Post-Quantum Authentication: Up Next

Post-quantum key establishment has moved from standards into deployment. Post-quantum authentication has not moved nearly as far, and specification work is no longer the only constraint. The IAB is holding a workshop in Prague on 11 and 12 October 2026 to bring deployment experience together with the people working on the relevant protocols and standards.

EXTENDED: Paper submission deadline is now: 2026-09-11

The workshop is focused on accelerating the deployment of post-quantum authentication. We want evidence about what actually delays deployment in production systems. More details about what position papers, due 4 September 2026, should cover and how they should be submitted are provided below.

Deployment of post-quantum authentication is complicated. The protocol standards are advancing, but more studies need to be conducted on constraints encountered in production systems.

There is no shortage of specification work. NIST has standardized ML-DSA in FIPS 204 and SLH-DSA in FIPS 205. The IETF has published the conventions for using them in X.509 as RFC 9881 and RFC 9909. There are also active proposals for composite signatures, Merkle Tree Certificates, and KEM-based authentication.

What we largely do not have is evidence about what happens when these approaches meet production systems. We know the sizes of the keys and signatures, and we can benchmark individual operations. We know much less about their effect on certificate chains, handshake limits, cryptographic modules, firmware budgets, offline verification, and trust-store timelines.

We would like to hear from the people who have tried, measured, purchased, planned, or operated any part of this transition.