IMC Newsdesk

EU demands Post-Quantum IoT Infrastructure

  • August 20, 2026
  • William Payne

Threats against critical infrastructure, operational technology and IoT continue to escalate and grow in sophistication. Current IoT cyber security rests on protocols that could very soon be shattered by advances in quantum computing. Hostile state actors and hacking collectives are engaged already in large scale Harvest Now Decrypt Later (HNDL) exercises 1. Vast amounts of encrypted edge, IoT and OT data are regularly being intercepted and stored for future decryption.

In response to this threat, the European Commission has adopted recommendation C(2024) 2393 requiring the implementation of post quantum cryptography (PQC) across all sectors in the European Union deemed either essential or important 2, a definition that covers a broad swathe of energy, industrial, manufacturing commerce cities, transportation, healthcare, logistics, and retail across the continent.

The NIS Cooperation Group has subsequently codified Recommendation C(2024) 2393 into the Coordinated Implementation Roadmap (v1.1) (CIR v1.1) 3, which establishes rigid, non-negotiable milestones for EU Member States and operators of critical national infrastructure and key industrial and commercial sectors.

Roadmap Deadlines & Challenges

The Roadmap poses considerable challenges for IoT device makers, network integrators, and operators. The first of the challenges is a rigid and unyielding timeframe. The second major challenge is meeting the requirements for post quantum cryptography, as specified by the European Commission and the NIS Cooperation Group, on highly resource constrained IoT, OT and edge devices and networks.

By 31 December 2026, essential and important entities must complete comprehensive cryptographic asset inventories and risk-based data classifications 4. This milestone requires board-level governance, including a named migration owner, and the initiation of hybrid cryptographic pilots on high-risk communication layers, such as TLS 1.3 and VPN gateways 5.

Following this preparatory phase, the Roadmap imposes a deadline of 31 December 2030 for the full migration of CNI production environments to quantum-safe states 6. Regulators expect operators to employ hybrid deployment models during the interim. This would involve combining classical asymmetric algorithms (such as ECDH or RSA) with standardised PQC primitives (such as ML-KEM) to ensure that a session key remains secure unless both algorithms are simultaneously broken 7.

Hybrid operation is a transitional phase that is mandatory and required to satisfy supervisory audits, not a permanent architectural state. Post-2030, reliance on classical public-key cryptography for sensitive IoT and OT channels will violate the expected standard of care under NIS2 8.

IoT PQC Challenges

The computational overhead of PQC poses an acute challenge for OT and IoT devices and networks. This challenge is especially acute in large scale, complex OT and IoT infrastructure that is typical of energy and utility infrastructure, industrial, logistics, healthcare, and transportation infrastructure. The transition from conventional cryptography to NIST-standardised lattice-based primitives introduces a severe inflation in key and signature sizes 9, fundamentally clashing with the resource constraints of embedded and edge devices.

Conventional Elliptic Curve Cryptography (ECC-256) requires a 32-byte public key and a roughly 64-byte signature, while RSA-2048 relies on a 256-byte key 10. However, the primary PQC key encapsulation mechanism, ML-KEM-768 (FIPS 203), requires a 1,184-byte public key and a 1,088-byte ciphertext 11. The primary digital signature algorithm, ML-DSA-65 (FIPS 204), requires a 1,952-byte public key and a 3,293-byte signature 12.

For 32-bit microcontrollers, such as ARM Cortex-M4, Cortex-M33, or embedded RISC-V cores typically equipped with 32 KB to 128 KB of SRAM, this is beyond challenging 13. Polynomial matrix multiplications inherent to lattice-based cryptography require significant memory allocations 14. When these algorithms execute, the resulting stack allocations risk systemic buffer overflows, memory exhaustion, and execution stalls, destabilising the entire embedded system 15.

Protocol Overhead & OTA Updates

PQC key inflation also disrupts the network and protocol layers of embedded systems. Bandwidth-constrained wireless networks such as Thread, Zigbee, NB-IoT, and LoRaWAN, are designed for minimal payload sizes 16. Transmitting multi-kilobyte PQC public keys and signatures will cause severe IP packet fragmentation 17. This fragmentation will force edge devices to keep their radios active for significantly longer periods, draining battery life and disrupting the duty cycles required for remote IoT deployments 18.

Under PQC, secure boot mechanisms and Over-The-Air (OTA) firmware verification will have to re-architected. Validating a firmware update using ML-DSA (FIPS 204) or stateful hash-based signatures like SLH-DSA (FIPS 205), LMS, or XMSS 19 requires flash memory structures capable of handling massive signature payloads and complex state management 20. Failure to properly engineer these verification routines will run the risk of bricking remote hardware during an OTA update, an unacceptable outcome for critical infrastructure 21.

The integration of hybrid key exchange modes also directly impacts TLS 1.3 and DTLS handshake latency 22. In time-sensitive embedded control loops, such as those found in industrial robotics or smart grid switching, the additional milliseconds required to process hybrid handshakes and transmit fragmented PQC payloads can exceed operational time-outs, leading to dropped connections and system failures 23.

Telecoms & 5G/6G Challenges

Currently, 3GPP standards utilise the Elliptic Curve Integrated Encryption Scheme (ECIES) to conceal the Subscription Permanent Identifier (SUPI) into a Subscription Concealed Identifier (SUCI) before transmission 24. Transitioning this de-anonymisation process to PQC primitives, such as ML-KEM, requires fundamental updates to core network routing and authentication functions to handle the inflated ciphertext payloads without degrading connection setup times 25.

The Remote SIM Provisioning (RSP) architecture for eUICC and eSIM ecosystems relies on Public Key Infrastructure (PKI) hierarchies 53,54,55,56. Upgrading these will necessitate deployment of PQC-capable Hardware Security Modules (HSMs) within telecom data centres to sign and verify operator profiles using ML-DSA.57,58,59

At the network edge, integration of hybrid cryptographic handshakes poses a threat to the sub-millisecond latency targets required by 5G Ultra-Reliable Low-Latency Communication (URLLC) and Multi-Access Edge Computing (MEC) gateways 26.

The computational overhead and packet fragmentation introduced by combining classical algorithms with lattice-based PQC primitives risk violating the strict timing budgets required for autonomous vehicle telemetry and industrial automation, forcing telecom architects to aggressively optimise hardware acceleration at the edge 27.

Industrial OT & Manufacturing

Industrial OT is typically characterised by legacy Programmable Logic Controllers (PLCs) and Remote Terminal Units (RTUs) with operational lifespans of 15 to 20 years 28. These embedded devices lack the SRAM, Flash memory, and processing cycles required to support PQC via software or firmware updates. This creates a systemic vulnerability that cannot be patched 29.

Integrating PQC into modern industrial communication protocols poses significant technical barriers. In OPC UA (OPC Unified Architecture) deployments, certificate management and mTLS wrappers rely on standard X.509 certificate buffers 30. The key inflation inherent to ML-DSA certificates will exceed these legacy device buffer limits, causing handshake failures and breaking secure communication channels 31.

To mitigate this, operators must deploy crypto-agile industrial gateways to act as protocol-wrapping proxies 32. These gateways terminate the PQC-secured connections from the IT network and translate them into classical or symmetric protocols to isolate non-upgradeable fieldbus devices.

To satisfy the supply chain security mandates of NIS2, industrial operators must implement rigorous Cryptographic Bill of Materials (CBOM) tracking 33. Managing CBOMs across multi-tier industrial hardware vendors is now a regulatory necessity to identify hidden structural cryptographic vulnerabilities and prove compliance during supervisory audits 34.

Healthcare & IoMT

Telemetry and diagnostic data generated by connected medical devices, ranging from implantable pacemakers to wearable monitors and hospital imaging equipment, are subject to strict patient data retention mandates, often exceeding 10 years 35.

Healthcare diagnostic data is subject to complex regulatory regulation. Operators and manufacturers must align the technical requirements of NIS2 Article 21 (which mandates state-of-the-art encryption and crypto-agility) 36 with the EU Medical Device Regulation (MDR) and its associated cybersecurity guidelines (MDCG 2019-16) 37.

Updating cryptographic software on clinical hardware to support PQC could alter the device’s risk profile, potentially triggering a lengthy and costly recertification process under the MDR 38. As a result, healthcare providers will have to implement network-level PQC isolation while manufacturers develop next-generation IoMT devices with pre-certified, crypto-agile secure enclaves.60

Smart Energy, Cities, Vehicles

Distributed Energy Resource (DER) gateways, smart meters, and traffic management systems rely on embedded PKI. The PQC transition in this sector is most significantly challenged within the Electric Vehicle (EV) charging ecosystem, specifically the ISO 15118 Plug & Charge protocol 39.

ISO 15118-2 and the updated ISO 15118-20 specifications require strict maximum frame size limits for V2G (Vehicle-to-Grid) communication 40. The integration of lattice-based PQC certificates breaks these frame size limits, rendering the standard PKI handshake impossible over constrained charging cables 41. Resolving this requires protocol extensions to support certificate fragmentation, alongside the deployment of crypto-agile HSMs within the charging infrastructure backend to process hybrid signatures 42.

Energy operators must also reconcile overlapping regulatory frameworks. They are required to comply with the horizontal PQC mandates established by NIS2 and Commission Recommendation C(2024) 2393, while simultaneously adhering to vertical, sector-specific controls dictated by the EU Network Code on Cybersecurity (NCCS) 43. Navigating this dual-regulatory landscape requires energy providers to implement PQC migration roadmaps that satisfy both the NIS Cooperation Group’s 2030 deadlines and the specific resilience testing criteria of the NCCS.61

Milestones & Deadlines

EU infrastructure operators have been set a series of milestones and deadlines that they must meet by EC Recommendation C(2024) 2393 and NIS Cooperation Group’s Coordinated Implementation Roadmap 44.

Phase 1 has a target of 31 December 2026 and requires operators to deploy automated Cryptographic Bill of Materials (CBOM) discovery tools to compile a comprehensive cryptographic asset inventory across all embedded systems and network layers 45.

This phase also requires a rigorous risk classification to identify long-retention assets vulnerable to the Harvest-Now-Decrypt-Later (HNDL) threat 46. Finally, this phase requires a formal, board-level migration plan sign-off compliant with the management accountability requirements of NIS2 Article 20 47.

Phase 2 covers 2027–2028 and shifts transition to the establishment of hybrid deployment pilots. Engineering teams must target edge gateways and VPN layers, bench-testing dual TLS 1.3 and DTLS stacks. During this phase, operators must measure Over-The-Air (OTA) latency, radio-on times, and RAM/power consumption metrics in real-world environments to ensure that hybrid handshakes do not destabilise constrained edge networks 48.

In Phase 3, which covers 2028–2029, operators must shift their procurement to replace all legacy microcontrollers with System-on-Chips (SoCs) featuring hardware-accelerated Roots of Trust (RoT) tailored for PQC, such as dedicated lattice acceleration units 49. At the same time, secure boot enclaves must be updated to handle ML-DSA or SLH-DSA signature verification for OTA firmware updates 50.

Phase 4 marks the regulatory hard deadline of 31 December 2030. By this date, operators must have achieved the complete operational deprecation of legacy RSA and ECC algorithms across Critical National Infrastructure 51. Production environments must transition to pure PQC primitives, eliminating the computational overhead of hybrid modes and achieving full compliance with EU supervisory rules 52.

Footnotes & Source List