agenda/minutes for TAC meeting on May 6, 2026

meeting-minutes/2026/2026-05-06-TAC.md

@@ -0,0 +1,142 @@
+---
+layout: default
+title: 2026-05-06 TAC Meeting Record
+parent: 2026
+grand_parent: Meeting Minutes
+---
+
+# Post-Quantum Cryptography Alliance - Technical Advisory Council (TAC) Meeting 06 May, 2026
+[**View Recording**](https://zoom.us/rec/share/Xq0RMk98Eo2ptmiadtDTqltRZ-3rOrhUTx4IWdLHnjxhOPiwh-GEcnPTe8QUIfZ9.JID0sNOfo2LGUDua)
+*Recordings are also available on your [Open Profile](https://openprofile.dev/my-meetings) page under Past Meetings*  
+[**Join the meeting**](https://zoom-lfx.platform.linuxfoundation.org/meeting/98559442147?password=5e9d28b7-97d4-4628-9087-5f359dbf3d80)  
+[**PQCA Meeting Calendar**](https://pqca.org/calendar/)  
+[**Discord Server**](https://discord.pqca.org ))
+
+---
+
+### **Antitrust Policy Notice**
+
+Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at [linuxfoundation.org/antitrust-policy](https://linuxfoundation.org/antitrust-policy). If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.
+
+---
+
+## Voting Representative Attendance (_Alphabetical by 1st name_)
+### Premier Member Representatives
+
+* [x] Brian Jarvis, AWS
+* [ ] ~~Michael Maximilien, IBM~~
+* [ ] ~~Norman Ashley, Cisco (OQS Rep)~~
+* [ ] ~~Sophie Schmieg, Google~~
+
+ ### Project Representatives
+* [x] Matthias Kannwischer, TCR
+* [ ] ~~Hanno Becker, AWS (PQCP)~~
+* [x] Andreas Schade, IBM (CBOMkit)
+* [x] Aditya Koranga, NgKore \[TAC Chair\]
+
+## Non-Voting Representative Attendance
+
+### LF Staff 
+* [x] Christina Harter 
+* [x] Hart Montgomery 
+* [ ] ~~Min Yu~~
+
+### Other Attendees
+* [ ] Andy Warner, Google
+* [ ] Katarina, Siemens 
+* [ ] Matthew Garrow-Fischer, Horizen Labs
+* [ ] Sumanth B., Genpact
+
+---
+# Meeting Agenda
+- LFX Mentorship accepting applications until May 22nd: https://mentorship.lfx.linuxfoundation.org/project/bdbecf7d-baaa-4adc-98a0-2ecbb4e8f05c
+- Working Group Proposal: https://github.com/PQCA/TAC/issues/139
+  - Confirm WG Name
+  - Confirm first members (and a Chair)
+  - Confirm meeting cadence (meetings open to the public)
+  - Mailing list? Discord channel?
+  - Draft Charter: [template here](https://docs.google.com/document/d/1R-bKcAbTbwYWLJ42yGiagGT2uduKlYVNnqSPIgrB24E/edit?usp=sharing)
+- Follow up: Invitation to OpenSSF team members for security baseline discussion
+- Blog: CBOMkit pipeline
+- Project updates 
+
+# Discussion & Updates
+
+### **Introduction of 1st Time Attendees**
+Sumanth from Genpact introduced himself as a Banking Solutions Architect based in Bangalore with interest in learning more about PQC migration and readiness efforts. Andy noted that Google is also actively working through PQC migration challenges and offered to share several relevant Google blog posts and resources after the meeting.  
+
+---
+### LFX Mentorship Program Updates  
+Aditya shared updates on the LFX Mentorship Program proposal to extend language and library support for CBOMkit. The proposal has generated significant community engagement, resulting in a large increase in pull requests submitted to both CBOMkit and Sonar Cryptography repositories.  
+
+Andreas noted concerns around the volume and quality of some submissions, suspecting that several may be AI-generated or low-quality contributions. Aditya clarified that mentee evaluations will begin after the **May 22 application deadline**, at which point the team will review applicants and select participants.  
+
+---
+
+### Readiness Tracking Working Group Launch  
+The primary focus of the meeting was finalizing the launch of the new working group proposed by Andy from Google to track PQC compatibility and readiness across cryptographic libraries, software, and related open-source projects.  
+
+Following prior TAC approval via GitHub issue discussion, the group finalized the working group name as **Readiness Tracking Working Group**. Andy confirmed Google will participate as the initial member organization and agreed to serve as the inaugural chair.  
+
+The TAC agreed on the following working group structure:  
+- **Public working group** open to all interested participants  
+- **Monthly meetings** to reduce meeting fatigue and align with contributor bandwidth  
+- GitHub repository and mailing list to be created under PQCA  
+
+Christina offered to support initial setup by creating the GitHub repository and mailing list. Andy will coordinate scheduling for the first meeting and define initial governance and contribution guidelines, including determining what documentation or references can be linked within readiness tracking entries (e.g., technical documentation vs. marketing content).  
+
+The group also discussed how to handle closed-source software and proprietary readiness claims. Andy proposed using standard embargo-style practices for vendors not yet ready to publicly disclose readiness information.  
+
+---
+
+### OpenSSF Presentation Follow-Up  
+Hart previously connected the TAC with the OpenSSF team regarding their security baselines initiative. Aditya agreed to follow up on Hart’s email and propose dates for an upcoming PQCA TAC Meeting presentation from the OpenSSF team. This remains a pending action item from previous meetings.  
+
+---
+
+### Blog Review Updates  
+Christina shared that the **CBOMkit pipeline blog post** has been updated following prior feedback. Katarina confirmed all requested comments had been addressed.  
+
+Aditya and Brian will complete a final review before publication approval. Christina will prompt the content review team for one additional review cycle to move the blog post toward publication.  
+
+---
+
+### Project Updates  
+
+#### OQS
+No representative present on the call.
+
+#### CBOMkit  
+Andreas shared several CBOMkit updates, including:  
+- New **Open Policy Agent (OPA)** support for external policy evaluation  
+- Continued expansion of supported libraries and integrations  
+- New outreach from DB Systel regarding collaboration opportunities  
+
+The team also noted ongoing work to manage contributor quality amid increased project visibility from the mentorship program.  
+
+#### PQCP  
+Matthias reported that:  
+- **mldsa-native memory optimizations** are now complete  
+- CBMC proofs are also complete  
+- A new release is expected within the next **1–2 weeks**  
+
+Rust crate bindings and additional integration improvements remain in progress.  
+
+---
+
+### **Next Steps / Action Items**
+
+| Action Item | Owner | Status / Due Date |
+|---|---|---|
+| Contact OpenSSF team to schedule participation in an upcoming PQCA TAC Meeting (refer to Hart’s email and suggest dates) | Aditya | Before next TAC meeting |
+| Set up mailing list and GitHub repository for the new Readiness Tracking Working Group | Christina | Before first working group meeting |
+| Confirm date/time for the first Readiness Tracking Working Group meeting | Andy | Before next TAC meeting |
+| Establish contribution/linking guidelines for the Readiness Tracking Working Group (e.g., approved source documentation only) | Andy / Working Group | First working group meeting |
+| Notify Aditya or Andy if interested in joining the Readiness Tracking Working Group | All interested members | Ongoing |
+| Review updated CBOMkit pipeline blog post to confirm all comments are addressed | Aditya & Brian | Before publication |
+| Prompt content review team for final review of the CBOMkit pipeline blog post | Christina | This week |
+| Share Google PQC migration blog resources with Sumanth | Andy | After meeting |
+
+---
+
+**Adjourned:** 7:38am PT.