PQC signature process for HSM
Private keys are used to protect all security-relevant processes in companies. They are valuable because they hide the "secret" for decrypting the previously encrypted data. This sensitive key material must be kept highly secure. Hardware security modules (HSM) play a very important role in this context. HSMs are particularly effective in protecting the stored private keys from unauthorized access and ensure that cryptographic operations can be performed quickly.
For private keys of post-quantum cryptosystems there are still no HSMs that natively support their storage and use. But Utimaco HSMs can already be extended for the use of post-quantum cryptosystems. This is realized by developing special cryptographic modules that are loaded into the HSM. MTG has developed a special PQC module for exactly this purpose.
Utimaco General Purpose Hardware-Sicherheitsmodule: CryptoServer LAN V5 (© Utimaco GmbH)
For the implementation of a PQC signature procedure in the Utimaco HSM, the so-called XMSS algorithm has been applied. XMSS is the world's first standardized signature method for post-quantum cryptography, developed by Prof. Dr. Johannes Buchmann and his research team.
The MTG XMSS module for the Utimaco HSM enables a secure storage and usage of XMSS keys. This algorithm is appropriate, for example, to secure the boot and update process of firmware in embedded systems against quantum computer attacks in the future. PQC is particularly relevant for systems that are used for long-life products in transportation, aerospace or comparable critical areas of application.
Additional PQC Modules for HSM
More PQC algorithms can be developed for the Utimaco HSM upon request. Currently we are working with the following PQC algorithms:
- Classic McEliece
- SPHINCS+
- Others upon request
Securosys PQC HSM
In addition to its own PQC solutions, MTG also offers integration of the Securosys Primus PQC HSM. These high-security modules are specifically designed to help businesses prepare for the upcoming challenges posed by quantum computers. They support all PQC algorithms selected by NIST and, when combined with traditional methods such as RSA and ECC/ED, enable a secure and gradual transition to post-quantum cryptography within existing infrastructures.
A key advantage of the Securosys HSMs is their flexibility:
-
Support for all PQC algorithms standardized by NIST (e.g., ML-KEM, ML-DSA, SLH-DSA, HSS-LMS, XMSS)
-
Hybrid operation modes for a secure transition phase
-
High performance alongside strong security and seamless integration
The combination of MTG software and Securosys HSM ensures end-to-end protection of data and communication channels—both today and in the coming era of quantum computing.
Test Securosys PQC HSM in a Secure Environment
Get ready today for the demands of tomorrow: In an testing environment, you can try out the post-quantum capabilities of Securosys HSMs in a practical setting, run evaluations, and gradually develop your migration strategies – all without risk: https://cloud.securosys.com/cloudhsm