Architecting PKI Hierarchies for Graceful PQ Migration

on YouTube ↗34m

" summary

Argues that migration is a toolbox not one solution: Flag Day (switch everything at once) is simplest but rarely possible; staged migrations use hybrids, mixed PKIs, or parallel PKIs depending on control and protocol type. Recommends hash-based roots for extreme longevity, hybrids or composites at issuing CAs for throughput tradeoffs, and pure PQ or smaller keys at end entities for bandwidth. Notes CMS already supports hybrid signatures, related-certificate-descriptor (RCD) enables discovery by URL, altSubjectAltPublicKeyInfo is an x509 2019 extension, and composites uniquely provide one atomic signature and hybrid encryption.

AI-written summary · about

" chapters (21)

1. 0:00Welcome
2. 1:06PKI migration challenges
3. 2:30Migration toolbox and algorithms
4. 4:15Government regulations and hybrid algorithms
5. 6:00Long-term data security
6. 7:25Migration strategies: Flag Day vs staged
7. 8:28Mixed PKI hierarchies
8. 9:52Parallel PKIs and dual certificates
9. 12:45Hybrid security and dual signatures
10. 13:47Composite keys for hybrid crypto
11. 16:57Toolbox recap and deployment
12. 18:25Q&A on tools and standards
13. 19:53Link certificates and discovery
14. 22:02Embedded systems and timelines
15. 24:11Migration toolbox completeness
16. 25:12Migration pain scale
17. 27:20Shortening RSA key lifetimes
18. 29:04Mixed root and intermediate CA
19. 31:13Hybrid compatibility and scalability
20. 32:39Algorithm selection guidance
21. 33:43Post-quantum readiness

" related talks

• 38mPKI deployments are as unique as any snowflake; how to build equally flexible PQ migration strategieGreg Wetmore · Post-Quantum Cryptography Conference Amsterdam 2023
• 24mTransitioning to Post-Quantum Cryptography in IAMUdara Pathum · Post-Quantum Cryptography Conference 2025
• 32mand Signatures – no Problem?Jan Klaußner · Post-Quantum Cryptography Conference Amsterdam 2023
• 26mFrom Inventory to Action: Navigating the Next Phase of PQC TransitionBruno Couillard · Post-Quantum Cryptography Conference 2025
• 26mA structured approach to the quantum safe transformationEfstathia Katsigianni · Post-Quantum Cryptography Conference 2025
• 26mCrypto-Agile PKI: A Strategic Blueprint for Post-Quantum TrustGanesh Mallaya · Post-Quantum Cryptography Conference 2025
• 20mHybrid Approach for quantim safe PKI Development for Organizations HAPKIDOGabriele Spini · Post-Quantum Cryptography Conference Ottawa 2023
• 24mPKI Agility and the Difference to Cryptographic Agility: Lessons from the Past and PresentMichael Osborne · Post-Quantum Cryptography Conference 2025