PQ Firmware Signing Budget

Which post-quantum signature fits a Cortex-M4 bootloader?

ML-DSA-44 verifies in about 1.4 million cycles in the pqm4 m4f build, under 10 ms at 168 MHz, with a 2,420-byte signature and a 1,312-byte public key. LMS has a 56-byte public key and a signature of 1.5 to 2.9 kB, but the signer must track state. SLH-DSA has a 32-byte key and signatures from 7,856 bytes.

Where do the verify times come from?

Cortex-M4 cycle counts come from pqm4 for ML-DSA, SLH-DSA and Falcon, and from the papers on the Sources tab for the classical and stateful schemes. Cortex-A53 and A72 figures come from eBACS. Milliseconds are cycles divided by your clock. pqm4 measures at 24 MHz with no flash wait states, so a fast part running from flash will take longer.

What happens on MCU classes other than the Cortex-M4?

Where no benchmark is sourced for that core, the tool scales the Cortex-M4 cycle count by a multiplier you can see and edit, and labels the result as an assumption. Turn scaling off to show no sourced figure instead.

Why store a hash of the public key in fuses?

An ML-DSA-65 public key is 1,952 bytes, more than most OTP or fuse banks hold. Fusing a 32-byte SHA-256 hash of the key and shipping the full key in the image header keeps the root of trust in fuses, at the cost of sending the key with every signed image.

How many signatures does an LMS or XMSS key allow?

A tree of height H signs 2 to the power H messages: 1,024 at H10, 32,768 at H15 and 1,048,576 at H20. HSS stacks LMS trees, so the heights add. Reusing a one-time key breaks security, so the signer must update its state before releasing each signature.

What does hybrid mode add?

Each image carries a classical signature and a post-quantum signature, and the bootloader requires both to verify. Key storage, signature bytes and verify time are the sums of the two schemes.

Background: Post-quantum security for robots and drones and Post-quantum cryptography explained. Everything runs in your browser.