Post-Quantum Interoperabilität in Aktion: Wie die Zusammenarbeit die PQC-Zukunft der Cybersicherheit gestaltet

Anmerkung des Herausgebers: Besonderer Dank gilt Tomas Gustavsson und David Hook, zwei der führenden Experten für angewandte Kryptographie und PKI, die diesen Blog verfasst haben. Die Einblicke und die technische Tiefe, die hier geteilt werden, sind ein direktes Ergebnis ihrer profunden Fachkenntnisse und ihrer engen Zusammenarbeit.

Während sich die Landschaft der Post-Quantum-Kryptografie (PQC) weiterentwickelt, ist eines klar: Der Erfolg wird sich nicht durch isoliertes Arbeiten einstellen. Interoperabilität - zwischen Algorithmen, Bibliotheken, Protokollen und der realen Infrastruktur - ist unerlässlich, um PQC in großem Umfang nutzbar, vertrauenswürdig und sicher zu machen.

Bei Keyfactor haben wir einen praktischen Ansatz für PQC gewählt, indem wir unsere Produkte - angefangen bei EJBCA, SignServer und Bouncy Castle - aktiv getestet und mit dem breiteren Ökosystem, einschließlich OpenSSL, CryptLib, WolfSSL, Anbietern von Hardware und offenen Standardisierungsgremien wie der IETF, NIST und X9, zusammengearbeitet haben.

Our goal is simple: demonstrate that post-quantum cryptography isn’t just a theoretical idea — it works. Today. 

This isn’t just about us. It’s about collaboration — because when we test together, share results openly, and iterate with the community, everyone benefits. 

 Ein lebendes Labor für PQC-Interoperabilität

We maintain a living resource that documents real-world interoperability testing with PQC algorithms, protocols and formats across multiple tools and lifecycle stages. We want to share practical configurations and observations that reflect what’s actually needed to make PQC work in modern PKI and signing deployments.  

Here’s a snapshot of what we’ve tested so far: 

TLS 1.3 Authentication + Key Exchange 

• Use Case: Mutual TLS (mTLS) with PQC certificates 
• Tools: EJBCA + OpenSSL 3.5 + Bouncy Castle 
• Outcome: Success using ML-DSA for authentication and ML-KEM for key exchange — a milestone toward crypto-agile secure communications. 

CMS Signing and Validation 

• Use Case: Code, container, and document signing with PQC 
• Tools: SignServer, Bouncy Castle, OpenSSL 
• Outcome: Cross-library verification of CMS-signed messages with ML-DSA and SLH-DSA. Encryption with ML-KEM also validated. 

Issuing Certificates  

• Use Case: Issue, renew and revoke PQC-enabled certs 
• Tools: EJBCA, Bouncy Castle, OpenSSL 
• Outcome: PQC CSRs generated and processed; Certificates, CRLs and OCSP responses validated across libraries. 

Hybrid Certificates 

• Use Case: Gradual migration using hybrid certs (e.g., ECDSA + ML-DSA) 
• Tools: EJBCA, Bouncy Castle and WolfSSL 
• Outcome: TLS with hybrid certificates is functioning today. Testing has been ongoing within X9.146.  More testing underway for corner cases like dual-key storage and signture validation. 

Hardware Security Modules (HSMs) 

• Use Case: PQC key management in secure hardware 
• Vendors: Securosys, Fortanix, Crypto4A, Utimaco and CryptoNext 
• Outcome: Early success with LMS and ML-DSA support, with ongoing work to validate object size limits and integration edge cases. 

Zusammenarbeit treibt Innovation und Standards voran

This work is possible because of active collaboration between maintainers, implementers, and the broader open-source community. Participating in the IETF PQC Hackathon and contributing to ongoing ACVP testing allows us to catch bugs early, align on evolving drafts, and push forward on shared challenges — from signature size handling to private key,  CMS and PKCS#12 encoding nuances. 

These collaborations aren’t just technical. They help build trust, transparency, and alignment — essential ingredients when rolling out something as foundational as new cryptographic primitives. 

Nehmen Sie an der Reise teil - versuchen Sie es selbst

If you’re working in PKI, signing, or security infrastructure, now’s the time to start experimenting with PQC. You don’t have to wait for final standards — protocols, formats and algorithm updates are stable, and libraries like Bouncy Castle and OpenSSL already support testable implementations. 

We continuously update our Post-Quantum Cryptography (PQC) lab environment to support new use cases. Try it out today! 

Explore our ongoing interoperability testing efforts on this page — we’ll keep it updated as we make progress: Interoperability and Future-Ready Cryptography 

EJBCA, SignServer, and Bouncy Castle also maintain broader interoperability and certification coverage beyond just PQC — supporting your needs across current and future cryptographic standards. 

EJBCA: https://docs.keyfactor.com/ejbca/latest/interoperability-and-certifications 

SignServer: https://docs.keyfactor.com/signserver/latest/interoperability 

Bouncy Castle: http://docs.keyfactor.com/bouncycastle/latest/interoperability 

Weiterführende Ressourcen 

Einen tieferen Einblick in die Tools, Standards und die Zusammenarbeit, die PQC vorantreiben, erhalten Sie in diesen wichtigen Referenzen:

IETF Hackathon – PQC Certificates: https://github.com/IETF-Hackathon/pqc-certificates?tab=readme-ov-file#ietf-hackathon—pqc-certificates 

PQC Almanac: https://downloads.bouncycastle.org/java/docs/PQC-Almanac.pdf 

Let’s make PQC not just ready — but usable, reliable, and trustworthy. Together.