---

title: "Learning Path" description: "Post-Quantum PKI Lab - Hands-on learning for PQC migration"

QLAB

Post-Quantum PKI Lab

QLAB is an educational resource to help teams understand PKI and Post-Quantum Cryptography (PQC) migration through hands-on practice.

"The PKI is the tool for transition — post-quantum is an engineering problem, not magic."

What you'll learn:

• Understand the quantum threats to current cryptography (SNDL, TNFL)
• Assess your PQC migration urgency using Mosca's theorem
• Issue classical and post-quantum certificates with the same workflow
• Build complete PQC hierarchies (Root CA → Issuing CA → End-Entity)
• Deploy hybrid certificates for backward-compatible migration
• Manage full lifecycle: revocation, OCSP, CRL
• Sign code, timestamp documents, and create LTV signatures
• Encrypt with ML-KEM key encapsulation (the new pattern)
• Practice crypto-agile CA migration

QLAB uses Qpki for all PKI operations.

---

Installation

Prerequisites:

• Git — for cloning the repository
• Bash — for running demos (Git Bash or WSL on Windows)
• OpenSSL 3.x — optional, for cross-verification commands

macOS / Linux

git clone https://github.com/qpki/qlab.git
cd qlab
./tooling/install.sh

Windows

# 1. Install QPKI (PowerShell)
git clone https://github.com/qpki/qlab.git
cd qlab
.\tooling\install.ps1

# 2. Run demos (requires Git Bash or WSL)
./journey/00-revelation/demo.sh

Note: The install script works in PowerShell, but the demos require Git Bash or WSL.

Getting Started

./journey/00-revelation/demo.sh

---

Learning Path

Total time: ~2h | Quick path: 20 min (Revelation + Quick Start)

🗺️ Journey Map

┌───────────────────────────────────────────────────────────────────────┐
│  AWARENESS              BUILD                    LIFECYCLE            │
│  ┌──────┐ ┌──────┐      ┌──────┐ ┌──────┐    ┌──────┐ ┌──────┐       │
│  │Lab-00│→│Lab-01│  →   │Lab-02│→│Lab-03│ →  │Lab-04│→│Lab-05│       │
│  │Why?  │ │How?  │      │Chain │ │Hybrid│    │CRL   │ │OCSP  │       │
│  └──────┘ └──────┘      └──────┘ └──────┘    └──────┘ └──────┘       │
│                                                       ↓              │
│  MIGRATION              ENCRYPTION           LONG-TERM SIGS          │
│  ┌──────┐               ┌──────┐            ┌──────┬──────┬──────┐   │
│  │Lab-10│  ←            │Lab-09│    ←       │Lab-06│Lab-07│Lab-08│   │
│  │Agile │               │KEM   │            │Sign  │Time  │LTV   │   │
│  └──────┘               └──────┘            └──────┴──────┴──────┘   │
└───────────────────────────────────────────────────────────────────────┘

---

🚀 Awareness

| # | Lab | Time | Takeaway | |---|-----|------|----------| | 0 | The Quantum Threat | 10 min | Your data is already being recorded | | 1 | Classical vs Post-Quantum | 10 min | Same workflow, just different algorithms |

↓ Let's build!

📚 Build

| # | Lab | Time | Takeaway | |---|-----|------|----------| | 2 | Full PQC Chain | 10 min | Build a 100% PQC chain | | 3 | Hybrid | 10 min | Or hybrid to coexist with legacy |

↓ PKI operations stay identical

⚙️ Lifecycle

| # | Lab | Time | Takeaway | |---|-----|------|----------| | 4 | Revocation | 10 min | Revoke = same command | | 5 | OCSP | 10 min | Verify = same protocol |

↓ Sign, timestamp, archive for decades

💼 Long-Term Signatures

| # | Lab | Time | Takeaway | |---|-----|------|----------| | 6 | Code Signing | 10 min | Signatures that outlive the threat | | 7 | Timestamping | 15 min | Prove WHEN, forever | | 8 | LTV | 15 min | Bundle proofs for offline verification |

↓ Except for encryption...

🔐 Encryption

| # | Lab | Time | Takeaway | |---|-----|------|----------| | 9 | Encryption | 15 min | KEM keys require a new pattern: attestation |

↓ And for production migration?

🧭 Migration

| # | Lab | Time | Takeaway | |---|-----|------|----------| | 10 | Crypto-Agility | 15 min | CA versioning + trust bundles |

---

Algorithms

Post-Quantum (NIST 2024)

• ML-DSA (FIPS 204) — Lattice-based signatures → replaces ECDSA
• SLH-DSA (FIPS 205) — Hash-based signatures (conservative)
• ML-KEM (FIPS 203) — Key encapsulation → replaces ECDH

Hybrid (Transition)

• Catalyst certificates (ITU-T X.509 9.8)
• Composite certificates (supported, no lab demo)

See Qpki for the full list of supported algorithms.

---

Resources

• Qpki — The PKI toolkit used by QLAB
• Glossary — PQC and PKI terminology
• Troubleshooting — Common issues and solutions
• NIST Post-Quantum Cryptography
• FIPS 203 (ML-KEM)
• FIPS 204 (ML-DSA)
• ITU-T X.509 (Hybrid Certificates)

---

License

Apache License 2.0 — See LICENSE