# Why IoT Manufacturers Must Act Now on Quantum-Safe Security
## The Coming Threat to Connected Devices
The world of connected devices is on the brink of a security transformation. Tomorrow’s quantum computers will be powerful enough to break the encryption methods that protect today’s Internet of Things (IoT) devices. For manufacturers building products with long lifespans, this is not a distant hypothetical — it is a pressing design decision that must be made before the hardware is finalized.
When a manufacturer locks in a microcontroller’s flash memory, bootloader, and key storage during the design phase, those choices remain unchanged for the entire life of the product line. If the cryptography protecting firmware updates becomes vulnerable, every device already shipped could be exposed to malicious software masquerading as a legitimate update.
## What Happens When Firmware Signatures Fail
Every IoT device trusts a specific digital signature algorithm to verify that its firmware is genuine. This trust is anchored in a public key stored in read-only memory or protected flash storage. Once a device is manufactured, that anchor cannot be changed without hardware revision.
If a quantum computer renders the current signature algorithm obsolete, attackers could create forged firmware updates that pass verification. Unlike encrypted network traffic that might be recorded and decrypted later, a forged firmware signature represents an immediate and direct attack vector. A compromised device in the field could be bricked, hijacked, or turned into a vector for larger network attacks.
Replacing every unit in the field is far more expensive than adding a few extra megabytes of flash memory to the bill of materials during the design phase. A proactive approach to quantum-safe cryptography is simply good business.
## Regulatory Timelines Driving the Transition
Governments and standards bodies have established clear timelines that manufacturers must follow:
– **The U.S. National Security Agency (NSA)** recommends that all new software and firmware for national security systems be signed with quantum-resistant algorithms by 2025, with full deployment completed by 2030.
– **NIST** has published a transition plan that proposes deprecating traditional algorithms like RSA and ECDSA at commonly used security levels after 2030, and banning them entirely by 2035.
– **The European Union** recommends that member states begin transitioning to post-quantum cryptography by the end of 2026, with high-risk applications fully migrated by the end of 2030. The EU Cyber Resilience Act, taking effect in December 2027, will require manufacturers to provide security updates for their products throughout a defined support period — meaning quantum readiness must be built in from day one.
## The Hidden Costs of Larger Encryption Keys
Quantum-safe algorithms require significantly more data than their classical counterparts. Even the most compact versions of new signature schemes demand over a kilobyte for public keys and more than two kilobytes per signature. For devices with limited memory and narrow radio channels, this creates real engineering challenges.
Boot times increase when verification requires more computational work. One team implementing post-quantum secure boot found that verification time jumped from three milliseconds to over thirty milliseconds. They resolved this by adding dedicated hardware acceleration, but sourcing and integrating such a component takes time that must be accounted for before the design is finalized.
Wireless communications are even more affected. In smart home protocols like Matter running over Thread, switching to a pure post-quantum handshake more than doubles the size of each data transmission. Given that a Thread radio frame can carry only 127 bytes at a time, this expansion creates serious bandwidth challenges. A hybrid approach — pairing a classical algorithm with a post-quantum one — allows manufacturers to stay within existing limits while gradually migrating to fully quantum-safe communications.
## Building Flexibility Into Device Architecture
Crypto agility is the ability for a device to switch encryption algorithms through a software update without requiring new hardware. Achieving this on a microcontroller requires a bootloader capable of handling multiple signature algorithms and a secure, updatable storage location for trust anchors.
Designers are advised to keep cryptographic parameters out of hardcoded source code so that algorithms can be swapped as standards evolve. For new designs, replacing older signature schemes with quantum-resistant alternatives is recommended. Some approaches require both old and new signatures to be valid during a transition period, ensuring backward compatibility while building forward security.
This dual-signature strategy increases the size of each firmware update, which means manufacturers must plan for longer transfer times, more retry attempts, and carefully staged rollouts. The dual-signature phase should be treated as a normal operational state lasting several years.
## Five Critical Questions for Component Suppliers
Before locking in a hardware design, IoT manufacturers should obtain written answers to the following questions from their suppliers of microcontrollers, cellular modules, and secure elements:
1. **Algorithm support**: Which post-quantum algorithms does the bootloader or secure element support today, and which ones can be added through a future firmware update?
2. **First boot stage**: Can the immutable boot stage verify a hybrid signature, and is its root key replaceable after the device has been shipped?
3. **Hardware acceleration**: What acceleration hardware is available, and how much RAM and flash does the supplier’s cryptographic library require?
4. **Side-channel protection**: Which physical attack countermeasures and certifications (such as FIPS 140-3 or Common Criteria) cover the post-quantum functions?
5. **Update commitment**: Can the supplier guarantee security updates for the component throughout the entire product support period required under regulations like the EU Cyber Resilience Act?
## Setting Up Your Signing Infrastructure
Manufacturers also need to prepare their own signing environments. Some quantum-safe signature schemes use one-time keys that must be carefully tracked. NIST permits this tracking only within certified hardware security modules operating at security level 3 or higher.
Placing signing keys inside a dedicated key management system — separate from the build system — adds a layer of security and control. It is essential to have this signing infrastructure fully operational before the first device begins verifying quantum-safe signatures.
## Planning for Devices Already in the Field
For fleets of devices already deployed, a gateway-based approach can limit exposure during the transition period. By having gateways handle quantum-safe communications toward the cloud using protocols like hybrid TLS 1.3, the sensitive radio link between the gateway and the cloud is protected while the older links between devices and gateways are gradually upgraded.
The transition from algorithm selection to working hardware can take eight months or more. That timeline can only be met if cryptographic requirements are addressed before the design freeze, not after.
## Frequently Asked Questions
**Q: What is a cryptographically relevant quantum computer?**
A: It is a quantum computer powerful enough to solve the mathematical problems that underpin current encryption schemes like RSA and elliptic-curve cryptography. When such machines become available, they will be able to break the digital signatures that verify firmware authenticity.
**Q: Why is firmware signing more urgent than encrypted network traffic?**
A: Encrypted network traffic can potentially be recorded now and decrypted later when quantum computers arrive. Firmware signatures, however, represent a direct trust anchor. Once the underlying algorithm is broken, attackers can immediately distribute malicious updates that devices will accept as legitimate.
**Q: What is crypto agility?**
A: Crypto agility is the ability of a device to switch between encryption algorithms through a software update, without requiring any hardware changes. This is achieved through a flexible bootloader and updatable trust anchor storage.
**Q: What is a hybrid key exchange?**
A: A hybrid key exchange pairs a classical encryption algorithm with a post-quantum one. This keeps communications secure against both current and future threats while staying within the size limits of existing protocols and radio standards.
**Q: Why are NIST and the EU setting deadlines for this transition?**
A: These organizations recognize that quantum computing will eventually break widely used encryption. By setting clear deadlines, they give manufacturers and organizations time to migrate to quantum-safe algorithms before the threat becomes active.
**Q: Can existing IoT devices be made quantum-safe after deployment?**
A: It depends on the device architecture. Devices with crypto agility — flexible bootloaders and updatable trust anchors — can be upgraded through firmware. Devices without these features may need hardware replacement.
**Q: How much extra flash memory do post-quantum algorithms require?**
A: The smallest standardized post-quantum signature scheme requires over 1,300 bytes for a public key and over 2,400 bytes per signature. This is significantly larger than current algorithms and must be factored into the bill of materials.
## Conclusion
The transition to quantum-safe cryptography is not optional for IoT manufacturers — it is a design requirement that must be addressed before hardware is finalized. Regulatory timelines from NIST, the NSA, and the European Union are already in motion, and manufacturers who wait until after design freeze risk creating products that will be vulnerable the moment quantum computers become capable of breaking current encryption.
By asking the right questions of suppliers, building crypto agility into bootloaders, planning for larger data sizes in wireless protocols, and setting up quantum-ready signing infrastructure in advance, manufacturers can protect their products — and their customers — for decades to come. The cost of preparation is a fraction of the cost of a full product recall.
Thank you for reading
