Mixed Certificate Chains for the Transition to Post Quantum Authentication in PKI
summary
Proposes a migration that uses XMSS at root + ECDSA intermediate then replaces ECDSA with lattice schemes, implements it in TLS 1.3 using wolfSSL and Kyber integration, and measures notebook vs Raspberry Pi with servers in West Europe, US East and Australia. Results show median time-to-first-byte rises ~12% (notebook) and ~14% (embedded), certificate-chain growth e.g. +3.3 KB for XMSS+ECDSA and +6 KB for XMSS+Falcon, a worst case of ~47 KB chain for SPHINCS+ speed variant 17KB signatures, and a single XMSS sign taking ~3.5 s on Raspberry Pi; XMSS+Dilithium outperforms EC on the embedded handshake but increases RAM/stack usage.
AI-written summary · about
chapters (7)
- 0:00Post-quantum PKI research intro
- 1:54Speaker background
- 4:23Why post-quantum auth matters
- 7:13Mixed certificate chains strategy
- 10:47TLS 1.3 integration setup
- 16:18Experimental results
- 25:59Conclusion
related talks
44mPost-quantum cryptography migration strategy for cloud services
28mQuantum-safe PKI for the German administration
35mThe internet is ready for some PQC certificates
30mCoping with post-quantum signatures in the WebPKI
26mCrypto-Agile PKI: A Strategic Blueprint for Post-Quantum Trust
46mAchieving Quantum Readiness: A Comprehensive Approach
36mPost-Quantum Cryptography for Digital Signing
13mNavigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools