Post-Quantum Readiness for Long-Lived IoT Devices Begins at Design Freeze

Manufacturers finishing an IoT device today decide, through flash memory and bootloader design, whether it will still receive secure updates after 2030. NIST and EU deadlines, larger signatures, and chip suppliers’ commitments must therefore be considered before design freeze.

Once a hardware design is frozen, flash size, boot code, and key storage are fixed for the entire product line. Today, manufacturers protect firmware updates and network connections with RSA and elliptic-curve cryptography. A cryptographically relevant quantum computer, meaning a machine that can solve the mathematical problems behind both schemes, would break that protection.

Forged Updates Put Devices in the Field at Risk

For manufacturers of long-lived devices, firmware signatures pose a more immediate concern than traffic that attackers might record today and decrypt later. A device that verifies its firmware with ECDSA, the elliptic-curve signature algorithm, trusts that algorithm until its trust anchor is replaced. The trust anchor is the public key in boot ROM or protected flash against which the device checks every signature. If that key cannot be changed, the device will accept a forged update from the day ECDSA is broken.

An Internet Engineering Task Force (IETF) draft on post-quantum cryptography for constrained devices puts it this way: “If firmware verification relies on traditional signature algorithms, attackers could generate forged signatures in the future and distribute malicious updates.” The manufacturer may then have no choice but to replace devices in the field. A little more flash on the bill of materials costs less than a service call for every unit.

Manufacturers that supply devices for U.S. national security systems face earlier dates. In its CNSA 2.0 algorithm suite, the National Security Agency (NSA) recommends that new software and firmware for these systems be signed with the new algorithms by 2025 and that all deployed firmware be transitioned by 2030.

Regulators Set Deadlines Starting in 2030

NIST, the U.S. standards agency, has also established a timeline for the transition. In its draft transition plan, NIST IR 8547, it proposes deprecating RSA and ECDSA at the widely used 112-bit security level after 2030 and disallowing classical algorithms after 2035. The European Commission recommends that member states begin the transition to post-quantum cryptography by the end of 2026 and move high-risk use cases over by the end of 2030.

Starting in December 2027, the EU’s Cyber Resilience Act (CRA) requires every manufacturer to set a support period during which it handles vulnerabilities in its product. For a device launched in 2028 with support into the 2030s, the EU and NIST deadlines fall within the years its maker is still responsible for security updates.

Larger Signatures Consume Flash and Radio Capacity

NIST has standardized ML-DSA for firmware signatures and ML-KEM for key exchange. Even the smallest ML-DSA parameter set needs 1,312 bytes for the public key and 2,420 bytes for each signature. Image headers, certificate fields, and key slots in today’s designs cannot hold values of that size. Manufacturers should therefore add the extra flash to the bill of materials before design freeze.

Boot also takes longer. Jefferson Ricardini, a cryptographer at Amazon in São Paulo who has spent more than a decade implementing cryptography for constrained systems, described a secure boot project in a paper for the ACM workshop QRSEC 2025. Verifying a post-quantum signature took 34 milliseconds there, compared with 3 milliseconds for the previous hardware-accelerated check. The team then added a dedicated accelerator to the chip. Sourcing and integrating that block took longer than planned. Manufacturers should order such components before design freeze.

The impact on radio communications is even more significant. In the smart home standard Matter running over the Thread radio protocol, a drop-in post-quantum handshake grows from 1.6 kB to 22.8 kB. A Thread radio frame carries at most 127 bytes. A hybrid key exchange, which pairs a classical algorithm with a post-quantum one and keeps the existing certificates, stays within Matter’s message limit. Makers of Matter devices can protect their session keys this way without changing the radio technology.

A Flexible Bootloader Keeps Devices Updatable

Crypto agility means a device can switch algorithms and trust anchors through a signed update, with no new hardware. On a microcontroller, that requires a bootloader that supports more than one signature algorithm and a protected, updatable store for trust anchors. Stefan Schumacher, a security architect at the German public-sector IT provider Dataport, pointed to the earlier move from 3DES to AES in a conference talk and advised keeping key sizes and parameters out of source code.

In a Linux Foundation talk, Ajith P Venugopal described how an embedded Linux device checks an RSA-signed image at boot against a key stored in one-time programmable (OTP) fuses, memory cells that can be written only once. For new designs, he proposed ML-DSA instead. When the key sits in such fuses, the choice of algorithm holds for the device’s entire service life.

The draft European standard ETSI EN 304 623 requires bootloaders with a replaceable trust anchor to support combined verification, for example a classical and a post-quantum signature on the same boot stage. The stage runs only if both signatures are valid. Ricardini’s team checks both signatures in the first boot stage, which is burned into ROM. The later stages, which can be replaced through updates, contain both algorithms but initially use only the classical one, reducing boot time until the manufacturer switches over.

Dual-signed images are larger and must still be transmitted over existing low-bandwidth wireless links, such as NB-IoT or Thread. Operators should plan for longer transfers, more retries, and staggered rollouts. Devices that replace their trust anchor need two partitions, so a failed update can fall back to the last working image, plus protection against older, vulnerable versions. The dual-signature phase should count as normal operations for years.

Five Questions IoT Manufacturers Should Ask Suppliers

Before design freeze, buyers of microcontrollers, cellular modules, and secure elements should obtain written answers to five questions that can be incorporated into supplier contracts. Protection against side-channel attacks, which extract keys through power consumption or timing, costs compute time. In a talk on post-quantum cryptography for embedded systems at CYSAT 2025, a speaker measured 30 times the runtime for post-quantum signatures with strong protection of this kind.

• Algorithms: Which post-quantum algorithms does the bootloader or secure element support today, and which can a firmware update add?
• First boot stage: Can the immutable stage verify a hybrid signature, and can its root key be replaced in the field?
• Acceleration: What hardware acceleration is available, and how much RAM and flash does the supplier’s library need?
• Side-channel protection and certification: Which countermeasures and which certification, for example FIPS 140-3 or Common Criteria, cover the post-quantum functions?
• Update commitment: Can the supplier commit to providing security updates for the component throughout the product’s required support period under the CRA?

The manufacturer’s own signing setup changes as well. Stateful hash-based signature schemes suit firmware signing, but the signing software has to keep track of every one-time key it has used. NIST allows that only inside certified hardware security modules (HSMs) at security level 3 or higher. In Ricardini’s project, the hash-based option failed because the HSM vendor could not handle that bookkeeping. Venugopal placed the signing key in a key management system, “probably not your build system,” as he said in his talk. Manufacturers should therefore have their signing systems, including suitable HSMs, in place before the first device checks the new signatures.

Devices already in the field need a separate plan. In October, IoT Business News described where healthcare devices and operational technology stand on post-quantum readiness, drawing on data from more than 2.5 million devices. In such fleets, a gateway that speaks hybrid TLS 1.3 as defined in RFC 10024 toward the cloud limits recordable traffic to the link between device and gateway. Ricardini’s project took eight months from algorithm selection to working hardware. Such a timeline can only be accommodated within a product development cycle if cryptographic requirements are addressed before design freeze.

The post Post-Quantum Readiness for Long-Lived IoT Devices Begins at Design Freeze appeared first on IoT Business News.