Rishabh Das of J. Warren McClure School of Emerging Communication Technologies, along with colleagues, has developed AMORT-V1, a checkpointed attestation protocol that reduces the cost of quantum-safe industrial controllers by 90 times relative to existing methods without durable logging. Programmable logic controllers, often deployed for decades, require long-term post-quantum security, yet prior measurements showed post-quantum signing consumed 88-99% of round-trip latency. The team validated the protocol using a seven-node Raspberry Pi 5 testbed and five physical OpenPLC provers, achieving transferable device-origin verification in 2.95 μs per report.

Checkpointing Reduces Costs for Quantum-Safe PLCs

This cost reduction stems from shifting public-key signing and durable commitment from individual reports to periodic checkpoints, a strategy that significantly minimizes computational load. The protocol further improves efficiency by 878 times when durable logging is required, demonstrating substantial savings in resource use for long-lived programmable logic controllers. AMORT-V1 employs a device-held disclosure chain, releasing keys only after checkpoint commitment, to ensure transferable proof of device origin without incurring per-report costs.

Devices build Merkle roots over accumulated reports, signing them with ML-DSA keys to immediately prove authorship independent of controller involvement. This approach amortizes the post-quantum signature operation across multiple reports, further optimizing performance.

AMORT-V1 Protocol: Checkpointed Attestation Design

AMORT-V1 establishes per-device evidence keys using an ML-KEM epoch, a critical first step in its checkpointed attestation protocol, and moves costly public-key signing to periodic checkpoints rather than individual reports. This approach addresses the long-term security requirements of programmable logic controllers, which often operate for decades and now face the emerging threat of quantum computing. The protocol authenticates each report with a message authentication code, or MAC, under the established key, and then commits these reports through hash-chained Merkle checkpoints.

The researchers investigated how checkpoint intervals balance reduced post-quantum costs against the potential for delayed omission detection, framing this as their first research question. They also explored whether AMORT-V1 could restore publicly transferable device-origin authentication, even after replacing per-report signatures with symmetric evidence, and at what computational cost.

This focus on device-origin verification is central to the protocol’s design, as shared MACs alone do not provide sufficient proof of a device’s identity. The work further examines whether per-device epochs can maintain failure isolation and support recovery from events like revocation, re-keying, or device restart without relying on persistent hardware operations for every report. Three key contributions define the AMORT-V1 protocol, according to the study: the checkpointed post-quantum attestation method itself, a system for transferable device-origin authentication using symmetric evidence, and mechanisms to preserve failure isolation and enable recovery from various failure scenarios.

“These mechanisms provide a path toward long-lived post-quantum attestation for controller fleets without placing expensive cryptographic or durable-state operations on every report,” the authors state. They acknowledge that checkpointing cannot reduce the cost of repeatedly measuring large software images, suggesting future work should combine AMORT-V1 with incremental measurement techniques, hardware assistance and trusted measurement-state caching to further optimize performance.

An ML-KEM epoch forms the basis for per-device evidence keys within the AMORT-V1 protocol, shifting the burden of public-key signing away from each individual report to periodic checkpoints.

MAC Authentication and Hash-Chained Merkle Checkpoints

The protocol uses hash-chained Merkle checkpoints, signed with either ML-DSA or SLH-DSA, to commit ordered evidence, establishing a secure and verifiable history of device activity. The design addresses a critical limitation of symmetric evidence, its inability to prove device origin to external parties, by incorporating a device-held disclosure chain. This chain restores transferable device-origin authentication only after checkpoint commitment, adding a layer of security without compromising performance.

At each checkpoint, a record containing the tree root, the hash of the previous checkpoint, the total leaf count and a tuple for each device is signed, creating an auditable trail of activity. This chaining of checkpoints allows detection of equivocation if the controller were to sign conflicting records for the same position. The separation of continuous evidence generation from public verification and durable commitment is a key innovation within AMORT-V1.

This structure allows for a configurable tradeoff between attestation overhead and detection delay, providing flexibility for different deployment scenarios. The protocol’s design also supports rollback-resistant restart through TPM-backed monotonic state without placing durable hardware operations on the per-report path.

Device-Origin Verification via Disclosure Chains

Every report also includes a per-device sequence number, incrementing with each transmission to further enhance accountability. Beyond enhanced security, AMORT-V1 significantly reduces the computational burden on industrial controllers. “AMORT-V1 restores transferable device-origin authentication without a public-key operation on each report,” the researchers state, highlighting the protocol’s efficiency. The work demonstrates that checkpointing alone is insufficient, but when combined with a disclosure chain, it provides a robust and cost-effective solution for long-term post-quantum attestation in industrial control systems.

The benefits of checkpointing are particularly pronounced when durable logging is required, where the cost reduction jumps to 878 times. AMORT-V1 also supports rollback-resistant restart through TPM-backed monotonic state without placing durable hardware operations on the per-report path.

Rollback Resistance Through TPM-Backed Monotonic State

The research details three methods for resisting rollback attacks: fresh-epoch recovery, an unanchored reservation scheme, and a Trusted Platform Module (TPM)-backed reservation scheme, evaluated at a reservation window of 64. Re-keying costs ranged from 3.54 milliseconds for 100 identities to 351 milliseconds for 10,000, highlighting the computational demands of maintaining secure communication channels. The TPM-backed reservation scheme successfully detected all 150 attempts to use stale states, while the unanchored scheme re-issued 19200 sequence numbers, indicating a significant vulnerability.

“Epoch state confines revocation and re-keying to one identity, fresh-epoch recovery makes any lost evidence visible, and TPM-backed reservation stops sequence reuse under rollback while keeping the TPM off the per-report path,” the researchers state. The TPM-backed approach achieves a ready state in 10.39 milliseconds, slightly slower than the 5.63 milliseconds of fresh-epoch recovery, but offering substantially improved security against malicious actors.

A complete TPM-backed reservation requires 15.77 milliseconds, a trade-off for robust protection against compromised devices. With an assumed non-volatile write budget of 5 x $10^{5}$ writes, a ten-year service life necessitates a reservation window of at least 631.

👉 More information
🗞 AMORT-V1: Checkpointed Post-Quantum Attestation for Industrial Controllers
✍️ Rishabh Das, Gerald Agendia, Jibriel Adjei and Ahmed Oun
🧠 ArXiv: http://arxiv.org/abs/2611.07476v1

More like this