Implementing X.509 multiple algorithm certificates

[Faria Miranda Duarte, J.D. (João) de]

Hi all,

In 2019, the ITU-T standardised the multiple algorithms certificates 
(i.e. hybrid) directly in the X.509 standard 
(https://www.itu.int/rec/T-REC-X.509-201910-I/en). It is based on the 
expired Internet draft by Truskovsky et al 
(https://datatracker.ietf.org/doc/html/draft-truskovsky-lamps-pq-hybrid-x509-01). 


The ITU-T were a bit sneaky. It's in Section 9.8 called "Alternative 
cryptographic algorithms and digital signature extensions" (there is 
also some more relevant info scattered, such as in Section 9.2.2.4 or 
9.3.2.1).

Instead of referring to hybrid certificates, they call them "multiple 
algorithm certificates" and instead of "post-quantum signature", they 
call it "alternative signature". This all corresponds exactly with the 
expired Internet-Draft, which is to address the current 
classical->post-quantum migration.

A timeline published by the ITU-T is found here 
(https://www.itu.int/en/ITU-T/Workshops-and-Seminars/2022/0509/Documents/Jean-Paul%20Lemaire_Public.pdf).

In the second to last slide, they specifically say:

     New extensions have been added to migrate to quantum safe algorithms

I was wondering if this is going to be implemented as it seems to 
deviate quite a bit from the current X.509 code?
This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. TNO accepts no liability for the content of this e-mail, for the manner in which you use it and for damage of any kind resulting from the risks inherent to the electronic transmission of messages.