Following the success of the 2021, 2022 and 2024 editions, DGA — in partnership with CREACH LABS and with the support of ANSSI, IRISA, IRMAR and the Pôle d'Excellence Cyber — is organizing the 4th edition of the Post-Quantum Cryptography workshop during the European Cyber Week 2026.

Description

At the dawn of the quantum computing era, the security of digital communications is entering a new phase. Post-quantum cryptography is now essential to protect our data and ensure its authenticity through electronic signatures, the foundation of digital trust.

This 2-day workshop brings together the academic, industrial, and institutional communities around topics ranging from the design of schemes to their implementation and evaluation.

On the agenda:

• Talks addressing strategic, regulatory and digital sovereignty challenges,
• Industry feedback on the integration of post-quantum cryptography and electronic signature solutions,
• Presentations of ongoing research and development, especially on new signature schemes, their performance and their large-scale deployment.

The organising committee

• Marie-Thérèse André, DGA MI
• Philippe Chartier, INRIA - IRMAR
• Karine Chatel, Univ. Rennes - CREACH LABS
• Pierre-Alain Fouque, Univ. Rennes - IRISA
• Gabriel Gallin, DGA MI
• Benoît Gérard, ANSSI
• Aurore Guillevic, INRIA - IRISA
• Reynald Lercier, DGA MI - IRMAR
• Antonin Leroux, DGA MI - IRMAR
• Guénaël Renault, ANSSI

Practical infos

• Date

  From November 18, 2026 to November 19, 2026 (09:00 – 18:00)

• Location

  Couvent des Jacobins, 20 Place Sainte-Anne, 35000 Rennes (France) — Metro lines A & B, Station: Sainte-Anne

• Registration

  Free, on prior registration — register to the conference

Program for Wednesday, November 18

• 09:00 – 10:30

  Introduction & National Initiatives

  Chair: Guénaël Renault

  Opening of the two days and presentation of French initiatives, from the ANSSI roadmap to the developments by DGA.

  • 09:00 – 09:15

    Opening

    Pantxoa Amorena, Head of the Cyber Division, DGA

  • 09:15 – 10:00

    ANSSI PQC transition roadmap and product certification strategy

    Anthony Journault and Nicolas Gurel, ANSSI

    Abstract

    In the second part, Nicolas Gurel will present feedback and advances in ANSSI's post-quantum cryptography product certification. Following up on the presentation delivered in 2024 regarding ANSSI policies on the certification of products using post-quantum cryptography and the ITSEF licensing process, he will cover:

    • the required capabilities of ITSEFs;
    • ITSEFs licensed or in the licensing process;
    • the products certified to date;
    • initial technical feedback from these evaluations, with a focus on key considerations identified in the Common Criteria (CC) and First-Level Security Certification (CSPN) schemes.
  • 10:00 – 10:30

    PQC developments at DGA

    Clément Gomez, DGA

    Abstract to be announced.

• 10:30 – 11:00

  Coffee break

• 11:00 – 12:00

  NIST Signature Initiative

  Chair: Pierre-Alain Fouque

  A status report on NIST's call for additional post-quantum signature schemes, beyond the algorithms already standardised.

  • 11:00 – 12:00

    Status report on the additional signature schemes initiative

    Pierre Ciadoux, Former NIST associate

    Abstract to be announced.

• 12:00 – 13:30

  Lunch

• 13:00 – 13:30

  Satellite event: graduation ceremony of the Rennes Master's in Cryptography

• 13:30 – 15:30

  Trust in Post-Quantum Schemes

  Chair: Benoît Gérard

  Perspectives on the foundations of trust in a post-quantum scheme.

  • 13:30 – 14:10

    SQIsign: latest updates

    Antonin Leroux, DGA MI - IRMAR

    Abstract

    SQIsign is the only isogeny-based scheme submitted to NIST's additional call for post-quantum signatures. It offers the most compact sizes among all candidates. In this talk, we will go over the changes behind the latest official update to the scheme for the third round of the NIST competition. This includes new parameter sets at all security levels following new attacks published over the summer, and a complete rework of the quaternion part of the protocol, a necessary effort toward reaching a constant-time implementation of SQIsign, which remains one of the main missing features.

  • 14:10 – 14:50

    Technical elements on signature hybridization

    Maxime Roméas, cryptography laboratory, ANSSI

    Abstract to be announced.

  • 14:50 – 15:30

    Title to be announced

    Pierre-Yves Strub, PQShield

    Abstract to be announced.

• 15:30 – 16:00

  Coffee break

• 16:00 – 18:00

  Signature Schemes

  Chair: Gabriel Gallin

  From new schemes to standards: what holds, what breaks, and what it takes to deploy them.

  • 16:00 – 16:30

    Cryptanalysis of the signature scheme Hawk

    Alice Pellet-Mary, CNRS, Univ. Bordeaux

    Abstract

    In this talk, I will present the recent attacks on the signature scheme Hawk, that have led to its withdrawal from the NIST competition. We will first review the main ideas of the attacks. We will then mention their impact on Hawk, and discuss the most promising way to avoid them in future constructions based on module-LIP. We will conclude the talk with a discussion about what these attacks say about the hardness of other module lattice problems (spoiler: they have no impact on "short vector"-type problems such as NTRU or module-LWE).

  • 16:30 – 17:00

    Integration issues of post-quantum algorithms in communication protocols

    Thomas Pornin, NCC Group

    Abstract

    Post-quantum key exchange and signature schemes are meant to replace pre-quantum schemes such as RSA and ECDSA in existing communication protocols and data formats. However, they have somewhat different characteristics, in terms of size (larger keys, ciphertexts and signatures), speed, RAM usage, code size, protection from side-channel attacks, and API requirements such as data streaming and multi-signatures. In this talk, we discuss these issues especially in the case of the Falcon (FN-DSA) and Dilithium (ML-DSA) signature schemes, both for large systems (laptops, servers) and small embedded systems (microcontrollers). We will also investigate how implementers in the industry are starting to tackle these issues.

  • 17:00 – 18:00

    Presentation of the NYMPHEAS upstream study

    Kirsten Wilk, Secure-IC

    Abstract

    NYMPHEAS is an upstream study conducted jointly by DGA MI, Secure-IC, and SERMA. It focuses on post-quantum digital signature algorithms, that is algorithms resistant to cryptanalysis by a quantum computer. Specifically, it aims to provide a comparative overview of the strengths and weaknesses of so-called "alternative" algorithms, which rely on security foundations radically different from those of already standardized, lattice-based algorithms.

    Secure-IC will present the state of the art for the Dilithium, SDitH, UOV, FAEST, and HuFu algorithms. In particular, a software implementation was developed independently of the reference implementation, and its characteristics will be presented.

Program for Thursday, November 19

• 09:00 – 10:30

  Early-Career Researchers in Post-Quantum Cryptography

  Chair: Karine Chatel

  PhD students and early-career researchers present their ongoing work.

  • 09:00 – 09:45

    Opening and poster introductions by the presenters

  • 09:45 – 10:30

    Discussions around the posters

• 10:30 – 11:00

  Coffee break

• 11:00 – 12:00

  Transitioning to Post-Quantum Cryptography

  Chair: Antonin Leroux

  Lessons learned on how to concretely initiate the post-quantum transition.

  • 11:00 – 11:40

    PQC Migration in The Netherlands: Strategies and Lessons Learned

    Bor de Kock, TNO

    Abstract

    After the PQC Migration Handbook was published in 2023, the public and private sector in The Netherlands has started taking the transition to Post-Quantum Cryptography more seriously — but now it is 2026 and a lot of work is still to be done. In this talk we discuss PQC migration in The Netherlands: what has happened so far, what could have gone better, and what has the role of TNO as an independent research organization been.

  • 11:45 – 12:00

    Best poster award

• 12:00 – 13:30

  Lunch

• 13:30 – 15:30

  Embedded Security & Implementations

  Chair: Aurore Guillevic

  Deploying PQC in constrained and hostile environments — smart cards, embedded devices, and code exposed to reverse engineering.

  • 13:30 – 14:10

    Securing Tomorrow with Post-Quantum Cryptography

    Melissa Azouaoui, NXP

    Abstract

    Quantum computing is becoming an engineering reality that must be considered in today's embedded system designs. As governments and standardization bodies define post-quantum cryptography (PQC) migration roadmaps, manufacturers face the challenge of securing devices that may remain deployed for decades.

    This talk explores the integration of PQC into embedded security architectures and the practical challenges of deploying quantum-safe security in resource-constrained environments. Drawing on NXP's experience in PQC standardization and product development, it highlights how PQC can be incorporated as a foundational security capability and what organizations can do today to prepare for the post-quantum transition.

  • 14:10 – 14:50

    Protecting Post-Quantum Cryptography in Hostile Environments (white-box)

    Agathe Houzelot, IDEMIA

    Abstract

    Post-quantum cryptography is progressively being integrated into consumer devices, mobile applications and digital identity infrastructures. However, this transition raises a new security challenge: how can quantum-resistant cryptographic algorithms remain protected when deployed in hostile software environments that attackers can inspect, modify and reverse engineer?

    White-box cryptography aims to protect cryptographic secrets even when an attacker has full visibility and control over the software implementation, but its application to post-quantum cryptography remains largely unexplored. In this talk, we investigate white-box implementations of post-quantum cryptography, using the FrodoKEM key encapsulation mechanism as a case study.

    We explore how existing protection techniques can be adapted to a lattice-based cryptosystem, introduce new mechanisms when existing approaches are not applicable or insufficient, and evaluate the resulting trade-offs between security and performance. Our work highlights that the transition to post-quantum cryptography is not simply a matter of replacing classical algorithms. It also requires rethinking how cryptographic secrets are protected once deployed in software.

    By addressing this challenge, we open a new research direction at the intersection of post-quantum cryptography and software protection techniques, contributing to the development of the next generation of secure digital services for the post-quantum era.

  • 14:50 – 15:30

    Development and evaluation of secure, embedded implementations of ML-KEM and ML-DSA

    Ryad Benadjila and Gabriel Zaid, CryptoExperts

    Abstract

    The optimized and portable implementation of the FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) post-quantum standards on highly constrained microcontrollers raises significant challenges, particularly regarding memory footprint and security against physical attacks (SCA and FIA).

    Drawing on our experience integrating these standards into CryptoExperts' PQLib library (portable across Cortex-M4, RISC-V, etc.), this presentation will detail the implemented software architecture and the memory/speed trade-offs.

    We will analyze the subtleties related to these algorithms' primitives when developing a portable, constant-time implementation (pitfalls, main bottlenecks, potential benefits of hardware acceleration, etc.), before briefly addressing the difficulties involved in protecting against physical attacks.

    Finally, we will present the challenges posed by the CESTI evaluation of protected implementations, along with some results on PQLib.

• 15:30 – 16:00

  Coffee break

• 16:00 – 18:00

  Advanced Protocols & Primitives

  Chair: Florian Méhats

  Beyond encryption and signatures: key-exchange and messaging protocols, homomorphic encryption, and privacy-preserving signatures.

  • 16:00 – 16:30

    Anonymous Credentials in a Post-Quantum World

    Olivier Sanders, Orange Labs

    Abstract

    Anonymous Credentials, long confined to the area of secure computing, are in the limelight today thanks to the European Digital Identity Wallet (EUDI wallet) initiative that aims at providing both secure and private solutions for authenticating European citizens. This requires new cryptographic mechanisms that significantly depart from the classical digital signature standards. This momentum for privacy-preserving solutions however coincides with the post-quantum migration urged by many cybersecurity agencies worldwide, which is quite complex to manage in this specific context.

    In this talk, we will present these cryptographic mechanisms and the associated issues, both technical and practical, along with the peculiar challenges of migrating them to quantum-resistant solutions.

  • 16:30 – 17:00

    The Zama Protocol in a Post-Quantum World

    Morten Dahl, Zama

    Abstract

    Blockchains are cryptographic systems in an unusually pure form: there are no trusted servers, account ownership rests entirely on digital signatures, and every transaction is published to a permanent, globally replicated ledger. This makes them uniquely exposed on both sides of the quantum threat: harvest-now-decrypt-later applies to a public ledger by construction, and a signature forgery is not fraud to be reversed but ownership itself.

    The Zama Protocol adds confidentiality to blockchains using fully homomorphic encryption (TFHE): smart contracts operate on encrypted values, with decryption controlled by a threshold key management system built on secure multiparty computation. In this talk we give a component-by-component assessment of what the quantum threat means for this protocol, organized by a simple deadline distinction: confidentiality must be post-quantum today, while integrity must migrate before Q-day. The confidential layer, built on lattice assumptions from the same family as ML-KEM and ML-DSA, is already post-quantum; the threshold KMS is secure on paper but its deployment relies on classical primitives; the underlying blockchain's signatures remain classical. We present our phased roadmap for closing the gaps on our side, and along the way illustrate how the protocol works and the use cases being built on top of it.

  • 17:00 – 17:30

    DAKE: Bandwidth-Efficient AKE from Double-KEM

    Éric Sageloli, Thales

    Abstract

    Bandwidth remains a major bottleneck in post-quantum cryptography, especially for authenticated key exchange protocols, which are at the core of numerous applications.

    In this presentation, we introduce DAKE (Double AKE), a generic family of secure, two- and three-message, bandwidth-efficient AKE protocols contributing to this line of research. To improve the communication size of ML-KEM-based AKEs, these protocols rely on double-KEMs: primitives that encapsulate a single shared key under two public keys at once. We also introduce Maul, a size-efficient ML-KEM-inspired double-KEM designed to be compatible with our protocols.

    When instantiated with Maul, our protocols reduce overall communication by about 16% in the mutually authenticated setting, and about 20% in the unilateral setting, improving over both the double-KEM AKE of Xue et al. (ASIACRYPT 2018) and standard ML-KEM-based AKEs.

  • 17:30 – 18:00

    Triple Ratchet: a bandwidth-efficient hybrid secure Signal protocol

    Thomas Prest, PQShield

    Abstract

    Secure messaging apps are used by billions of people daily. Faced with the imminent threat of “Harvest Now, Decrypt Later” attacks, their providers must act now to make their protocols hybrid-secure: at least as secure as before, but now also post-quantum secure. Since most of these apps build on Signal's Double Ratchet, securing Signal matters a great deal.

    Signal and Apple have already deployed hybrid variants: PQXDH on the initial handshake, and PQ3 on the whole protocol, by adding a PQ-ratchet. But the communication overhead of Kyber forces real-world PQ3 to run that ratchet only about every 50 messages, and this amortization degrades quickly in realistic scenarios, causing many consecutive retransmissions of 2272 bytes of public key and ciphertext.

    We present Triple Ratchet, which improves on PQ3 in two ways. Erasure codes make communication inside the PQ-ratchet provably balanced, giving far better worst-case guarantees. And Katana, a new Kyber variant, cuts the combined ciphertext and public key size by over 37% at the 192-bit security level, from 2272 to 1416 bytes; along the way we identify and fix a security flaw in earlier optimization proposals.

    Developed with the Signal team, who have brought some of these ideas into production. This talk is aimed at security practitioners rather than cryptographers alone.

Provisional programme — talks and speakers marked "to be confirmed" will be announced later, and timings may still change.

Call for posters

A Call for Posters is open to PhD students and postdoctoral researchers. The poster session is an opportunity to present ongoing work and to engage in discussion with specialists from a range of disciplines. Topics may include, but are not limited to:

• New post-quantum cryptographic schemes (design, security, cryptanalysis).
• Performance and optimization of post-quantum primitives.
• Software, hardware or embedded implementation, resistance to physical attacks.
• Integration, large-scale deployment and post-quantum cryptographic transition.

Each accepted poster will be the subject of a short 3-minute talk. The best poster will be awarded a prize during the event.

• Submission

  One-page abstract in English, with name, affiliation and contact details

• Send to

  conference@creachlabs.fr

• Deadline

  11 October 2026

• Notification

  18 October 2026

• Selection criteria

  Relevance, scientific quality and clarity

• Poster format

  A0, portrait, written in English

• Printing

  Can be handled by the organizers (send your file ahead of time)

Early-career researchers are warmly encouraged to submit a proposal. Feel free also to forward this call to anyone who might be interested.

Submit your poster abstract

Satellite events

Other post-quantum cryptography events take place in Rennes alongside the workshop.

• Post-quantum day of the Rennes cryptography seminar

  Friday, November 20, 2026 (09:30 – 15:15) — Amphitheatre E, Building 02A, Université de Rennes, Beaulieu campus — on site and by videoconference

  Following the European Cyber Week, a day of more technical talks dedicated to post-quantum cryptography. More information

• Graduation ceremony of the Rennes Master's in Cryptography

  Wednesday, November 18, 2026 (13:00 – 13:30) — Couvent des Jacobins, Le Réfectoire room

  Graduation ceremony of the Master's in Mathematics and Applications — IT Mathematics and Cryptography, held alongside the workshop.

Part of the European Cyber Week 2026

The Post-Quantum Cryptography workshop is featured on the program of the European Cyber Week 2026.

Register to the conference