SEALSQ unveils VaultIC409 secure element to bring post-quantum security to IoT

[FairDos96]

Swiss chip company SEALSQ has launched the VaultIC409, a secure element designed to add post quantum cryptography to connected devices. A secure element is a dedicated security chip that stores keys and performs cryptographic operations away from the main processor. The Quantum Insider's article is largely based on SEALSQ's press release, so it is worth reading with that in mind

The chip is built on SEALSQ's QS7001 platform, which is going through Common Criteria EAL5+ certification. It is aimed at existing VaultIC408 customers who make smart meters, industrial gateways, communications equipment and cloud connected IoT devices. The selling point is that they can add quantum resistant security without redesigning their hardware security from scratch

On the technical side, it supports ML-KEM, the FIPS 203 standard for setting up keys, and ML-DSA, the FIPS 204 standard for digital signatures. It also keeps RSA and ECC for hybrid setups during the transition. There is a hardware root of trust, dedicated cryptographic accelerators, and an SPI interface to handle the larger keys and signatures that post quantum algorithms produce

SEALSQ ties the launch to the EU Cyber Resilience Act and the NSA's CNSA 2.0 roadmap, both of which push manufacturers towards stronger security. A TLS 1.3 demo is planned at Electronica in Munich from 10 to 13 November, with engineering samples due in the second quarter of 2027. The article also cites a forecast of 39 billion IoT devices by 2030

IoT security has a poor track record, so any product that makes strong cryptography easier to adopt is welcome. Devices like smart meters can stay in service for well over a decade. That makes them exactly the kind of hardware that needs protecting against future quantum attacks today

Are device makers moving fast enough on post quantum security? And does a drop in upgrade path like this make adoption more likely?

SEALSQ Unveils VaultIC409 Secure Element for Post-Quantum Cryptographythequantuminsider.com

[Jude86]

Europe's Cyber Resilience Act is going to force a lot of change in the IoT world. Cheap devices with no security updates will struggle to meet it

Chips like this give manufacturers a clear path to compliance. That is good for everyone who owns connected gadgets. Some cheap brands may simply leave the EU market. That would not be a great loss

[ECWCole36]

Bigger keys and signatures are an underrated challenge. Small microcontrollers struggle with the memory and bandwidth involved. A dedicated SPI interface and accelerators should help a lot with that. ML-DSA signatures are several kilobytes. That adds up quickly on slow links