Quantum-safe PKI for the German administration
summary
BSI runs the German administration PKI (VPKI) currently using RSA‑4096 and plans a parallel migration starting ~2025 with optimistic completion ~2035. Candidates: XMSS or LMS (stateful hash‑based) for root CA because signature+key sizes approach current ~1 KB, SPHINCS+ and Dilithium increase certificates to ~14.5 KB and ~5.5 KB respectively in hybrid mode with ECDSA. Proposed build uses a Merkle‑tree ladder on HSM0 plus LMS trees on HSM1/HSM2 for backups, but HSM lifetimes and the ban on private‑key export break the 10 years availability requirement.
AI-written summary · about
chapters (8)
- 0:00Introduction and project overview
- 1:30Current PKI infrastructure
- 4:26Choosing post-quantum schemes
- 9:30Performance and comparisons
- 11:52Root CA and backup management
- 15:59Hybrid mode and migration
- 18:51Migration timeline and conclusion
- 20:56Q&A session
related talks
46mAchieving Quantum Readiness: A Comprehensive Approach
28mMixed Certificate Chains for the Transition to Post Quantum Authentication in PKI
13mNavigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools
26mCrypto-Agile PKI: A Strategic Blueprint for Post-Quantum Trust
32mCybersecurity in Post Quantum Era
36mPost-Quantum Cryptography for Digital Signing
34mArchitecting PKI Hierarchies for Graceful PQ Migration
24mTransitioning to Post-Quantum Cryptography in IAM