Zak Doffman is CEO of post-quantum trust platform company Pairpoint, a Vodafone–Sumitomo joint venture. In a recent interview, he discussed how IoT operators and manufacturers can future-proof existing IoT infrastructure from cyber-threats, including quantum decryption, without having to rip-and-replace existing IoT and OT infrastructure thanks to technology developed by the company. The same technology also provides a low-cost route to quantum authentication and digital sovereignty, a growing requirement for IoT operators in Europe, UK, US, the Middle East, and the Far East.

Governments are legislating to require IoT operators to adopt post-quantum cryptography (PQC) to protect against increasingly sophisticated and wide-ranging cyber attacks on national critical infrastructure. The fear is that adversaries will soon deploy quantum-based decryption to break public key-based (PKI) encryption. New regulations such as the EU PQC Roadmap, the CRA, US Executive Order 14412 and CNSA 2.0 are drivers of change. But these schemes and roadmaps typically demand implementation of algorithms and encryption that are beyond the compute and bandwidth limits of most installed OT and IoT devices and networks.

The PQC Compute Trap and the ‘Rip-and-Replace’ Dilemma

For Doffman, this regulatory push risks triggering an economic and operational crisis for enterprise IT leaders. “There is an element of ‘be careful what you wish for’ with post-quantum cryptography,” he warns.

The fundamental issue lies in what can be termed the PQC compute trap. Traditional asymmetric post-quantum algorithms, such as ML-KEM and ML-DSA, rely on complex lattice-based mathematics. While highly secure, they demand a 40-80x key size inflation compared to legacy standards. For a standard enterprise server, this overhead is negligible; for a constrained 8-bit or 32-bit microcontroller at the edge, it is catastrophic. The resulting network fragmentation and battery/compute exhaustion effectively render legacy hardware obsolete.

“When you run the maths in terms of what happens when every laptop, phone, and IoT device is running 80 times the compute just to deliver what people assume to be the safety levels of encryption today, that is an enormous overhead,” Doffman explains. “You are talking about additional certificate and key rotation, a huge increase in bandwidth and computational processing, and you are reducing the lifecycle of the devices. A vast proportion of the IoT devices already deployed simply cannot cope with that computational upgrade.”

Without an alternative, enterprises face a mandated, global hardware refresh. Pairpoint’s strategic intervention is designed to bypass this capital expenditure entirely. “We are saving the world from blindly ripping and replacing hundreds of millions of devices and launching new SIMs, new cloud overlays, and new NOCs and SOCs that you do not need,” he says.

Symmetric SIM Cryptography: Securing Brownfield IoT

Pairpoint’s solution to the PQC compute trap is to abandon asymmetric public-key infrastructure (PKI) at the edge, pivoting instead to the highly secure, underutilised cryptographic hardware already embedded in billions of cellular devices: the SIM card.

“We are the only technology that can deliver quantum safety to brownfield IoT estates without changing anything, just by a small software patch at the edge,” Doffman asserts.

The technical logic rests on the resilience of symmetric cryptography. While quantum computers can easily break asymmetric PKI using Shor’s algorithm, symmetric keys (such as AES-256) remain structurally secure against quantum threats. By delegating key generation to the SIM’s tamper-resistant Secure Element, Pairpoint removes the cryptographic burden from the host device’s processor.

“The SIM shares a secret with the network core,” Doffman notes. “The secrets are never shared over the air. We do not expose the secrets or compromise them, but we use them in a similar way to how they are designed to be used. In doing so, we can create NIST compliant quantum safe keys that customers can rotate as often as required.”

This architecture generates ephemeral, dynamic session keys that guarantee forward secrecy, all while operating entirely within the device’s existing power and memory constraints. “None of this carries a compute processing or bandwidth overhead,” Doffman adds. “It is all within the existing envelope. We do not change anything. That is what makes this so different.”

Critical National Infrastructure and Cross-Bearer Utility

The commercial implications of this lightweight architecture are most acute in sectors managing long-lifecycle assets, particularly Critical National Infrastructure (CNI) and utilities. These sectors are highly vulnerable to “harvest now, decrypt later” attacks, yet their hardware cannot support heavy PQC upgrades.

“In utilities and energy, there are somewhere between 1.2 and 1.7 billion smart meters around the world that were designed in a time before quantum was a concern,” Doffman points out. “Even with new ones, if you put PQC on them, you are going to consume a significant amount of processing and erode the componentry. These are 15-year devices running super low-bandwidth connectivity plans.”

Furthermore, Pairpoint has decoupled this security model from the cellular radio itself, enabling cross-bearer utility. Because the key derivation functions at the application layer, the SIM can authenticate and generate keys even when operating outside of cellular coverage.

Onshore Digital Sovereignty and Sovereign AI Attestation

Beyond quantum resilience, Pairpoint is capitalising on a rapidly escalating geopolitical mandate: digital sovereignty. As governments draft stringent data residency laws (such as the EU Data Act and NIS2) and push back against foreign legal extraterritoriality, enterprises are seeking verifiable ways to prove the physical jurisdiction of their data and compute assets.

“I have been taken aback by how quickly the digital sovereignty demand has come up in conversations with customers,” Doffman admits. “It is almost as acute as quantum in a sense, and it is more ubiquitous. And it does play into AI in a big way.”

Conventional digital sovereignty measures, such as IP geofencing, are easily circumvented via proxy spoofing. Pairpoint’s alternative relies on the inherent onshore digital sovereignty provided by native carrier cores (NOCs/SOCs). By validating lower-layer cellular network signalling parameters (such as Mobile Country Codes and Cell IDs) directly inside the operator’s core, the SIM provides an unforgeable, hardware-rooted proof of location.

“All of the alternatives to what we do find it very difficult to be completely digitally sovereign, because to do so requires data, signalling, and control all to be onshore,” Doffman explains. “It is hard and very expensive to do transnationally. But because we sit within a network, the networks are inherently sovereign. The NOCs and SOCs are all onshore.”

This capability extends up the enterprise stack, offering a critical foundation for localised artificial intelligence. “If you wanted to build a digitally sovereign AI infrastructure and attest to it, we could enable you to do that, powered by the cellular network in that jurisdiction, without having to build your own shadow ecosystem or infrastructure,” he says. This sovereign AI attestation ensures that sensitive workloads are only decrypted and processed when the hardware can cryptographically prove it resides within the correct national borders.

Telco Monetisation: Turning Connectivity into Trust

Ultimately, Pairpoint’s architecture represents a strategic pivot for the telecommunications industry itself. For decades, mobile network operators (MNOs) have struggled with margin erosion as connectivity became commoditised and over-the-top cloud providers captured the value of enterprise IT.

Doffman’s vision is to reverse this trend by transforming the MNO’s existing infrastructure into a monetisable security platform. “In its simplest form, what Pairpoint does is expand the utility of network cryptography,” he states. “It turns cellular connectivity networks into secure digital infrastructure. It turns connectivity into trust.”

By licensing this technology directly to carriers, Pairpoint enables MNOs to offer Trust as a Service to their enterprise clients. This carrier-first strategy avoids disintermediating the networks, instead empowering them to sell high-margin cryptographic attestation, device binding, and sovereignty proofs.

“For the networks, it provides a new revenue category that they do not necessarily have today. They are not reselling somebody else’s infrastructure; they are selling their own,” Doffman concludes. “Because it is rooted in standards, it is unbelievably straightforward for a network to onboard this and launch it… If I look to the next five or ten years of Pairpoint, it is all about the trust layer. We are turning connectivity into trust, and we see huge opportunities in the way the world is evolving to do that.”