PKI for Space Systems: Rethinking Certificates for the Post-Quantum Era

Federated space missions such as Artemis and LunaNet need secure, interoperable communication across independently governed agencies, and public key infrastructure (PKI) is the natural foundation. Yet current CCSDS guidance adopts the terrestrial X.509 Internet profile without adaptation, bringing an extensive, unrestricted feature set to resource-constrained spacecraft, and the transition to post-quantum cryptography inflates certificates and revocation data further. This talk examines the standardisation gap. It compares post-quantum certificate formats for a federation, proposes a minimal certificate profile, and asks whether the emerging IETF C509 encoding offers enough benefit to justify adoption: our evaluation with the first open-source native C509 toolkit shows roughly 40% smaller traditional certificates, 60% smaller revocation lists and about 80% less parser code, but savings that plateau at around 200 bytes once post-quantum keys and signatures dominate. The talk closes with what remains unsolved, certificate validation on constrained and intermittently connected assets, and with delegated validation, the subject of an experiment selected for ESA’s CyberCUBE in-orbit cybersecurity platform. The talk is based on work with the European Space Agency, published at Security for Space Systems (3S) 2025 as “Towards Minimal Certificates for Federated Space Public Key Infrastructure”.