Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IEEE Consumer Communications and Networking Conference

Post-Quantum Public Key Infrastructures: Hybrid Certificates, Cryptographic Combiners, and Migration Strategies

Abdullah Aydeger, Engin Zeydan, Awaneesh Kumar Yadav, Madhusanka Liyanage

Published Jan 9, 2026• 2 citations
Publisher

Abstract

The impending threat posed by quantum-capable adversaries necessitates a secure and practical transition of Public Key Infrastructures (PKIs) to support post-quantum cryptography (PQC). This paper addresses the multifaceted challenges of integrating PQC into existing PKI ecosystems by examining novel cryptographic combiners and hybrid certificate designs that can provide quantum-resistant security. We assess the performance, compatibility, and security of these hybrid certificates across standard communication protocols such as TLS, considering variations in root and intermediate certification paths. In addition, we introduce key management procedures that cover signature generation, validation, and lifecycle considerations under both software and hardware constraints. Beyond X.509, alternative trust models and certificate mechanisms are also analyzed for specialized domains, including IoT, firmware signing, and smart cards.

DOI
10.1109/ccnc65079.2026.11366420

Related papers

A Comprehensive Review of Post-Quantum Cryptography Integration into Public Key Infrastructure: Challenges, Algorithms, and Future Directions

Godi Amulya, Siva Rama Krishna T

Development of Quantum Computers are growing rapidly, the security of today’s cryptographic systems which are working with Public Key Infrastructure (PKI) is at serious risk. RSA and ECC algorithms are the backbone of secure communication and digital identity can be breakable by quantum algorithms such as Shor’s. Hence, a transition is required to Post-Quantum Cryptography (PQC), which is designed to handle quantum attacks. This work provides a detailed review of how PQC can be integrated with the existing PKI, with a special focus on the auto-enrollment process. Auto-enrollment is an essential process but often overlooked mechanism, responsible for automatically issuing and renewing digital certificates. First, we explored how current PKI systems are exposed to the quantum threats and the readiness. The performance of the algorithms that are standardized by NIST, such as Kyber and Dilithium were discussed. We analyze the technical and operational challenges of transitioning to PQC by referencing both research studies and real-world implementations from major industry players such as Google and Microsoft. These include large key size, certificate size, compatibility issues, complex computations and need for crypto-agility. We also examine the hybrid approaches that combine classical and post-quantum methods as traditional strategies. The survey concludes by outlining best practices, deployment considerations, and open research challenges that must be addressed for a smooth, secure, and scalable shift to quantum-safe PKI. This work aims to guide researchers, engineers, and policymakers in building the next generation of cryptographic infrastructure that can stand the test-time even in a quantum world.

IEEE International Conference on Emerging Computing and Intelligent Technologies (ICoECIT)•Jan 28, 2026•0 citations

Quantum Safe Public Key Infrastructure: Hybrid Classical PQC Certificate Chains and Migration Framework for Enterprise TLS

Pavan Navandar

The imminent threat of cryptographically relevant quantum computers (CRQCs) to RSA and elliptic curve cryptography — combined with the 'harvest now, decrypt later' attack paradigm — necessitates an urgent enterprise PKI migration to post quantum cryptographic (PQC) algorithms. This paper presents a comprehensive hybrid PKI framework enabling phased, backward compatible migration from classical to post quantum certificate chains. The framework embeds dual signatures (ECDSA + CRYSTALS Dilithium3) within X.509v3 certificates following the emerging RFC 9480 composite certificate standard. We provide Algorithm 2 (HybridCertIssue) specifying the complete certificate generation and verification protocol, and a migration roadmap structured across five phases from 2021 to 2035+. Experimental evaluation on a 10,000 node enterprise PKI demonstrates: TLS handshake overhead of +4.6 KB, latency increase of +38ms (LAN p50), and Dilithium3 signing throughput of 800 ops/sec on FIPS 140 3 HSMs. Security proofs establish that the hybrid scheme is secure if either the classical or PQC scheme is unforgeable — requiring an adversary to simultaneously break both ECDSA and Dilithium3. The migration cost model scales O(n log n) for n node PKI hierarchies. A 30 organization survey quantifies migration readiness: only 41% have completed cryptographic asset inventory, representing the critical first blocker.

International Journal of Engineering & Extended Technologies Research•Jul 10, 2024•0 citations

Post-Quantum Cryptography (PQC) for Identity Management

Oluwatosin Oladayo Aramide

The impending arrival of viable quantum computing is a major worry to modern-day identity management systems that mainly depend on classical public-key cryptography techniques such as RSA and elliptic curve. Such systems are the basis of secure infrastructure in digital identities such as authentication, digital signature and trust models based on certificates. These cryptographic primitives can be broken using quantum algorithms like Shor and Grover, compromising the privacy of credentials and sessions stored and authenticated on digital ecosystems. The paper provides the necessity of the transition of identity management systems to post-quantum cryptographic (PQC) algorithms that will be resistant to quantum attacks. It gives a general overview of quantum-exposed identity protocols, as well as a look at the up-and-coming PQC algorithms under development, with a special call to digital signature algorithms capable of identity provision, authentication, and credential lifecycle management. Moreover, the paper isolates the problems of integration which include key size overhead, legacy system compatibility and performance trade-offs and suggests integration to take place through the use of hybrid and decentralized framework to allow a secure migration. This study will form part of a strategic plan to a post-quantum identity infrastructure, with the long term reliability, validity, and withstanding of quantum-era vulnerabilities.

Adhyayan A Journal of Management Sciences•Nov 30, 2022•9 citations

Crypto-Agile migration to Hybrid Post-Quantum Cryptography in Enterprise TLS PKI VPN and Cloud-Native Systems and services

Stanley Nwakamma, John Ojukwu, Serif Oyindamola Oyesiji

The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.

Gulf Journal of Computer Sciences•Aug 2, 2026•0 citations

Shaping a Quantum-Resistant Future: Strategies for Post-Quantum PKI

Grazia D’Onghia, Diana Berbecaru, Antonio Lioy

As the quantum computing era approaches, securing classical cryptographic protocols becomes imperative. Public key cryptography is widely used for signature and key exchange but it’s the type of cryptography more threatened by quantum computing. Its application typically requires support via a public-key certificate, which is a signed data structure and must therefore face twice the quantum challenge: for the certified keys and for the signature itself. We present the latest developments in selecting robust Post-Quantum algorithms and investigate their applicability in the Public Key Infrastructure context. Our contribution entails defining requirements for a secure transition to a quantum-resistant Public Key Infrastructure, with a focus on adaptations for the X.509 certificate format. Additionally, we explore transitioning Certificate Revocation List and Online Certificate Status Protocol to support quantum-resistant algorithms. Through comparative analysis, we elucidate the complex transition to a quantum-resistant PKI.

arXiv:2601.11104•IEEE Symposium on Computers and Communications (ISCC)•Jun 26, 2024•4 citations

Leveraging Post-Quantum Cryptography in Digital Signatures for Enhanced Security in Quantum Computing Threat

Pavan Kurariya, Jahnavi Bodhankar, Santosh Pandey

The emergence of quantum computing introduces unprecedented risks to classical cryptographic schemes, particularly digital signatures that safeguard authentication, confidentiality, and data integrity across digital ecosystems. To address these concerns, this paper investigates the adoption of Post-Quantum Cryptography (PQC) within Public Key Infrastructure (PKI) frameworks, emphasizing its role in strengthening electronic signature (eSign) systems against quantum threats. Traditional PKI implementations rely on algorithms such as RSA and ECC in combination with Hardware Security Modules (HSMs) for secure key management; however, these methods are vulnerable to quantum algorithms like Shor's. We examine how quantum-resistant alternatives-including lattice-based, hash-based, and multivariate polynomial-based schemes standardized by NIST-can be integrated into PKI without compromising interoperability and compliance. A comparative evaluation highlights trade-offs in performance, storage, and computational complexity while demonstrating the feasibility of embedding PQC into existing eSign infrastructures. Our findings underscore the urgency of transitioning towards quantum-safe digital signatures to ensure resilience, regulatory alignment, and long-term trust in national-scale digital services.

IEEE International Conference on Blockchain and Distributed Systems Security (ICBDS)•Oct 30, 2025•0 citations
The impending threat posed by quantum-capable adversaries necessitates a secure and practical transition of Public Key Infrastructures (PKIs) to support post-quantum cryptography (PQC). This paper addresses the multifaceted challenges of integrating PQC into existing PKI ecosystems by examining novel cryptographic combiners and hybrid certificate designs that can provide quantum-resistant security. We assess the performance, compatibility, and security of these hybrid certificates across standard communication protocols such as TLS, considering variations in root and intermediate certification paths. In addition, we introduce key management procedures that cover signature generation, validation, and lifecycle considerations under both software and hardware constraints. Beyond X.509, alternative trust models and certificate mechanisms are also analyzed for specialized domains, including IoT, firmware signing, and smart cards.
Development of Quantum Computers are growing rapidly, the security of today’s cryptographic systems which are working with Public Key Infrastructure (PKI) is at serious risk. RSA and ECC algorithms are the backbone of secure communication and digital identity can be breakable by quantum algorithms such as Shor’s. Hence, a transition is required to Post-Quantum Cryptography (PQC), which is designed to handle quantum attacks. This work provides a detailed review of how PQC can be integrated with the existing PKI, with a special focus on the auto-enrollment process. Auto-enrollment is an essential process but often overlooked mechanism, responsible for automatically issuing and renewing digital certificates. First, we explored how current PKI systems are exposed to the quantum threats and the readiness. The performance of the algorithms that are standardized by NIST, such as Kyber and Dilithium were discussed. We analyze the technical and operational challenges of transitioning to PQC by referencing both research studies and real-world implementations from major industry players such as Google and Microsoft. These include large key size, certificate size, compatibility issues, complex computations and need for crypto-agility. We also examine the hybrid approaches that combine classical and post-quantum methods as traditional strategies. The survey concludes by outlining best practices, deployment considerations, and open research challenges that must be addressed for a smooth, secure, and scalable shift to quantum-safe PKI. This work aims to guide researchers, engineers, and policymakers in building the next generation of cryptographic infrastructure that can stand the test-time even in a quantum world.
The imminent threat of cryptographically relevant quantum computers (CRQCs) to RSA and elliptic curve cryptography — combined with the 'harvest now, decrypt later' attack paradigm — necessitates an urgent enterprise PKI migration to post quantum cryptographic (PQC) algorithms. This paper presents a comprehensive hybrid PKI framework enabling phased, backward compatible migration from classical to post quantum certificate chains. The framework embeds dual signatures (ECDSA + CRYSTALS Dilithium3) within X.509v3 certificates following the emerging RFC 9480 composite certificate standard. We provide Algorithm 2 (HybridCertIssue) specifying the complete certificate generation and verification protocol, and a migration roadmap structured across five phases from 2021 to 2035+. Experimental evaluation on a 10,000 node enterprise PKI demonstrates: TLS handshake overhead of +4.6 KB, latency increase of +38ms (LAN p50), and Dilithium3 signing throughput of 800 ops/sec on FIPS 140 3 HSMs. Security proofs establish that the hybrid scheme is secure if either the classical or PQC scheme is unforgeable — requiring an adversary to simultaneously break both ECDSA and Dilithium3. The migration cost model scales O(n log n) for n node PKI hierarchies. A 30 organization survey quantifies migration readiness: only 41% have completed cryptographic asset inventory, representing the critical first blocker.
The impending arrival of viable quantum computing is a major worry to modern-day identity management systems that mainly depend on classical public-key cryptography techniques such as RSA and elliptic curve. Such systems are the basis of secure infrastructure in digital identities such as authentication, digital signature and trust models based on certificates. These cryptographic primitives can be broken using quantum algorithms like Shor and Grover, compromising the privacy of credentials and sessions stored and authenticated on digital ecosystems. The paper provides the necessity of the transition of identity management systems to post-quantum cryptographic (PQC) algorithms that will be resistant to quantum attacks. It gives a general overview of quantum-exposed identity protocols, as well as a look at the up-and-coming PQC algorithms under development, with a special call to digital signature algorithms capable of identity provision, authentication, and credential lifecycle management. Moreover, the paper isolates the problems of integration which include key size overhead, legacy system compatibility and performance trade-offs and suggests integration to take place through the use of hybrid and decentralized framework to allow a secure migration. This study will form part of a strategic plan to a post-quantum identity infrastructure, with the long term reliability, validity, and withstanding of quantum-era vulnerabilities.
The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.
As the quantum computing era approaches, securing classical cryptographic protocols becomes imperative. Public key cryptography is widely used for signature and key exchange but it’s the type of cryptography more threatened by quantum computing. Its application typically requires support via a public-key certificate, which is a signed data structure and must therefore face twice the quantum challenge: for the certified keys and for the signature itself. We present the latest developments in selecting robust Post-Quantum algorithms and investigate their applicability in the Public Key Infrastructure context. Our contribution entails defining requirements for a secure transition to a quantum-resistant Public Key Infrastructure, with a focus on adaptations for the X.509 certificate format. Additionally, we explore transitioning Certificate Revocation List and Online Certificate Status Protocol to support quantum-resistant algorithms. Through comparative analysis, we elucidate the complex transition to a quantum-resistant PKI.
The emergence of quantum computing introduces unprecedented risks to classical cryptographic schemes, particularly digital signatures that safeguard authentication, confidentiality, and data integrity across digital ecosystems. To address these concerns, this paper investigates the adoption of Post-Quantum Cryptography (PQC) within Public Key Infrastructure (PKI) frameworks, emphasizing its role in strengthening electronic signature (eSign) systems against quantum threats. Traditional PKI implementations rely on algorithms such as RSA and ECC in combination with Hardware Security Modules (HSMs) for secure key management; however, these methods are vulnerable to quantum algorithms like Shor's. We examine how quantum-resistant alternatives-including lattice-based, hash-based, and multivariate polynomial-based schemes standardized by NIST-can be integrated into PKI without compromising interoperability and compliance. A comparative evaluation highlights trade-offs in performance, storage, and computational complexity while demonstrating the feasibility of embedding PQC into existing eSign infrastructures. Our findings underscore the urgency of transitioning towards quantum-safe digital signatures to ensure resilience, regulatory alignment, and long-term trust in national-scale digital services.