Skip to content

Beyond Classical Cryptography: Building Quantum-Resistant Cloud Native Infrastructure With SPIFFE#

KubeCon + CloudNativeCon Europe 2025 (London) digest Program Core pick London · 1–4 April 2025

Abstract Recording

Andrés Vega, M42 & Hugo Landau, Messier42 — Core

Play the recording: Beyond Classical Cryptography: Building Quantum-Resistant Cloud Native Infrastructure With SPIFFE

  • Why: A concrete, working demonstration of post-quantum cryptography threaded through the exact identity/networking stack the PM tracks (SPIFFE/SPIRE, Cilium, Envoy) rather than a standards-committee abstraction — a preview of what PQ migration actually touches in a real cluster.
  • What: A live demo of end-to-end post-quantum cryptography in Kubernetes: PQC-enabled SPIRE issuing Kyber KEM / Dilithium3 X.509 certificates, quantum-resistant mTLS, and Cilium L7 policy enforcement over that identity. (from abstract only)
  • How: Deploys PQC-enabled SPIRE, Cilium, and Envoy together — Kyber for key exchange, Dilithium3 for certificate signatures — with Cilium network policies doing L7 filtering and Envoy handling inter-node mTLS with the PQ algorithms. (from abstract only)
  • Where applicable: General technique for any SPIFFE/SPIRE + Cilium/Envoy deployment; depends on NIST's 2024 PQC algorithm choices (ML-KEM/Kyber, ML-DSA/Dilithium) holding up, which is the same assumption the IETF PQ-migration work (see the ietf-122 digest) is built on.