By Thomas Joos, freelance technology journalist and author.
Manufacturers of IoT devices today are deciding, through flash memory and bootloader design, whether they will still receive secure updates after 2030. NIST and EU deadlines, larger signs, and chip supplier commitments must be considered before the design is frozen.
After the hardware design is frozen, the flash size, boot code, and key storage are fixed for the entire product line. Today, manufacturers protect firmware updates and network connections with RSA and elliptic curve cryptography. A cryptographically relevant quantum computer, meaning a machine capable of solving the mathematical problems behind the scheme, would remove these protections.
Fake Updates Put Devices in the Field at Risk
For long-lived device manufacturers, firmware signatures pose a more pressing concern than traffic that an attacker can record today and decrypt later. Devices that verify firmware with ECDSA, an elliptic curve signature algorithm, trust the algorithm until the trust anchor is changed. The trust anchor is a public key in the boot ROM or protected flash to check the device for each signature. If the key cannot be changed, the device will receive fake updates from the day the ECDSA is broken.
The Internet Engineering Task Force (IETF) draft on post-quantum cryptography for constrained devices states as follows: “If firmware verification relies on traditional signature algorithms, attackers can generate fake signatures in the future and distribute malicious updates.” The manufacturer then has no choice but to replace the device in the field. A little more flash in the bill of materials costs less than the service call for each unit.
Manufacturers that supply devices for the US national security system face an earlier date. In the CNSA 2.0 suite of algorithms, the National Security Agency (NSA) recommends that new software and firmware for the system be signed with the new algorithm by 2025 and that all assigned firmware be transferred by 2030.
Regulators Set Deadlines Beginning in 2030
NIST, the US standards agency, has also drawn up a timeline for the transition. In the draft transition plan, NIST IR 8547, proposes deprecating RSA and ECDSA at the widely used 112-bit security level after 2030 and disallowing classical algorithms after 2035. The European Commission recommends that member states begin the transition to post-quantum cryptography by the end of 2026 and use 2026 in high-risk cases.
From December 2027, the EU Cyber Resilience Act (CRA) requires every manufacturer to set a support period when handling vulnerabilities in their products. For devices launched in 2028 with support in the 2030s, the EU and NIST deadlines fall in the years in which they are still responsible for security updates.
Larger signs use Flash and Radio Capacity
NIST has standardized ML-DSA for firmware signatures and ML-KEM for key exchange. Even the smallest ML-DSA parameter set requires 1,312 bytes for the public key and 2,420 bytes for each signature. Image headers, certificate fields, and button slots in the current design cannot hold these size values. Therefore, the manufacturer must add extra flash to the bill of materials before the design freezes.
Boot also takes longer. Jefferson Ricardini, a cryptographer at Amazon in São Paulo who has spent more than ten years implementing cryptography for constrained systems, described the secure boot project in a paper for the ACM QRSEC 2025 workshop. Post-quantum signature verification took 34 milliseconds there, compared to 3 milliseconds for previous hardware-accelerated checks. The team then added a custom accelerator to the chip. Sourcing and combining the blocks took longer than planned. The manufacturer must order these components before the design is frozen.
The impact on radio communications was even more significant. In the smart home standard Matter that uses the Thread radio protocol, the post-quantum drop-in handshake increases from 1.6 kB to 22.8 kB. A Thread radio frame carries a maximum of 127 bytes. Hybrid key exchanges, which combine classical algorithms with post-quantum algorithms and maintain existing certificates, remain within the limits of Matter messages. Matter maker tools can protect the session keys in this way without changing the radio technology.
Flexible Bootloader Makes Your Device Upgradable
Crypto agility means that devices can switch algorithms and trust anchors through signed updates, without new hardware. In microcontrollers, it requires a bootloader that supports more than one signature algorithm and an updatable store to anchor trust. Stefan Schumacher, a security architect at German public sector IT provider Dataport, pointed to the previous move from 3DES to AES in a conference talk and suggested that key sizes and parameters should not be in the source code.
In a Linux Foundation talk, Ajith P Venugopal explained how an embedded Linux device checks an RSA-signed image at boot against a key stored in a one-time programmable (OTP) fuse, a memory cell that can only be written to once. For the new design, he proposed ML-DSA. When the button sits on that fuse, the selection of the algorithm continues for the entire service life of the device.
The draft European standard ETSI EN 304 623 requires bootloaders with replaceable trust anchors to support joint verification, for example classical and post-quantum signatures at the same boot stage. The stage runs only if both signatures are valid. Tim Ricardini checked two signatures at the first boot stage, which was burned into the ROM. The next stage, which can be changed through an update, contains both algorithms but initially uses only the classic algorithm, reducing the boot time until the manufacturer switches.
Double-signed images are larger and still need to be transmitted over existing bandwidth wireless links, such as NB-IoT or Thread. Operators should plan for re-transfers, re-tests, and staggered rollouts. Tools that replace trust anchors require two partitions, so that failed updates can roll back to the last working image, plus protection against older, vulnerable versions. The dual-signature stage should be considered a normal operation for many years.
Five Questions IoT Manufacturers Should Ask Suppliers
Before the design is frozen, buyers of microcontrollers, mobile modules, and secure elements must obtain written answers to five questions that can be incorporated into the supplier contract. Protection against side channel attacks, which extract keys through power consumption or time, the cost of calculating time. In a discussion on post-quantum cryptography for embedded systems at CYSAT 2025, speakers measured 30 times the runtime for post-quantum signatures with strong protection of this type.
- Algorithm: What post-quantum algorithms support bootloaders or secure elements now, and which can improve firmware updates?
- First boot stage: Is the immutable level of hybrid signature verification, and its root key can be changed in the field?
- Acceleration: Is hardware acceleration available, and how much RAM and flash library the supplier needs?
- Side channel protection and certification: Do countermeasures and certifications, for example FIPS 140-3 or Common Criteria, cover post-quantum functions?
- Update commitment: Can the supplier commit to provide security updates for the component throughout the required support period of the product in CRA?
The manufacturer’s signature setup also changes. Stateful hash-based signature schemes are compatible with firmware signatures, but signature software must track each one-time key used. NIST allows only in certified hardware security modules (HSMs) at security level 3 or more. In Ricardini’s project, the hash-based option failed because the HSM vendor could not handle the bookkeeping. Venugopal places the signing keys in the key management system, “Maybe not your build system,” as he said in his speech. Therefore, manufacturers must have a signature system, including an appropriate HSM, before the first device checks for a new signature.
Equipment already in the field requires a separate plan. In October, IoT Business News described healthcare devices and operational technologies in post-quantum readiness, drawing on data from more than 2.5 million devices. In these fleets, gateways that use hybrid TLS 1.3 as defined in RFC 10024 to the cloud limit the traffic that can be recorded to the link between the device and the gateway. The Ricardini project took eight months from the selection of the algorithm to the hardware used. Such a timeline can only be accommodated in the product development cycle if the cryptographic requirements are addressed before the design is frozen.
