Real-World Readiness for PQC: Gaps, Gains, and Groundwork
summary
Migration is already practical for many stacks: OpenSSL 3.5 out of the box on recent distros plus Apache and curl deliver hybrid TLS key exchange and MLd‑DSA server auth for API and server-to-server use. Ten HSMs are tested and MLd‑DSA often outperforms RSA, but cloud HSMs can limit payloads and a 660 MB CRL (≈10 million revocations) breaks naive HSM pipelines, so tested 10 HSMs reveals gaps. Expect tooling hiccups (browser lacks MLd‑DSA, timestamp and CMS digest bugs) that require testing and upstream fixes.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:03PQC migration context
- 2:24Quantum readiness challenges
- 4:35PQC migration use cases
- 6:18PKI stack migration
- 8:48Signature sizes and CRL limits
- 10:36TLS migration with OpenSSL 3.5
- 13:25MLDSA in TLS authentication
- 14:36PQC API endpoints
- 15:59ACME certificate automation
- 17:24CMS signing and verification
- 18:08Timestamping limits in OpenSSL
- 18:51CNSA compliance adjustments
- 19:57Hybrid certificate deployment
- 20:59PQC readiness conclusion
related talks
47mReal-World Lessons in Post-Quantum Cryptography Migration
24mUpdate on end-to-end PKI and HSM integrations with ML-DSA
41mPreparing for and migrating to a world with PQC
32mPQC in OpenSSL Library
33mExtending or Evolving: Choosing the Path to Quantum Readiness
31m2025 is Here - How to get your PQC Readiness Plan Underway
30mNavigating the Quantum Readiness Journey: Hands-on Guidance for Starting Your Migration-
46mAchieving Quantum Readiness: A Comprehensive Approach