SEAL SQ describes four key regulatory shifts reshaping post-quantum cryptographic compliance, with the National Security Agency’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) emerging as the defining benchmark for both national security systems and commercial markets. Initially defined for National Security Systems, CNSA 2.0 is widely recognized as the standard that will extend to commercial and regulated markets, establishing an expectation that CNSA 2.0 algorithms should be supported and preferred. This expectation follows NIST’s finalization of its first set of post-quantum cryptographic standards in August, moving the transition beyond theoretical concerns and creating concrete benchmarks for implementation. The increasing regulatory pressure reflects a present-day imperative, driven by the threat of adversaries collecting encrypted data for future decryption, a “harvest now, decrypt later” scenario, and impacting device lifecycles that can span a decade or more.
Secure boot and root of trust The hardware root of trust is the most critical element in any embedded system
The hardware root of trust is receiving increased scrutiny as regulatory bodies mandate cryptographic agility. Keys permanently embedded in read-only memory or one-time programmable memory during manufacturing present a unique challenge; these cannot be updated after deployment, meaning any vulnerability in the underlying algorithms remains indefinitely. If these foundational keys rely on algorithms susceptible to quantum computing attacks, the device is permanently exposed, a risk that is driving a shift toward post-quantum cryptography. CNSA 2.0 algorithms should be supported and preferred, even before they become strictly required by broader regulations. These milestones represent more than guidance; they define the compliance trajectory for secure systems worldwide, demonstrating alignment between national security priorities and industry standards. Experts anticipate that the long-term security of embedded systems will increasingly depend on the integrity of this hardware root of trust and the algorithms it supports. A critical point is that keys embedded in ROM or OTP at manufacturing cannot be updated once deployed, highlighting the need for proactive, future-proof security measures.
Firmware signing and verification Firmware integrity relies on digital signatures that must remain secure over the full device lifecycle
The foundation of embedded system security currently rests on digital signatures verifying firmware integrity throughout a device’s operational lifespan, but this established process is evolving to meet the need for post-quantum resilience. Anticipating the increased computational demands is now paramount, as the adoption of post-quantum algorithms introduces larger signature sizes and, consequently, higher verification costs. These changes are not merely theoretical considerations; manufacturers must proactively address the impact on memory architecture and boot processes to ensure continued functionality and security. CNSA 2.0 algorithms should be supported and preferred, and the transition to post-quantum cryptography defines the compliance trajectory for secure systems worldwide. As devices evolve and face new threats, firmware integrity relies on digital signatures that must remain secure over the full device lifecycle, highlighting the continuous need for robust verification mechanisms.
Post-quantum alternatives such as ML-KEM are required to ensure long-term confidentiality of device communications.
Systems with limited update capability Many deployed devices cannot be upgraded to support post-quantum cryptography
This presents a structural risk, demanding either costly hardware redesigns or the implementation of complex, system-level compensating controls to maintain security as quantum computing capabilities advance. Devices designed today with classical cryptography risk becoming vulnerable and non-compliant within their operational lifetime. SEAL SQ highlights that this limitation is not merely a technical challenge, but increasingly a regulatory one, as governments and standards bodies begin to formalize post-quantum requirements. The company’s QS7001 security platform and QVault Trusted Platform Module enable features that support secure key storage, cryptographic operations, and resistance to physical attacks. These platforms are built to support hybrid cryptography, combining classical and post-quantum algorithms, and facilitate the progressive integration of new PQC standards as they mature. Looking ahead, compliance with standards like Common Criteria (EAL5+) and FIPS 140-3 will become essential for demonstrating due diligence, even before post-quantum cryptography is formally mandated.
SEALSQ’s INeS PKI platform further supports this transition by offering secure digital identity and certificate management, enabling secure device onboarding and authentication. This combined hardware and software approach aims to accelerate certification processes and reduce integration complexity for manufacturers facing evolving regulatory landscapes and the urgent need to secure devices against future quantum threats.
The transition to post-quantum cryptography is no longer just a technical issue – it is becoming a regulatory and compliance requirement.
