7.3 KiB
IGF 2026 WS #383 Post-Quantum Migration: Governing a Global Transition
Description
Encryption underpins public and private services delivered over the Internet, including government services, financial transactions, healthcare systems, digital identities, software distribution and critical infrastructure. Advances in quantum computing threaten many of the public-key cryptographic algorithms on which these services rely, creating an urgent need to migrate to post-quantum cryptography. Policymakers and regulators will play an essential role in accelerating this transition. Requirements introduced without sufficient understanding of technical dependencies could lead to fragmented approaches, incompatible implementations or unnecessary costs. These challenges may be particularly significant for developing countries, which face limited technical capacity and longer infrastructure lifecycles, risking widening existing digital divides. Governments face legitimate public policy objectives, including national security, resilience, protection of critical infrastructure and digital sovereignty. The challenge is to pursue these objectives while maintaining the interoperability on which the global Internet depends. The workshop will examine how these objectives can be balanced through effective coordination between policymakers and the technical community. This session will bring together policymakers, regulators, the technical community, private sector and civil society to examine the technical and governance considerations involved in PQC migration. Drawing on experience from the IETF and the technical community, it will explore how public policy can support global standards, encourage preparation, provide regulatory certainty and address sectors that may struggle to migrate. The discussion will consider questions such as when regulatory intervention is useful, how migration should reflect technical readiness and risk, how procurement and reporting requirements can encourage progress, and how governments and regulators can participate effectively in the standards processes. Short expert presentations will provide context, but the workshop will focus primarily on dialogue among policymakers, regulators, technical experts, industry and civil society. Its goal will be to develop practical recommendations for policy and regulatory approaches that accelerate PQC migration while preserving global interoperability and security.
Policy Question(s)
A. How should technical standards bodies, industry, governments and regulators coordinate responsibilities and timelines for a globally interoperable transition to post-quantum cryptography? B. Which policy and regulatory measures are most effective in accelerating migration while avoiding premature mandates, fragmented requirements or barriers to implementation? C. What shared practices, information and accountability mechanisms are needed to identify cryptographic dependencies, prioritize migration risks, and support organizations with limited resources or legacy infrastructure, particularly in developing countries?
Expected Outcomes
The workshop will produce a concise set of multistakeholder observations and recommendations identifying areas of consensus, differing perspectives, and practical actions for advancing a timely, secure and interoperable global PQC migration. These will identify practical actions for standards bodies, technology providers, network and service operators, governments and regulators, including approaches to migration planning, cryptographic inventories, sequencing, interoperability testing, procurement and regulatory coordination. Participants will gain a clearer understanding of the technical and governance dependencies that make PQC migration different from an ordinary technology upgrade; the respective roles and constraints of different stakeholder groups; and the risks of both delayed action and poorly coordinated mandates. The session report will capture areas of agreement, unresolved questions and suggested follow-up work. The organizers will share the recommendations through relevant IETF, IAB and Internet governance channels and use them to inform future technical-policy dialogue.
Format
Classroom Duration (minutes): 90 Format description: A 90-minute classroom format is best suited to the session. The topic is likely to attract a broad audience, but the workshop should remain discussion-led rather than becoming a sequence of presentations. Classroom seating provides greater capacity than a roundtable while enabling more direct interaction than a theatre layout. The session will use no more than four speakers plus one moderator. Opening presentations will be limited to five minutes each, leaving approximately 50 minutes for participant discussion and 10 minutes to synthesize recommendations. The moderator will organize contributions around the three policy questions and short migration scenarios, rather than relying on an open-ended question-and-answer period. This provides enough time to compare technical, operational and regulatory perspectives, explore areas of agreement and disagreement, and develop concrete outcomes with meaningful input from onsite and online participants. If 90-minute slot is not available, agenda can be re-arranged to fit into 60 minutes.
Hybrid Format
Hybrid Format: The session will be designed as a discussion involving onsite and online participants equally. The moderator will alternate between the room and the online, while an online moderator monitors chat and questions. Remote speakers will participate throughout, rather than in a separate segment. Opening interventions and discussion prompts will be brief. Participants will respond to live polls on migration readiness, priorities and responsibility, with results used to guide the discussion. A shared online document will allow participants to submit recommendations, identify barriers and react to proposals. Participants will also be invited to contribute examples from their own jurisdictions and organizations, allowing the discussion to compare different regulatory approaches, deployment experiences and operational challenges. Submitted questions will be integrated into each discussion segment. The final ten minutes will test the emerging recommendations through a rapid prioritization exercise, ensuring that the conclusions reflect both onsite and online participation.
Organizers
Organizer 1: Rosomakho Yaroslav, Zscaler Organizer 2: Dhruv Dhody, IAB Organizer 3: Roman Danyliw, IETF Organizer 4: Dirk Kutscher, Internet Research Task Force
Speakers
Speaker 1: Dierdre Connoly, Private Sector, Western European and Others Group (WEOG) Speaker 2: Michael Parsons, Government, Western European and Others Group (WEOG) Speaker 3: Ramy Fathy, Government, African Group Speaker 4: Rosomakho Yaroslav, Technical Community, Western European and Others Group (WEOG) Speaker 5: Elkins Nalini, Private Sector, Asia-Pacific Group
Moderator
Roman Danyliw, Technical Community, Western European and Others Group (WEOG)
Online Moderator
Dhruv Dhody, Technical Community, Asia-Pacific Group
Rapporteur
Dirk Kutscher, Technical Community, Asia-Pacific Group
Participant Benefits
What will participants gain from attending this session?
SDGs
9.1 16.7 17.14 17.16 17.17