Implementing Post Quantum algorithms in PKCS #11
summary
PKCS #11 3.2 adds explicit encapsulate/decapsulate and verify signature calls, mechanism IDs for MLKM, MLDDSA, SLDSA and XMSS, and a per-key parameter set plus optional CKA_SEED for seed-based private keys; MU (external prehash) is deferred to 3.3. Implementations use existing PQ libraries (LIOQS, Krux or vendor snapshots) rather than homegrown code because lattice algorithms have challenging side‑channel risks. NSS patches demonstrate how to map PKCS #11 parameters to underlying libs and how to support legacy vendor extensions via the vendor namespace.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:28Postquantum algorithm challenges
- 3:34Key exchange transformations
- 6:00Signature challenges
- 7:04Implementation difficulties
- 9:54PKCS#11 vendor extensions
- 11:17PKCS#11 3.2 changes
- 13:23Key parameters and seed handling
- 16:02Signature mechanisms
- 18:34Verify signature in PKCS#11
- 21:47Encapsulate/decapsulate examples
- 25:22PKCS#11 3.2 status
- 26:46Summary
related talks
13mNavigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools
55mMaking PQ Signatures work in the WebPKI
36mPost-Quantum Cryptography for Digital Signing
58mPQC Integration in HSMs: From Standards to Strategy
59mPost-quantum cryptography for .NET developers
46mFrom Theory to Practice: Real-World Lessons in Post-Quantum Cryptography Migration
23mHybrid PQC Digital Signatures and SSI
51mJava and Post-Quantum Cryptography