You are designing an SoC for an embedded device that will be used for more than 10 years. Which is an appropriate hardware and firmware design to prepare for future cryptographic migration (such as the move to post-quantum cryptography)?

Answer: B. Leave room for boot verification to handle multiple schemes and keys, make accelerators building blocks usable by several schemes, and allow schemes to be swapped by updates

Hardware cannot be rebuilt after manufacturing, so fixing a single scheme in circuits or ROM means rebuilding the device itself when that scheme is no longer secure. If the boot ROM can hold several key hashes in eFuses or can choose among schemes, keys and schemes can be switched later. If accelerators are building blocks usable by several schemes, such as hash functions (SHA-2 and SHA-3), polynomial multiplication and big-integer arithmetic, firmware updates can more easily support new schemes. For firmware signing, schemes such as LMS and XMSS, whose security relies only on hash functions, are also an option; in that case managing state on the signing side is essential so that a one-time key is never used twice.

• A. Fixing a single scheme and key makes it impossible to replace them when the scheme is broken.
• B. Correct. Room for later replacement is prepared at the hardware stage.
• C. A circuit specialized for a single scheme cannot be used for the migration to post-quantum cryptography.