migration at Anduril
D
Daniel Apon
Director of Cryptography, Anduril Industries
Anduril’s post-quantum cryptography (PQC) migration is well underway. Our particular focus is on the most constrained, most possibly complicated signals environments in which to establish secure, modern communications infrastructure. In this talk, I survey the technical roadmap of Anduril Industries from no-PQC to full-PQC, with special emphasis on DDIL (Denied, Disrupted, Intermittent, and Limited) communication scenarios. This talk discusses organizational challenges, engineering roadblocks (and successes), ranging from early planning and implementation, to simulation testing, live field testing, and deployment roll-out. A special emphasis is on interoperability of protocols and cryptographic primitives, and how to effectively handle various international regulation jurisdictions, as well as a call for further, future collaboration in this space, especially on common standards across various standardization bodies.
45 min
11:00
Lightning talk
Lightning talk 2
Speaker and topic to be announced.
15 min
11:15
Lightning talk
Lightning talk 3
Speaker and topic to be announced.
15 min
11:30
Lightning talk
Lightning talk 4
Speaker and topic to be announced.
15 min
11:45
To be announced
Session details will be announced soon.
45 min
Lessons Learned from Deploying LMS at Scale
Thalia Laing
Principal Cryptographer and Security Researcher, HP Security Lab
Stateful hash-based signatures such as LMS are standardised and well understood, but translating them into deployable products involves challenges that are often absent from standards and academic literature.
This talk discusses the practical realities of deploying a stateful hash-based scheme in long-lived hardware-rooted systems. Drawing on experience securing firmware update mechanisms in commercial PCs and printers, it explores how standards guidance, hardware lifecycles, resilience requirements, certification considerations and business constraints influenced key design decisions.
It covers lessons from adopting the LMS standard into security features deployed at scale, including the challenges of balancing security, resilience, certification and operational requirements, and reflects on how later developments in standards, certification programmes and industry guidance reinforced, challenged or reshaped those decisions — and what this means for future quantum-resistant migrations.
45 min
12:30
Lunch 90 min
14:00
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
Quantum-Safe Audit Log Relying on Attestation Procedures
Olivier Couillard
Technical Product Manager, Crypto4A Technologies Inc.
Last year, we examined how hardware security modules can provide cryptographic attestation, i.e., a signed snapshot of the state of an HSM and/or of its keys. Trust in cryptographic infrastructure, however, often requires more than a snapshot; it requires proof of history. This presentation introduces cryptographically verifiable audit logs for hardware security modules, a mechanism that produces a tamper-evident, independently verifiable record of every operation performed on a cryptographic object over its lifetime. Where attestation tells you what a key looks like today, an audit log tells you everything that was done to it and when. Key ceremonies require a verifiable sequence of authorized operations that no snapshot can reconstruct; key migration requires a temporary export, so the destination device’s attestation cannot prove the process was correct, but the combined audit logs of both devices can. The cryptographic architecture behind this relies on event chaining and attested log state, with tooling that runs entirely outside the HSM so that an auditor can verify the record without device access. For long-term validity, all of this must rest on quantum-safe roots of trust provisioned at manufacturing time.
25 min
Adding PQ Capabilities to SSH Protocol: The Fedora Approach
Dmitry Belyavskiy
Principal Software Engineer, Red Hat
OpenSSH and libssh are 2 mostly widespread implementations of SSH protocol. Real-world requirements for PQ crypto causes writing significant patches to OpenSSH because of difference of the upstream and downstream requirements. libssh upstream is more binded to Fedora maintainers and lands the changes upstream.
The talk covers key downstream changes in OpenSSH: using OpenSSL code, providing extra algorithms support, FIPS compatibility quirks, in OpenSSH, and corresponding changes in libssh.
25 min
Measuring PQC Readiness for PKI: Introducing the PKI Maturity Model Extension Framework and Its First Extension
Roman Cinkais
SVP Enterprise Products, OmniTrust
Kennedy Nwup
Principal Consultant, Afield AB
Most organisations approaching post-quantum migration share the same blind spot: they have a roadmap, but no honest way to measure where their PKI actually stands. This session introduces two published outputs of the PKI Consortium’s PKIMM Working Group: the PKI Maturity Model Extension Framework, and the PQC Readiness Extension for PKI built on top of it.
The PKI Maturity Model already helps organisations benchmark their PKI programmes against an industry reference structured around four modules and fifteen capability categories. The Extension Framework defines a standardised way to overlay targeted, fast-moving maturity criteria — PQC, automation, cryptographic agility — onto the existing categories, with consistent scoring, weighting, and reporting rules. The PQC Readiness Extension, authored by Kennedy Nwup, is the first published extension, giving PKI owners a defensible answer to questions their CISOs, regulators and auditors are starting to ask.
In this joint session, Roman Cinkais (Chair, PKIMM WG) and Kennedy Nwup (Vice Chair, PKIMM WG, and author of the extension) walk through the design of the Extension Framework, present the PQC Readiness Extension in detail, show how it is intended to be used in practice, and reflect on turning a working group draft into a published, community-endorsed specification.
Attendees will leave with a published framework and a PQC Readiness Extension they can apply to their PKI programme straight away.
25 min
To be announced
Session details will be announced soon.
25 min
14:30
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
15:00
Break 30 min
15:30
To be announced
Session details will be announced soon.
40 min
To be announced
Session details will be announced soon.
40 min
16:15
To be announced
Session details will be announced soon.
40 min
Practical Implementation of Hardware-Separated Composite Signatures for Large-Scale PKI During the PQC Migration Period
A
Akane Suzuki
Chief Researcher, Hitachi, Ltd.
The transition to Post-Quantum Cryptography (PQC) presents a significant challenge for organizations operating large-scale Public Key Infrastructures (PKIs). While PQC standards are becoming available, replacing vast numbers of deployed hardware tokens such as smart cards remains operationally expensive and time-consuming.
In this session, we present our implementation experience with the IETF LAMPS draft “Composite ML-DSA for Use in X.509 Public Key Infrastructure” in a hardware-separated environment for large-scale PKI migration. The approach combines existing smart cards holding traditional signature keys (e.g., RSA) with server-side Hardware Security Modules (HSMs) providing PQC signature capabilities (e.g., ML-DSA), enabling organizations to begin introducing PQC without requiring immediate replacement of end-user hardware. We discuss three representative risks observed during implementation and evaluation: cross-protocol signature composition, unintended reuse of composite-signature keys for single-algorithm signatures, and device impersonation across separated trust domains, and present a device-binding architecture that addresses them while maintaining compatibility with the IETF LAMPS composite signature framework.
We also evaluate the potential operational impact of this approach using a large-scale PKI migration model involving tens of millions of certificates, and share architectural considerations, implementation experiences, and validation results from a prototype built using cloud-based HSM services and commercially available PKI smart cards.
40 min
17:00
Closing (Day 2)
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
Brief closing remarks and a preview of Day 3.
5 min
Closing (Day 2)
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Brief closing remarks for the blue hall audience and a preview of Day 3.
5 min
17:05
Networking & drinks 85 min
18:30
End of day two
08:00
Registration 60 min
09:00
Plenary
Welcome back — Day 3
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Final day framing: what is ahead, and how to make the most of the
last day before heading back into the real world.
5 min
Blue hall
Welcome back — Day 3
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Parallel welcome and agenda highlights for the blue hall audience.
5 min
09:05
Plenary
Towards Coordinated Quantum Security in the Financial Sector: Risks, Priorities, and a Framework for Market Action
Jaime Gómez García
Global Head of Cryptography and Quantum Threat Program, Santander Digital Services
The transition to quantum security in the financial sector is not only a technological undertaking, but also a coordination challenge for a highly interconnected global ecosystem. Misaligned transition efforts may create operational risks, including interoperability tensions across markets, infrastructures, and jurisdictions, prolonged reliance on quantum-vulnerable cryptography, inefficient duplication of effort, and ecosystem fragmentation.
To address these risks, the Europol Quantum Safe Financial Forum, in collaboration with FS-ISAC and CFDIR, has proposed an operational framework for coordinated action. The framework focuses on identifying and prioritising critical use cases, structuring the transition through shared implementation waves, and defining three use-case-specific milestones to align sequencing and execution.
This session examines that prioritisation framework and provides an update on the state of quantum security in the financial sector — relevant not only to financial sector professionals, but to the wider community as an early example of ecosystem-wide coordination and its associated challenges.
25 min
Blue hall
To be announced
Session details will be announced soon.
25 min
09:35
Plenary
To be announced
Session details will be announced soon.
40 min
Blue hall
To be announced
Session details will be announced soon.
40 min
10:15
Break 30 min
10:45
Plenary
Scaling Quantum Safe: How HSBC Transitions from Early Momentum to Enterprise Execution
Antti Ropponen
Executive Partner, Quantum Safe Transformation Services, IBM
Quantum Safe transformation is emerging as a critical strategic priority for financial institutions, though most organisations are still in relatively early stages of structured execution. This session shares HSBC’s experience in evolving its Quantum Safe journey from a collection of early initiatives into a structured enterprise programme designed for long-term migration.
As a global financial institution operating across complex technology landscapes, HSBC recognised that successful cryptographic transformation requires more than identifying vulnerable algorithms or testing new technologies — it requires alignment across business priorities, technology domains, governance structures, third-party ecosystems, operational processes, and future investment decisions. The session explores how HSBC approached this transition by consolidating existing insights, validating readiness, strengthening alignment across stakeholders, and creating the foundations for the next stage of execution: moving from awareness and experimentation into an enterprise transformation mindset, strengthening board-level visibility, and building the governance, ownership, and execution model needed for a multi-year journey.
Rather than focusing only on technology change, this session highlights the organisational and strategic lessons behind scaling Quantum Safe adoption in a large financial institution.
55 min
Blue hall
To be announced
Session details will be announced soon.
55 min
Room a
PQC Regulation and Guidance Globally
Z
Zygmunt Lozinski
Quantum Safe Networks, IBM
PQC guidance varies by country and by industry. Some countries publish short policy papers, others provide detailed cryptographic recommendations, and even PQC migration handbooks. We are also seeing the development of sovereign PQC algorithms and standards. This tutorial gives an overview of the PQC and cryptographic guidance that is currently available, highlights common themes, and identifies significant differences.
Designed for managers and technical architects planning for PQC migration, especially those working in multinational organizations. It is also suitable for policy makers and regulators to help them understand the changing global landscape, and developers of cryptographic products and services will also benefit.
105 min
11:45
Plenary
Prioritising Financial Sector Use-Cases for Migration
S
Sarah McCarthy
SVP Cryptography, Citi
Sudha Iyer
Chief Engineer - PKI & Cryptography, Citi
The intricate web of interbank communications, transaction protocols, and shared infrastructure means no single financial institution can effectively navigate a successful Post-Quantum Cryptography (PQC) migration alone. The Quantum Safe Financial Forum (QSFF) was launched by Europol in 2024 and quickly established itself as the go-to authority for financial institutions grappling with the complexities of quantum-safe migration. The forum comprises experts from leading commercial banks, central banks, regulators and other financial entities.
A dedicated Working Group within QSFF is actively developing an aligned roadmap: precisely defining the scope of each “use-case” for PQC implementation, establishing criteria for evaluating and prioritizing those use-cases, linking business contexts to the CIA triad, identifying concrete milestones, and balancing dependencies to ensure a synchronized rollout.
This talk provides an overview of the Working Group’s structure, its deliverables to date, planned next steps, and practical ways in which the audience can contribute to this vital initiative.
45 min
Blue hall
To be announced
Session details will be announced soon.
45 min
12:30
Lunch 90 min
14:00
Plenary
Beyond the Handshake: Enhancing PKI with Out-of-Band Key Agreement
Michele Mosca
CEO, evolutionQ Inc.
Post-quantum cryptography (PQC) migration is accelerating, but it also exposes a deeper reality: cryptography can no longer be treated as a one-time design choice embedded in protocols. As standards evolve, organizations must prepare for a future where multiple cryptographic assumptions coexist and continuously change, while advances in automation and AI shrink the window to respond to emerging cryptographic risks.
This talk introduces Out-of-Band (OOB) Key Agreement as a practical way to enhance PKI, establishing an independent cryptographic control layer that complements existing protocols such as TLS and IPsec. Rather than replacing in-band key exchange, OOB mechanisms derive additional authenticated symmetric keys through a separate, policy-governed channel rooted in PKI identity, enabling organizations to introduce new cryptographic methods, rotate algorithms, and respond to emerging threats without requiring changes to application or transport layers.
In this model, PKI evolves from a foundational trust anchor into a central orchestrator of cryptographic policy and lifecycle management across multiple key establishment channels, enabling both resilience through diversity and operational simplicity in a post-quantum world.
25 min
Blue hall
To be announced
Session details will be announced soon.
25 min
Room a
To be announced
Session details will be announced soon.
25 min
Room b
To be announced
Session details will be announced soon.
25 min
Room c
To be announced
Session details will be announced soon.
25 min
Room d
To be announced
Session details will be announced soon.
25 min
Room e
To be announced
Session details will be announced soon.
25 min
14:30
Plenary
To be announced
Session details will be announced soon.
30 min
Blue hall
To be announced
Session details will be announced soon.
30 min
Room a
To be announced
Session details will be announced soon.
30 min
Room b
To be announced
Session details will be announced soon.
30 min
Room c
To be announced
Session details will be announced soon.
30 min
Room d
To be announced
Session details will be announced soon.
30 min
Room e
To be announced
Session details will be announced soon.
30 min
15:00
Break 30 min
15:30
Plenary
To be announced
Session details will be announced soon.
40 min
Blue hall
To be announced
Session details will be announced soon.
40 min
16:15
Plenary
Collaborative Efforts to Support Migration to PQC
William Newhouse
Cybersecurity Engineer & Migration to PQC Project Lead, NIST NCCoE
Bruno Couillard
CEO & Co-Founder, Crypto4A
Ted Shorter
Chief Technology Officer, Keyfactor
Evgeny Gervis
CEO, SafeLogic
A panel discussion that shares examples of how over 55 different organizations have collaborated within the NCCoE Migration to PQC project — using cryptographic visibility to support risk management decisions for migration actions, and performing demonstrations using PQC for interoperability and benchmarking to inform PKI system owners on starting to use PQC algorithms.
Bill Newhouse, the NCCoE Migration to PQC lead, moderates a panel of collaborators who have been working on implementing PQC algorithms in PKI systems (such as the US Government PIV card).
40 min
Blue hall
To be announced
Session details will be announced soon.
40 min
17:00
Plenary
Conference closing
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
The chairs bring the conference to a close with key takeaways, a call to
action, and what comes next for the PKI Consortium’s PQC work.
5 min
17:05
End of day three — thank you for joining us!
08:00
Registration 60 min
09:00
Welcome back — Day 3
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Final day framing: what is ahead, and how to make the most of the
last day before heading back into the real world.
5 min
Welcome back — Day 3
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Parallel welcome and agenda highlights for the blue hall audience.
5 min
09:05
Towards Coordinated Quantum Security in the Financial Sector: Risks, Priorities, and a Framework for Market Action
Jaime Gómez García
Global Head of Cryptography and Quantum Threat Program, Santander Digital Services
The transition to quantum security in the financial sector is not only a technological undertaking, but also a coordination challenge for a highly interconnected global ecosystem. Misaligned transition efforts may create operational risks, including interoperability tensions across markets, infrastructures, and jurisdictions, prolonged reliance on quantum-vulnerable cryptography, inefficient duplication of effort, and ecosystem fragmentation.
To address these risks, the Europol Quantum Safe Financial Forum, in collaboration with FS-ISAC and CFDIR, has proposed an operational framework for coordinated action. The framework focuses on identifying and prioritising critical use cases, structuring the transition through shared implementation waves, and defining three use-case-specific milestones to align sequencing and execution.
This session examines that prioritisation framework and provides an update on the state of quantum security in the financial sector — relevant not only to financial sector professionals, but to the wider community as an early example of ecosystem-wide coordination and its associated challenges.
25 min
To be announced
Session details will be announced soon.
25 min
09:35
To be announced
Session details will be announced soon.
40 min
To be announced
Session details will be announced soon.
40 min
10:15
Break 30 min
10:45
Scaling Quantum Safe: How HSBC Transitions from Early Momentum to Enterprise Execution
Antti Ropponen
Executive Partner, Quantum Safe Transformation Services, IBM
Quantum Safe transformation is emerging as a critical strategic priority for financial institutions, though most organisations are still in relatively early stages of structured execution. This session shares HSBC’s experience in evolving its Quantum Safe journey from a collection of early initiatives into a structured enterprise programme designed for long-term migration.
As a global financial institution operating across complex technology landscapes, HSBC recognised that successful cryptographic transformation requires more than identifying vulnerable algorithms or testing new technologies — it requires alignment across business priorities, technology domains, governance structures, third-party ecosystems, operational processes, and future investment decisions. The session explores how HSBC approached this transition by consolidating existing insights, validating readiness, strengthening alignment across stakeholders, and creating the foundations for the next stage of execution: moving from awareness and experimentation into an enterprise transformation mindset, strengthening board-level visibility, and building the governance, ownership, and execution model needed for a multi-year journey.
Rather than focusing only on technology change, this session highlights the organisational and strategic lessons behind scaling Quantum Safe adoption in a large financial institution.
55 min
To be announced
Session details will be announced soon.
55 min
Tutorial
PQC Regulation and Guidance Globally
Z
Zygmunt Lozinski
Quantum Safe Networks, IBM
PQC guidance varies by country and by industry. Some countries publish short policy papers, others provide detailed cryptographic recommendations, and even PQC migration handbooks. We are also seeing the development of sovereign PQC algorithms and standards. This tutorial gives an overview of the PQC and cryptographic guidance that is currently available, highlights common themes, and identifies significant differences.
Designed for managers and technical architects planning for PQC migration, especially those working in multinational organizations. It is also suitable for policy makers and regulators to help them understand the changing global landscape, and developers of cryptographic products and services will also benefit.
105 min
11:45
Prioritising Financial Sector Use-Cases for Migration
S
Sarah McCarthy
SVP Cryptography, Citi
Sudha Iyer
Chief Engineer - PKI & Cryptography, Citi
The intricate web of interbank communications, transaction protocols, and shared infrastructure means no single financial institution can effectively navigate a successful Post-Quantum Cryptography (PQC) migration alone. The Quantum Safe Financial Forum (QSFF) was launched by Europol in 2024 and quickly established itself as the go-to authority for financial institutions grappling with the complexities of quantum-safe migration. The forum comprises experts from leading commercial banks, central banks, regulators and other financial entities.
A dedicated Working Group within QSFF is actively developing an aligned roadmap: precisely defining the scope of each “use-case” for PQC implementation, establishing criteria for evaluating and prioritizing those use-cases, linking business contexts to the CIA triad, identifying concrete milestones, and balancing dependencies to ensure a synchronized rollout.
This talk provides an overview of the Working Group’s structure, its deliverables to date, planned next steps, and practical ways in which the audience can contribute to this vital initiative.
45 min
To be announced
Session details will be announced soon.
45 min
12:30
Lunch 90 min
14:00
Beyond the Handshake: Enhancing PKI with Out-of-Band Key Agreement
Michele Mosca
CEO, evolutionQ Inc.
Post-quantum cryptography (PQC) migration is accelerating, but it also exposes a deeper reality: cryptography can no longer be treated as a one-time design choice embedded in protocols. As standards evolve, organizations must prepare for a future where multiple cryptographic assumptions coexist and continuously change, while advances in automation and AI shrink the window to respond to emerging cryptographic risks.
This talk introduces Out-of-Band (OOB) Key Agreement as a practical way to enhance PKI, establishing an independent cryptographic control layer that complements existing protocols such as TLS and IPsec. Rather than replacing in-band key exchange, OOB mechanisms derive additional authenticated symmetric keys through a separate, policy-governed channel rooted in PKI identity, enabling organizations to introduce new cryptographic methods, rotate algorithms, and respond to emerging threats without requiring changes to application or transport layers.
In this model, PKI evolves from a foundational trust anchor into a central orchestrator of cryptographic policy and lifecycle management across multiple key establishment channels, enabling both resilience through diversity and operational simplicity in a post-quantum world.
25 min
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
To be announced
Session details will be announced soon.
25 min
14:30
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
To be announced
Session details will be announced soon.
30 min
15:00
Break 30 min
15:30
To be announced
Session details will be announced soon.
40 min
To be announced
Session details will be announced soon.
40 min
16:15
Panel discussion
Collaborative Efforts to Support Migration to PQC
William Newhouse
Cybersecurity Engineer & Migration to PQC Project Lead, NIST NCCoE
Bruno Couillard
CEO & Co-Founder, Crypto4A
Ted Shorter
Chief Technology Officer, Keyfactor
Evgeny Gervis
CEO, SafeLogic
A panel discussion that shares examples of how over 55 different organizations have collaborated within the NCCoE Migration to PQC project — using cryptographic visibility to support risk management decisions for migration actions, and performing demonstrations using PQC for interoperability and benchmarking to inform PKI system owners on starting to use PQC algorithms.
Bill Newhouse, the NCCoE Migration to PQC lead, moderates a panel of collaborators who have been working on implementing PQC algorithms in PKI systems (such as the US Government PIV card).
40 min
To be announced
Session details will be announced soon.
40 min
17:00
Conference closing
Paul van Brouwershaven
Chair PKI Consortium and CEO of Digitorus
Albert de Ruiter
Vice Chair PKI Consortium and Policy Authority PKI Dutch Government (Logius)
Sven Rajala
Vice Chair, PQC Working Group, PKI Consortium and International PKI Man of Mystery, Keyfactor
The chairs bring the conference to a close with key takeaways, a call to
action, and what comes next for the PKI Consortium’s PQC work.
5 min
17:05
End of day three — thank you for joining us!
For further information, contact the PKI Consortium at contact (at) pkic.org.
