News 27 Apr, 2023

Tech Update: Preparing for the migration to post-quantum public key algorithms with hybrid certificates

You can now use X.509 Section 9.8 extensions to enable hybrid certificates and CRLs with the Bouncy Castle APIs. Support for this has been problematic up until recently due to patent issues which are now resolved. While we are early adopters, we expect other libraries to follow suit soon. This feature is most interesting for users looking at planning the migration process from classical public key algorithms to post-quantum public key algorithms.

Preparing for PQC migration

The “alt” extensions described in X.509, Section 9.8, are designed to support an additional public key and/or signature. The use of the extensions enable a certificate to support keys from both classical and post-quantum algorithms together. This allows the certificate to be deployed even to hardware that cannot currently support the post-quantum algorithm used in the “alt” extensions and is still used in its original classical context. As the software on the machine using the certificate is updated to utilize post-quantum algorithms, the same certificate can continue to be used.

Hybrid Certificate support in Bouncy Castle, EJBCA and SignServer

Supporting this in Bouncy Castle is also the first step to using the X.509 alt extension in EJBCA, SignServer and other Keyfactor products. However, the Bouncy Castle Kotlin project lets you try it out now.

Try it out today with the Bouncy Castle Kotlin project

Bouncy Castle Kotlin uses the Bouncy Castle Java libraries to create PQC keys. There are examples of how to create hybrid certificates and more. This makes getting started with PQC hybrid certificates easy!

Check out our tutorial videos:

This website uses cookies

Cookies consist of small text files. They contain data that is stored on your device. To enable us to place certain types of cookies we need to obtain your consent. At PrimeKey Solutions AB, corp. ID no. 556628-3064, we use the following kinds of cookies. To read more about which cookies we use and storage times, click here to access our cookies policy.

Manage your cookie-settings

Necessary cookies

Necessary cookies are cookies that must be placed for basic functions to work on the website. Basic functions are, for example, cookies which are needed so that you can use menus on the website and navigate on the site.

Functional cookies

Functional cookies need to be placed on the website in order for it to perform as you would expect. For example, so that it recognizes which language you prefer, whether or not you are logged in, to keep the website secure, remember login details or to be able to sort products on the website according to your preferences.

Cookies for statistics

For us to measure your interactions with the website, we place cookies in order to keep statistics. These cookies anonymize personal data.

Cookies for ad-tracking

To enable us to offer better service and experience, we place cookies so that we can provide relevant advertising. Another aim of this processing is to enable us to promote products or services, provide customized offers or provide recommendations based on what you have purchased in the past.
Confirm choices Accept all