Filter Search for grants
Call Navigation
Call key data
Transition to post-quantum Public Key Infrastructures
Funding Program
Digital Europe
Call number
DIGITAL-ECCC-2025-DEPLOY-CYBER-08-PUBLICPQC
deadlines
Opening
12.06.2025
Deadline
07.10.2025 17:00
Funding rate
50%
Call budget
€ 15,000,000.00
Estimated EU contribution per project
between € 3,000,000.00 and € 4,000,000.00
Link to the call
Link to the submission
Call content
short description
The aim of this call is to tackle the challenges of an effective integration of PQC algorithms in Public Key Infrastructures (PKIs), which offers efficient migration strategies and strong business continuity guarantees. The call targets the different actors involved in the PKI ecosystems and supply and value chains, who all have a unique set of diverse needs and interdependencies, such as Certificate Authorities (CAs), intermediate CAs, researchers, end-users in different domains, and vendors.
Call objectives
Proposals shall target activities on the following subjects:
- design of digital signature combiners and key encapsulation mechanism combiners.
- the testing of deployment of certificates in protocols that use those certificates.
- the development of novel protocols for Automatic Certificate Management and revocation and of novel protocols for (privacy-friendly) certificate-transparency.
- the development of methods and tools that can be used by experts across various PKI domains, including all aspects of key management of asymmetric systems.
Proposals should carefully consider the requirements and constraints, such as security level, performance and business continuity, in a broad range of applications relevant for critical societal sectors and processes (such as governmental services, telecom, banking, smart homes, e-Health, automotive, and other sectors).
Proposals should address functions such as key establishment, digital signatures, and secure communication protocols that require careful adaptation with post-quantum counterparts to ensure resilience against threats posed by quantum-capable adversaries.
Proposals should safeguard compatibility with existing legacy systems. To achieve this, a transition to PKIs that support both pre-quantum and post-quantum cryptography should be addressed. The proposed systems should be able to seamlessly interact with legacy systems by disabling the post-quantum component as needed while preventing downgrade attacks. Relying solely on PQC solutions in this intermediate transition phase could introduce security risks given that the security analysis of the cryptosystems and of their implementations is not as mature as for their pre-quantum counterparts. Proposals should therefore use combinations of PQC solutions and established pre-quantum solutions, making sure to provide strongest-link security, meaning that the system remains secure as long as at least one of the components of the combination is secure.
For certificates for protocols that support negotiation, such as X.509 certificates for the Transport Layer (TLS), the use of post-quantum key exchange has already been demonstrated and can be implemented in a decentralised manner. Many other protocols need to be migrated, and this process will be more complex when old and new configurations must coexist. Moreover, for applications in IoT, smartcards, identity documents and others, the migration strategies defined for the core use cases of X.509 may well not work.
Proposals should develop clear procedures to effectively guide the various stakeholders involved in PKIs across different usage domains through the transition process.
Effective consortia should comprise a diverse range of actors along the entire PKI chain, encompassing expertise in areas such as software development, hardware implementation, cryptographic research, standardisation, policy, and application deployment, as well as organisations that can provide user case studies and real-world applications.
read more
Expected effects and impacts
Activities should include some or all of the following:
- Identification of requirements necessary to implement hybrid certificates.
- Development of approaches and techniques for constructing cryptographic combiners for different protocols.
- Testing of the combiners for issuance of new certificates for the different applications, taking into consideration the need to balance the growth of key, signature, and ciphertext sizes, which can lead to compatibility issues with standards, such as PKI certificates, revocation mechanisms, (privacy-friendly) certificate transparency mechanisms, the use of different cryptographic protocols across certificate chains, the applications requirements, such as security level, time-constraints in signing and verification steps, communication/computational and storage overhead, and hardware optimisation requirements.
- Development of and/or further improvement of open-source libraries.
- Development of novel protocols for Automatic Certificate Management and revocation, and of novel protocols for (privacy-friendly) certificate-transparency. Support to standardisation activities.
- Development of recipes for the design and deployment of the new PKIs, with analysis that depends on each component of a given PKI. • Tests on specialised uses of X.509 certificates other than the core cases using TLS, such as roots of trust, device integrity, firmware signing, and others.
- Design, improvement and testing of X.509 alternatives, such as, among others, Merkle tree ladders, the GNU Name System, older proposals such as SPKI and SDSI and the use of key encapsulation mechanisms for on-demand authentication in place of signatures.
- Awareness and training activities for stakeholders with different profiles, emphasising the interdependencies in the transition and facilitating a broader understanding of the technical standards amongst PKI users.
Participation of non-EU entities entails the risk of highly sensitive information about security infrastructure, risks and incidents being subject to legislation or pressure that obliges those non-EU entities to disclose this information to non-EU governments, with an unpredictable security risk. Therefore, based on the outlined security reasons, this topic is subject to Article 12(5) of Regulation (EU) 2021/694.
read more
Expected results
- New combiners ensuring that cryptographic schemes provide at least 128-bit security against quantum adversaries.
- Experimental evaluation on hybrid certificates in several standard protocols that use those certificates, also considering options for different cryptographic algorithms at the root Certification Authority level and at the other levels, in terms of security, performance, and backward compatibility. The impact of such certificates in protocols should be tested via open-source libraries.
- New and/or improved open-source libraries for certificate requests, issuance, validation, revocation and (privacy-friendly) certificate transparency.
- Clear procedures taking into account all aspects of key management: requirements for signature generation, in terms of the software and hardware used to create signatures as well as the secure storage and handling of private keys to maintain their authenticity and confidentiality, signature validation, with specification of the data required for verifying signatures and outlining the conditions necessary for a successful signature verification process, signature life-cycle process, and validity status of signatures.
- Test and evaluation of uses of X.509 certificates other than their core uses.
- Tests and evaluation of alternatives to X.509 certificates.
- Awareness activities and training courses.
Applicants should provide KPI’s and metrics relevant for the action to measure progress and performance. Proposals may include the indicators listed below or those of their choice.
When applicable, baseline and target values must be provided.
- Number of cybersecurity and/or tools deployed;
- Number of digital signature combiners and key encapsulation mechanism combiners designed;
- Number of novel protocols for Automatic Certificate Management developed;
- Number of new and/or improved open-source libraries for certificate;
- Number of tests and evaluation of uses of X.509 certificates other than their core uses;
- Number of awareness activities and training courses;
- Number and type of standardisation activities and contributions to them
read more
Eligibility Criteria
Regions / countries for funding
Iceland (Ísland), Liechtenstein, Norway (Norge)
eligible entities
Education and training institution, Non-Profit Organisation (NPO) / Non-Governmental Organisation (NGO), Other, Private institution, incl. private company (private for profit), Public Body (national, regional and local; incl. EGTCs), Research Institution incl. University, Small and medium-sized enterprise (SME)
Mandatory partnership
No
Project Partnership
In order to be eligible, the applicants (beneficiaries and affiliated entities) must:
- be legal entities (public or private bodies)
- be established in one of the eligible countries, i.e.:
- EU Member States (including overseas countries and territories (OCTs))
- EEA countries (Norway, Iceland, Liechtenstein)
Specific cases
Natural persons are NOT eligible (with the exception of self-employed persons, i.e. sole traders, where the company does not have legal personality separate from that of the natural person).
International organisations are NOT eligible, unless they are International organisations of European Interest within the meaning of Article 2 of the Digital Europe Regulation (i.e. international organisations the majority of whose members are Member States or whose headquarters are in a Member State).
Entities which do not have legal personality under their national law may exceptionally participate, provided that their representatives have the capacity to undertake legal obligations on their behalf, and offer guarantees for the protection of the EU financial interests equivalent to that offered by legal persons.
EU bodies (with the exception of the European Commission Joint Research Centre) can NOT be part of the consortium.
Entities composed of members may participate as ‘sole beneficiaries’ or ‘beneficiaries without legal personality’. Please note thatif the action will be implemented by the members, they should also participate (either as beneficiaries or as affiliated entities, otherwise their costs will NOT be eligible).
Beneficiaries from countries with ongoing negotiations for participating in the programme (see list of participating countries above) may participate in the call and can sign grants if the negotiations are concluded before grant signature and if the association covers the call (i.e. is retroactive and covers both the part of the programme and the year when the call was launched).
Special rules apply for entities subject to EU restrictive measures under Article 29 of the Treaty on the European Union (TEU) and Article 215 of the Treaty on the Functioning of the EU (TFEU). Such entities are not eligible to participate in any capacity, including as beneficiaries, affiliated entities, associated partners, subcontractors or recipients of financial support to third parties (if any).
Special rules apply for entities subject to measures adopted on the basis of EU Regulation 2020/2092. Such entities are not eligible to participate in any funded role (beneficiaries, affiliated entities, subcontractors, recipients of financial support to third parties, etc). Currently such measures are in place for Hungarian public interest trusts established under the Hungarian Act IX of 2021 or any entity they maintain (see Council Implementing Decision (EU) 2022/2506, as of 16 December 2022).
other eligibility criteria
This topic targets in particular stakeholders involved in the Public Key Infrastructures (PKIs) chain, Certificate Authorities (CAs), intermediate CAs and other entities with a focus on cryptography and its standardization activities. The topic targets also other actors in PKI chain and entities that can provide use-case studies and real-world applications for deployment.
Submissions from consortia, despite not mandatory, is strongly advised.
Additional information
Topics
Relevance for EU Macro-Region
EUSAIR - EU Strategy for the Adriatic and Ionian Region, EUSALP - EU Strategy for the Alpine Space, EUSBSR - EU Strategy for the Baltic Sea Region, EUSDR - EU Strategy for the Danube Region
UN Sustainable Development Goals (UN-SDGs)
project duration
36 months
Additional Information
Applications must be submitted electronically via the Funders & Tenders Portal electronic submission system (accessible via the topic page in the Search Funding & Tenders section). Paper submissions are NOT possible.
Proposals must be complete and contain all the requested information and all required annexes and supporting documents:
- Application Form Part A — contains administrative information about the participants (future coordinator, beneficiaries and affiliated entities) and the summarised budget for the project (to be filled in directly online)
- Application Form Part B — contains the technical description of the project (template to be downloaded from the Portal Submission System, completed, assembled and re-uploaded)
- mandatory annexes and supporting documents (templates to be downloaded from the Portal Submission System, completed, assembled and re-uploaded):
- ownership control declarations (including for associated partners and subcontractors)
Proposals are limited to maximum 70 pages (Part B).
Call documents
Call Document DIGITAL-ECCC-2025-DEPLOY-CYBER-08Call Document DIGITAL-ECCC-2025-DEPLOY-CYBER-08(kB)
Contact
applicants@eccc.europa.eu
Website
To see more information about this call, you can register for free here
or log in with an existing account.
Log in
Register now