How an associate member put the Alliance’s open-source stack to work — and made post-quantum migration a continental conversation.
When the Post-Quantum Cryptography Alliance opens its tooling and standards work to the community, the return isn’t always visible right away. Here is a case where it was.
On 26 June, the Africa Quantum Consortium (AQC) — a PQCA associate member — convened a two-hour working session, “Securing Africa’s Digital Backbone,” that drew registrations from more than twenty African countries. The room was deliberately mixed: students and university researchers alongside chief information security officers from African banks, and international practitioners including Professor Çetin Kaya Koç, founder of the CHES conference, and IBM Quantum Safe CTO Michael Osborne. PQCA hosted the event’s promotion, and the Alliance’s work sat at the center of the practical guidance that came out of it.
The through line of the session will be familiar to anyone in this community: the hardest part of migration isn’t the cryptography. “Nobody knows where the cryptography is,” Osborne told the room — across infrastructure, virtualization, and APIs, the first wall is discovery, not algorithm choice. Aditya Koranga, chair of PQCA’s Technical Advisory Committee, described hitting the same wall inside major banks: “nobody knew who to point us to.”
What made the session land for its audience was the answer Koranga gave next — and it ran directly on PQCA’s stack. For institutions that can’t afford expensive consultants, he pointed out, the tooling to begin is free and open: CBOMkit to build a cryptographic bill of materials, Open Quantum Safe for the algorithm implementations, and the PQ Code Package. He reminded the room how much is already in motion unnoticed — OpenSSL 3.5 now ships post-quantum key exchange by default — and made the discovery method concrete: start least-intrusive, with logs and outputs, then APIs, then networks, and only last the code and binaries, because a bank “won’t even let you touch their binary.”
For a region where much of the digital backbone is bought rather than built, that framing matters. The practitioners in the room converged on procurement as the highest-leverage move — naming standardized algorithms in contracts, requiring a CBOM from suppliers, and making crypto-agility a demonstrated condition rather than a marketing claim. It is the same discipline PQCA’s tooling is designed to support, applied to a continent that runs more of its economy through mobile money than anywhere on earth: over a trillion dollars a year, across 1.2 billion accounts.
The session was also candid about what isn’t ready. On quantum key distribution, three specialists — from Toshiba Europe, QRate, and Qubo Consulting — agreed it remains unstandardized and not backbone-ready, complementing post-quantum cryptography rather than replacing it. That discipline — keeping the science honest — is exactly the posture the Alliance’s work encourages.
AQC used the roundtable to launch a coordinating body for the region: the Pan-African Quantum Communications and Security Alliance (AQCSA), intended to turn a single session into shared inventory practice, common procurement language, and an African presence in the standards being written this year. Its first ask of any institution is deliberately small, and it will sound familiar to this community: name an owner, and start an inventory.
It is a reminder of what the associate-member model is for. Open tooling, made available to the field, gets picked up in places and by people the founders never had to reach directly — and turns into readiness on the ground. In under two months as a member, AQC has taken PQCA’s work from repository to a continental roundtable – that is the model we intended.
The full roundtable recording and AQC’s readiness whitepaper are available here:
▶ Watch the session: VIDEO LINK
▶ Read the white paper: WHITE PAPER LINK
▶ Institutions and individuals who want to get involved can express interest in AQCSA here: [FORM LINK]