Post-quantum Lab experimental region

PKIaaS customers can test the algorithms listed in the post-quantum (PQ) cryptography standard of the NIST (National Institute of Standards and Technology).

https://www.nist.gov/programs-projects/post-quantum-cryptography

Specifically, Entrust provides a "PQ Lab" sandbox experimental region to create CA hierarchies (root CA + issuing CA). This region has the limitations described in the following table.

Feature	PQ Lab limitations
Key generation mechanism	liboqs (https://openquantumsafe.org/liboqs) open-source software library for post-quantum keys; Entrust nShield HSMs for RSA and ECDSA keys. In future releases, PKIaaS will support post-quantum key generation using Entrust nShield HSMs.
PKIaaS Certificate Practice Statement and associated terms	Do not apply.
CA validity	A maximum of 6 months.
External CAs onboarding	Not supported.
Region and Data availability	Not guaranteed.
Enrollment Gateway	Not supported. The PQ Lab region does not support customer-hosted (on-premises) or Entrust-hosted enrollment gateway features.

Entrust might rebuild the PQ Lab region from time to time to reflect the latest changes from the post-quantum standards initiatives. On these occasions, your data in this region might be destroyed. We don't recommend deploying post-quantum CAs and certificates to your production environment.

To test post-quantum algorithms with the PQ Lab region

Make sure you have unused licenses to issue an online root CA/issuing CA and certificates.
In the Region list, select PQ Lab (Experimental).
Select a post-quantum algorithm in the Signing Key Details list.
Fill in the rest of the fields described in Creating an online root CA.
Follow the steps described in Creating an issuing CA under an online root CA.
Create a certificate request, for example, using the openquantumsafe/oqs-ossl3 tool. Alternatively, you can copy one of the below sample requests.
- Pure post-quantum algorithms
- Explicit composite algorithms
The Certificate Authorities of the PQ Lab region can also issue RSA and ECDSA certificates; use your existing tools to generate requests for these certificates.
Issue end-entity certificates using either:
- Entrust Certificate Services Enterprise, as explained in Processing a Certificate Signing Request.
- The API described in Accessing the CA Gateway API.
In the current version, PKIaaS does not support issuing post-quantum certificates in PKCS #12 format.