Post-quantum cryptography in constrained HSMs and smart cards

Short answer: Post-quantum cryptography strains constrained hardware security modules (HSMs) and smart cards because keys and computation are larger. An IETF individual draft examines seed-based key generation, which stores a small seed instead of the full private key at the cost of extra computation. A research paper says protecting post-quantum schemes against power analysis and fault injection on smart cards is at a very early stage. One vendor product sheet claims support for ML-KEM and ML-DSA; this is a vendor claim that has not been independently verified.

Constrained HSMs

An IETF draft on post-quantum cryptography in HSMs says HSMs play a critical role in securing cryptographic operations, including the adoption of PQC. It says the transition introduces new challenges for key management, particularly within constrained HSMs. Unlike high-performance, rack-mounted HSMs, constrained HSMs have limited memory, storage and computational resources, and the draft says the increased key sizes and computational demands of PQC require careful consideration. The document is an early individual draft, not a finished standard.

Seed-based key generation

The draft examines seed-based key generation in HSMs. Storing only a small seed rather than the full private key reduces storage requirements but increases the computational overhead of key derivation. The draft explores the trade-off between storage efficiency and performance, and discusses ephemeral key handling, optimisation strategies for PQC signature algorithms, and the impact of PQC on HSM firmware updates and backup.

Smart cards and embedded devices

A paper on efficient and secured implementation of post-quantum cryptography describes the challenges of implementing PQC on embedded devices and smart cards. The authors say one important aspect is protecting schemes against attacks such as power analysis and fault injection, and that research on this topic is still at a very early stage. They also describe how existing cryptographic hardware on smart cards or embedded microcontrollers can be used to accelerate post-quantum cryptography.

A vendor claim

A product sheet from the vendor of the CardOS smart card operating system, dated 2026, says CardOS V8 PQC supports ML-KEM (CRYSTALS-Kyber) and ML-DSA (CRYSTALS-Dilithium). This is the vendor's own marketing material. This article has not verified the claim, and the sheet does not give independent test results.

Limits

The IETF draft and the smart card paper are discussion and research documents. Neither shows a production HSM or card handling post-quantum keys at scale.

FAQ

Why are constrained HSMs harder for PQC?

The IETF draft says they have limited memory, storage and compute, while PQC needs larger keys and more computation.

What is seed-based key generation?

Storing a small seed rather than the full private key. It saves storage and costs computation when the key is derived.

Is side-channel protection mature for PQC on smart cards?

The paper says research on protecting against power analysis and fault injection is at a very early stage.

Can existing smart card hardware help?

The paper describes how existing cryptographic hardware on cards and microcontrollers can accelerate post-quantum cryptography.

Does any smart card support PQC?

A vendor sheet claims so for one product. That claim is unverified here.