IAB Workshop on Accelerating the Deployment of Post-Quantum Authentication (pqws)

Dennis Jackson (Mozilla)

Post-quantum (PQ) cryptography makes TLS handshakes substantially larger [1]. Merkle Tree Certifi-
cates (MTCs) [2] shrink the certificate chain. KEMTLS [3] goes further by replacing the handshake
signature with a much smaller KEM ciphertext, but requires invasive changes to the TLS state machine,
which have proven a barrier to deployment. Meanwhile, Encrypted Client Hello (ECH) [4] would
further inflate TLS handshake size if it were naively switched to PQ primitives.

TLS Preflight aims to address the issues blocking deployment of KEMTLS and PQ ECH. It achieves size
reductions similar to KEMTLS while being much easier to implement, and brings PQ security to ECH
without inflating the handshake. It also lets clients make zero round-trip (0-RTT) connections on their
very first contact with a server, which TLS 1.3 cannot do today, cutting latency on first connections

Slides for the Sunday 11 October 14:40 talk in the Code Signing, Keys and Hardware session: From Signature Generation to Operational Verification: Deployment Lessons from Hybrid Post-Quantum Software Signing in CI/CD (Rafael Lucas Silva, Luiz Otavio Duarte, Larissa de Oliveira Figueira, Facti).

Jaypal Baviskar, Afshan Mulla (Cisco)

Position. SD-WAN is the hardest place in the enterprise to deploy post-quantum authentication, and it is where the consequences of getting it wrong are largest. Three things combine.

First, every SD-WAN router proves who it is over DTLS on UDP, where one lost datagram forces the whole handshake flight to be sent again and post-quantum
certificates turn a 4-datagram handshake into a 36-datagram one.

Second, SD-WAN runs on the diverse links available: broadband, LTE and satellite, exactly where loss and delay are highest.

Third, SD-WAN does not use IKE. Data-plane encryption keys are generated by each router and distributed by the controller over that same control connection, so the security of every tunnel in the fabric rests on one certificate exchange.

This paper shows that with the algorithm CNSA 2.0 mandates, only about a third of control-connection attempts on a 3%-loss circuit would complete without
retransmission, against nine in ten today. We propose three fixes that need no new cryptography.

Jaypal Baviskar, Afshan Mulla (Cisco)

Position. The carrier control plane - BGPsec/RPKI route validation, SRv6 network programming, and increasingly autonomous agentic AI NetOps actions - is the least-examined post-quantum authentication deployment surface, because nearly all public discussion is framed around TLS and the Web PKI. Three things combine.

First, ML-DSA and SLH-DSA signatures are one to two orders of magnitude larger than the classical mechanisms they replace, and carrier infrastructure - sub-second BGP convergence, hard per-packet MTU ceilings, embedded route-processor crypto - was not built around that.

Second, each surface hits a different wall for the same underlying reason: BGPsec/RPKI signs per hop and per certificate, SRv6 carries a fixed 16-byte segment identifier in every packet, and agentic NetOps needs an action to be verifiable offline, potentially years later, by an auditor who was never in the session.

Third, all three can be addressed the same way: aggregate the signature, don’t multiply it.

This paper shows that is not just a proposal. Aggregating real RPKI certificates - from a single certificate up to 996,690, the practical scale of today’s global RPKI dataset - into a single ML-DSA-65-signed Merkle root reduces total signature overhead by up to 830,951.7x versus signing each certificate individually, with signing time flat at 9–12 ms regardless of batch size (Table 1). We propose extending the same aggregate-don’t-multiply principle to SRv6 and agentic NetOps, and raise where each needs the workshop’s input.

GOV.UK One Login is the central authentication and identity proofing system used by over 200 public-facing government services in the UK. It supports tens of millions of users and makes heavy use of cryptography within a serverless architecture running on AWS. Authentication is implemented across many layers, including internal and external OAuth interfaces and verifiable credentials (VCs), both of which are secured using JOSE. Given the central role it plays in providing citizens with access to a broad range of government services, a smooth migration to post-quantum authentication is necessary to maintain the required level of security and trust in the system.

Slides for the Sunday 11 October 09:30 talk in the National ID and Digital Identity session: Post-quantum authentication for GOV.UK One Login (Francis Lewis, Jess Winterborne, UK Government Digital Service).

Slides for the Sunday 11 October 09:40 talk in the National ID and Digital Identity session: Accelerating the Deployment of Post-Quantum Authentication (Jan Klaussner, D-Trust / Bundesdruckerei).

Zoey Wang (TrustAsia Technologies). Position paper for the Monday 12 October 11:40 MTC/PLANTS roundtable. End-to-end MTC test deployment in the CQRP validation realm: ACME, Issuance Logs, Mirror cosigning, TLS credential selection, X.509 fallback, Chrome Canary validation; proposes a cross-component interoperability testing framework.

Zayn Lohit (Chainguard). Position paper for the Monday 12 October 11:40 MTC/PLANTS roundtable. The software side of ML-DSA certificates works end to end; no public CA issues them and no managed load balancer terminates one. Asks for a public test ACME server and one managed load balancer in beta.

Aaron Gable, Josh Aas et al. (Let's Encrypt / Internet Security Research Group). Position paper for the Monday 12 October 11:40 MTC/PLANTS roundtable. Lessons from implementing and deploying a Merkle Tree Certification Authority: single-homed services, linting, public key storage, and open problems.

Francis Lewis, Jess Winterborne (UK Government Digital Service, Department for Science, Innovation and Technology). Position paper for the Sunday 11 October 09:30 slot in the National ID and Digital Identity session. GOV.UK One Login: PQC trials, transport constraints within AWS when using OAuth 2.0, and coordination challenges.

Chairs welcome deck for Monday 12 October at Cisco: Day 1 recap, remote participation rules, format, Day 2 agenda with chairs, logistics, report timeline, closing questions.

Chairs welcome deck for Sunday 11 October at CTU: why we are here, Chatham House rule, code of conduct, format, Day 1 agenda with chairs, logistics, introductions, wrap-up questions.

Slides for the Monday 12 October 09:30 talk in the Network Layer and DNS session: PQ Authentication in Optical Transport Networks: Deployment Experience and Open Questions (Ciaran Mullan, Richard Zink, Adva Network Security).

Swapneel Sheth (Verisign). Final version supplied by the authors for publication. Position paper for the Monday 12 October 09:00 slot in the Network Layer and DNS session.

Slides for the Monday 12 October 15:50 talk in the Enterprise Deployment and Root Migration session: Post-Quantum Authentication: Preparing Digital Identity for the Quantum Era (John Gray, Entrust).

Slides for the Monday 12 October 09:00 talk in the Network Layer and DNS session: How Merkle Trees Can Help Address Post-Quantum DNSSEC (and Other) Challenges (Swapneel Sheth, Verisign).

Slides for the Sunday 11 October 11:40 talk in the Performance and Embedded Systems session: Per-record ML-DSA-65 in a synchronous write path (John Interlante, Aleutian AI).

Slides for the Sunday 11 October 14:30 talk in the Code Signing, Keys and Hardware session: Challenges in adopting post-quantum (Florian Oprea, Alexander Railean, Hendrik Brockhaus, Siemens).

Luis Chan (PQShield)

The increased key and signature sizes of post-quantum schemes have made resource costs a central
concern in bringing them to constrained platforms. While optimised implementations help make the
primitives practical, the same large objects must also pass through the middleware that turns them
into firmware or device authentication. Consider a Zephyr-based product using MCUboot for firmware
authentication, Mbed TLS for certificate-based communications, and PSA with TF-M for cryptographic
services and isolation.1 These components provide the interfaces, formats and tools on which the product
depends. The constraints driving primitive optimisation must therefore also shape the middleware and
authentication designs built around it.

David Benjamin (Google/Chromium)

This document discusses a roadmap for post-quantum HTTPS authentication on the Web. It covers:
● The choice of post-quantum certificate construction
● The server capabilities necessary to deploy post-quantum certificates
● The challenges in providing meaningful security from the transition

John Preuß Mattsson et al. (Ericsson)

Ericsson began its PQC migration project in 2015. From the outset, authentication has been a major part. This position paper distills a decade of research and development into concrete recommendations: avoid stateful signatures and unnecessary complexity; prefer SHA-3; standardize seed-only private-key formats; prefer hedged signatures; avoid floating-point arithmetic; recognize practical quantum attacks on symmetric cryptography are a misconception; and treat composite signatures with caution because of their malleability and compliance risks. Internal benchmarking shows that ML-DSA and SLH-DSA meet telecom performance requirements and are the only sufficiently mature options for the 2030–2031 migration deadlines. Constrained IoT systems, however, still require lightweight KEM- and NIKE-based authentication that current standardized PQC algorithms do not provide.

Tirumaleswar Reddy.K, Hannes Tschofenig (Nokia / Univ. Bundeswehr Munich)

Most work on post-quantum (PQ) authentication has focused on the Web. Enterprise and mobile networks have different deployment constraints, and those constraints change what determines the pace of migration. In these networks, migration has a long, largely sequential critical path. Cryptographic modules must first support the new algorithms, products must integrate those modules, and the resulting implementations need to be validated or certified before deployment. Only then can new credentials be issued and rolled out across manufacturer and operator certificate hierarchies. The migration therefore cannot complete faster than the slowest of these steps.

This paper makes five observations:
1. Manufacturing and trust-anchor decisions create migration gates that protocols cannot remove.
2. Post-quantum readiness varies by device class.
3. The credential scheme affects long-term crypto-agility.
4. Large PQ credentials expose transport reliability problems, not merely latency problems.
5. The security benefit of PQ authentication arrives only when traditional authentication can be rejected

John Interlante (Aleutian AI)

Since March 2026 we have operated a system that captures AI system interactions—
including model calls, tool invocations, retrievals, and human approvals—as append-only
hash chains scoped by tenant and region. Every entry is signed synchronously at ingest
with ML-DSA-65 (FIPS 204) through Google Cloud KMS, while record content is encrypted
using keys established with ML-KEM-768 (FIPS 203). The design requirement that drove
these choices is long-term independent verification: a record must remain verifiable offline
without trusting Aleutian or requiring access to the original application infrastructure. For
evidentiary or compliance use cases, both the verification requirement and the underlying
evidence may outlive the originating system and may be subject to retention or legal holds
lasting seven years or more.

Jan Klaußner (D-Trust)

Hybrid authentication lets regulated infrastructures keep certified classical mechanisms while adding
quantum-resistant protection for long-lived data and credentials.

European authorities recommend or expect hybrid mechanisms for key establishment and
signatures in high-trust environments, including eID and trust services. For German TSPs and ID
card providers under eIDAS, hybrid PQ/T authentication is therefore the practical way to meet
current quantum-security expectations.

Bundesdruckerei and D-Trust participate in national and European projects on hybrid-capable PKIs
and protocols, including PoQuID (quantum-secure passports and IDs), FLOQI (Post-Quantum PKI)
and QSPECTRE (Quantum Safe PQC Signatures and PKIs for TSPs). PoQuID results included
research to application-level key combiner published as PQ-EAC paper
(https://eprint.iacr.org/2023/352).

John Gray (Entrust)

We are a CA vendor and operator that provides authentication systems that have long
deployment lifecycles that span many years, and delayed action may result in significant
security, operational, and compliance challenges in the future. Organizations should
prioritize the transition to post-quantum authentication now rather than waiting for large-
scale quantum computers to become available.

Ciaran Mullan, Richard Zink (Adva)

Adva Network Security GmbH develops high-assurance encryptors for carrier and critical networks,
securing Layer-2 (IEEE 802.1AE MACsec) and OTN (ITU-T G.709). Products are long-lived (up to 20+
years), difficult to update remotely, and subject to national security certifications (e.g. BSI, FIPS), in
regulated deployments. As part of Adtran, Inc., we apply our cryptography expertise to carrier and
critical-infrastructure networking.

Our PQC migration is well underway. Data-in-transit has been protected with hybrid key establishment
(classical + PQC) since 2021 already including national security certification. The management plane (NET-
CONF, SSH, HTTPS, etc.) can follow as updated protocol stacks emerge. Our current PQC migration efforts
are focused on authentication.

We propose a talk covering the topics below, grounded in our real-world experience: what is working, the
engineering decisions and trade-offs we made, the mistakes we have made (and may still make), and the open
questions we are still dealing with.

Panos Kampanakis, Viktor Dukhovni (AWS/OpenSSL)

Cross-signed certificates have been used as a transition mechanism in PKI
for years. For example, when there is a new Certificate Authority (CA) that
needs time to proliferate through ecosystem Trust Stores, the CA is sometimes
cross-signed by an existing trusted CA in order to prevent outages with certifi-
cates issued by it. After the new CA certificate is established in Trust Stores,
then it can be used as-is and the cross-signed certificate becomes irrelevant.
Cross-signing could lead to overlapping certificate chains which authenticate
the same leaf certificate. This complexity has sometimes led to issues depend-
ing on which path the verifier picked when building the certificate chain.

Harpreet Singh, Yaroslav Rosomakho (Zscaler)

Post-quantum key establishment is already moving into deployment, but post-quantum authentication raises a
different set of operational challenges. This paper summarises several early lessons from preparing a large,
globally distributed cloud proxy service for migration to post-quantum authentication.

Our work has included evaluation of ML-DSA, SLH-DSA and composite signatures across multiple cryptographic
libraries and processor architectures, together with practical questions around key representation and
application integration. The measurements cover 34 signature algorithms, six cryptographic implementations
and eight hardware platforms.

Ian McDiarmid-Sterling, Srikanth Varadarajan, Hoss Shafagh, Jared Crawford (Netflix)

As part of Netflix’s mission to entertain the world, we are migrating to post-quantum cryptography
(PQC) to ensure the continued security and privacy of Netflix data. Our goal is to make this transition
seamless for our members, allowing them to continue watching their favorite content uninterrupted.
Netflix’s migration to PQC focuses on defending against two main threats:
1. Harvest-now-decrypt-later attacks, in which attackers collect long‑lived encrypted data today
to decrypt it later with a quantum computer.
2. Forge-later attacks, where attackers use quantum computing to forge authentication in
systems that rely on long-term trust.
This document will primarily address our efforts to mitigate forge-later attacks by deploying
post-quantum (PQ) authentication.

Zach Steindler (GitHub/npm)

Today, npm packages are signed by several services working together:
• A build system that supports workload identity via OIDC (predominately GitHub Actions, but also GitLab Pipelines, CircleCI, Buildkite, and others)
• The npm CLI runs inside the build system to request the OIDC token and send it to the Sigstore public good instance
• The Sigstore public good instance returns a signature over the binary with included software supply chain metadata (SLSA Build Provenance), together referred to as a “bundle”
• The package and the Sigstore bundle are sent to the npm registry

Bruno Couillard (Crypto4A)

I am the CEO and co-founder of Crypto4A Technologies, a Canadian developer of hardware
security and cryptographic infrastructure. I have been involved in the design and deployment of
HSM technology and cryptographic systems for more than three decades, including contributing
to PKCS#11 and working on cryptographic modernization within the Canadian government.

Rafael Lucas Silva, Luiz Otavio Duarte, Larissa de Oliveira Figueira (Facti)

Software supply chains rely extensively on digital signatures to establish the authenticity and integrity of packages,
releases, container images, manifests, and other artifacts. Unlike ephemeral authentication exchanges, software signatures
may need to remain verifiable offline or years after an artifact was originally produced.

We investigated post-quantum software signing through a practitioner-oriented DevSecOps implementation in GitLab
CI/CD. The pipeline combines Shift-Left security controls, deterministic artifact manifest generation, and hybrid
signature generation.