IAB PQ Workshop
IAB Workshop on Accelerating the Deployment of Post-Quantum Authentication (pqws)
Welcome to IAB PQ Workshop
This is the webpage for the IAB Workshop on Accelerating the Deployment of Post-Quantum Authentication (pqws).
🏛️ Workshop Venue
There will be two different venues in Prague. The IAB thanks the Czech Technical University and Cisco Systems for generously offering us their space.
Sunday, 11 Oct
Faculty of Information Technology, Czech Technical University.
Thákurova 7, 160 00 Praha 6, Czechia.
📍Map. 🗺️ Street View.
The venue is within walking distance of the OpenSSL Conference location..
Monday, 12 Oct
Cisco Systems Prague office.
Pujmanové 1753/10a 140 00 Praha 4-Nusle Czechia.
The office is readily accessible by public transport. The nearest metro station is Pankrác on Line C, approximately a six-minute walk from the office..
🍽️ Lunch on Monday is not provided (12:40–13:40). Arkády Pankrác, the shopping centre at the Pankrác metro exit, is two minutes from the office and has a food court and several restaurants (Czech, Vietnamese, sushi, salads, bakery). Please be back by 13:40.
🗄️ Format
Two full days of discussion-focused sessions grouped broadly by topic. Sessions will have a moderator from the PC and will be organized as either a panel discussion with audience participation or a set of short presentations (10 min each) followed by a longer technical discussion.
Day 1 (Sunday) is at the Czech Technical University – in person only, Chatham House rule applies, which means you may use the information shared, but must not reveal who said it or their affiliation. Day 2 (Monday) is at Cisco Systems in Prague – with remote participants
📋 Agenda
Sunday, 11 October
09:00–09:30 — Welcome and introductions
Arrivals, welcome and participant introductions.
09:30–10:50 — National ID and Digital Identity
| Time | Duration | Session | Affiliation |
|---|---|---|---|
| 09:30 | 10 min | Post-quantum authentication for digital identity services in the cloud (slides) | UK Government Digital Service |
| 09:40 | 10 min | Accelerating the Deployment of Post-Quantum Authentication (slides) | D-Trust |
| 09:50 | 60 min | Discussion: National ID domain |
10:50–11:20 — Break
11:20–13:20 — Performance and Embedded Systems
| Time | Duration | Session | Affiliation |
|---|---|---|---|
| 11:20 | 10 min | Making Post-Quantum Authentication Fit in Embedded Stacks (slides) | PQShield |
| 11:30 | 10 min | Beyond Algorithm Choice: Initial Lessons from Preparing a Large Cloud Proxy Service for Post-Quantum Authentication (slides) | Zscaler |
| 11:40 | 10 min | Per-record ML-DSA-65 in a synchronous write path (slides) | Aleutian AI |
| 11:50 | 90 min | Discussion: Performance and Embedded domain |
13:20–14:20 — Lunch
14:20–16:30 — Code Signing, Keys and Hardware
| Time | Duration | Session | Affiliation |
|---|---|---|---|
| 14:20 | 10 min | Package Signing with Post-Quantum Cryptography (slides) | GitHub/NPM |
| 14:30 | 10 min | Challenges in adopting post-quantum (slides) | Siemens |
| 14:40 | 10 min | From Signature Generation to Operational Verification: Deployment Lessons from Hybrid Post-Quantum Software Signing in CI/CD (slides) | Facti |
| 14:50 | 70 min | Discussion: Code-signing domain | |
| ~16:00 | 10 min | Keys, Hardware, and Software/Firmware Signing | Crypto4A (moved: speaker arriving from the airport) |
| 16:10 | 20 min | Discussion continues |
16:30–17:00 — Wrap-up
Closing summary and discussion.
End of Day 1: 17:00
Monday, 12 October
08:30–09:00 — Arrivals and welcome
09:00–11:10 — Network Layer and DNS
| Time | Duration | Session | Affiliation |
|---|---|---|---|
| 09:00 | 10 min | How Merkle Trees Can Help Address Post-Quantum DNSSEC (and Other) Challenges (slides) | Verisign |
| 09:10 | 10 min | Post-Quantum Login and Authentication Problems in SD-WAN (slides) | Cisco |
| 09:20 | 10 min | Post-Quantum Authentication for BGPsec/RPKI, SRv6, and Agentic AI NetOps in Carrier Networks (slides) | Cisco |
| 09:30 | 10 min | PQ Authentication in Optical Transport Networks: Deployment Experience and Open Questions (slides) | Adva Network Security |
| 09:40 | 90 min | Discussion: Network Layer and DNS |
11:10–11:40 — Break
11:40–12:40 — MTC/PLANTS Roundtable
A discussion-focused roundtable bringing together perspectives on Merkle Tree Certificates, PLANTS and related approaches.
Participating affiliations include:
TrustAsia, Let’s Encrypt, Keyfactor, Chainguard, Google/Chromium (links go to the position papers)
12:40–13:40 — Lunch (on your own; see the venue notes above for options by Pankrác metro)
13:40–15:00 — Web TLS
| Time | Duration | Session | Affiliation |
|---|---|---|---|
| 13:40 | 10 min | Post-Quantum Authentication for the Web (slides) | Google/Chromium |
| 13:50 | 10 min | TLS Preflight: smaller, faster and more private handshakes (slides) | Mozilla |
| 14:00 | 60 min | Discussion: Web TLS |
15:00–15:30 — Break
15:30–17:50 — Enterprise Deployment and Root Migration
| Time | Duration | Session | Affiliation |
|---|---|---|---|
| 15:30 | 10 min | Post Quantum Authentication at Netflix (slides) | Netflix |
| 15:40 | 10 min | Post-Quantum Authentication in Enterprise and Mobile Networks (slides) | Nokia / University of the Bundeswehr Munich |
| 15:50 | 10 min | Post-Quantum Authentication: Preparing Digital Identity for the Quantum Era (slides) | Entrust |
| 16:00 | 10 min | Cross-signed Cert Transition Challenges (slides) | AWS / OpenSSL |
| 16:10 | 10 min | Lessons from a Decade of Post-Quantum Authentication (slides) | Ericsson |
| 16:20 | 90 min | Discussion: Enterprise Root Migration |
17:50–18:20 — Wrap-up
Closing summary and discussion.
End of Day 2: 18:20
📌 Tips for the Presenter & Attendees
-
We encourage open and robust discussions, but we also expect participants to be respectful of one another. We have all taken time from our busy schedules to attend this event to discuss this important topic together. Professionalism and respect are important so we can maximize the value of our time together. As noted on the workshop page, the IETF code of conduct, and the IETF anti-harassment policy will apply. Let’s also have some fun :-)
- Presenters: please send your slides in advance to pq-workshop-pc@iab.org. No laptop-and-HDMI roulette on the day. If you want to make last minute changes (discouraged), please create a datatracker account to make it easier on your session chair.
- Everyone: read the papers for your sessions and come with the hard questions and points to discuss.
- Join the Slack channel: pqauthiabworkshop.slack.com, if you don’t have an invite, please let us know.
🔗 Useful Links
- 📄 CFP @ Datatracker
- 📚 Accepted Papers 🗜️ Tarball
- 💡 Details about IAB Workshops
- ✍️ Blog
- ✉️ Mailing List
- 🖐 Slack
👥 Program Committee
- Nick Sullivan (Cryptography Consulting LLC/IAB)
- Yaroslav Rosomakho (Zscaler/IAB)
- Suresh Krishnan (Cisco/IAB)
- Thom Wiggers (PQShield)
- Mike Ounsworth (Cryptic Forest Software)
- Hoss Shafagh (Netflix)
- Vladimir Soukharev (Keyfactor)
- Tim Hollebeek (DigiCert)
- Murugiah Souppaya (HP)
- Reach us at pq-workshop-pc@iab.org