Post-Quantum Crypto Just Got a Chip to Run On

Chapter 14 of Quantum from the Ground Up covers the hardware side of post-quantum cryptography, meaning new encryption methods designed to survive an attack from a future quantum computer. This week gave that a concrete data point. BTQ Technologies and Taiwan's Industrial Technology Research Institute validated the first phase of a chip architecture built specifically to run the new encryption standards in hardware instead of software.

Why Hardware Matters Here

Encryption, whether old or new, is math. A processor runs that math the same way it runs any other program: by fetching instructions and data from memory, doing the calculation, then writing the result back. Post-quantum encryption methods use larger keys and more complex math than the encryption in use today, so they demand more of that fetch-and-calculate cycle. Running them purely in software, on a general-purpose processor, is slower and draws more power. That is a real problem for a car's onboard computer, a factory sensor, or a battery-powered IoT device that cannot spare the extra milliseconds or milliwatts.

The fix is to build a dedicated piece of hardware that runs only the encryption math, wired directly for that job. That is what a chip architecture like QCIM is.

What QCIM Actually Does

QCIM stands for Quantum Compute-in-Memory. Despite the name, it does not involve quantum computing itself. It refers to where the calculation happens on the chip. In a standard chip layout, memory and the processor are separate blocks connected by a data bus, and every calculation means shuttling data back and forth across that bus. Compute-in-memory design instead performs the calculation inside or immediately next to the memory itself, cutting out most of that back-and-forth. Less movement means lower power draw and faster results, which is exactly what power-constrained devices need if they are going to run demanding post-quantum math.

BTQ built this particular version around three specific encryption standards published by NIST: FIPS 203, 204, and 205. These are the official post-quantum algorithms the US government has approved for general use, covering both encrypting data and verifying digital signatures. Any hardware built to accelerate post-quantum cryptography needs to run these three algorithms specifically, since they are what systems will actually be required to support going forward.

 

What Was Tested, and What It Showed

The test ran inside a TSMC 28-nanometer design environment. TSMC is the world's largest chip manufacturer, and 28-nanometer refers to the size of the transistors in the manufacturing process being simulated, an older and well-proven node rather than the cutting edge, which keeps early testing cheaper and more predictable. Inside that environment, researchers checked two things. First, whether the QCIM core could genuinely speed up FIPS 203, 204, and 205 operations. Second, whether it produced correct results while doing so, since a faster chip that gets the math wrong is worthless for security. Both held up under the demanding conditions BTQ and ITRI put it through. ITRI's Dr. Chih-Cheng Lu called it meaningful progress toward module-level integration, the next phase of the program, where the core gets built into a larger working system rather than tested on its own.

BTQ is not new to this work. The collaboration with ITRI traces back to 2022, and a companion program with South Korea's ICTK is aimed at a fully integrated, commercially deployable chipset built around the same core. BTQ has said it expects to ship QCIM test chips to customers and partners by the end of the year. The target applications read like a list of things you do not want to re-secure one device at a time later: military systems, industrial equipment, automotive platforms, IoT devices, and connected infrastructure generally, all of which stay in service for years and are hard to patch remotely.

What This Changes in the Book

Chapter 14 already covers hardware paths to PQC, citing the SEALSQ QS7001. QCIM adds a second, independently developed example aimed at the same FIPS standards, this time using compute-in-memory design. The next edition adds it alongside QS7001 and tracks the module-level integration phase BTQ and ITRI are moving into next.

QCIM is the third hardware entry in a pattern this blog has been tracking since December: SEALSQ's QS7001, covered in The Quantum Security Race: Software vs. Hardware, and STMicroelectronics' ST54M, covered in Government Sets New Deadline for Quantum-Safe Encryption. All three chips target the same FIPS 203/204/205 standards introduced in Quantum Computers Just Got Much Closer to Breaking Your Passwords, and all three exist because the federal migration deadlines covered in that June post do not leave software-only implementations enough runway.

This post will fold into the next edition of Quantum from the Ground Up, due September 1.

Why Quantum Computing Matters, Even If You Never Touch One

I logged into my bank app last week to move some money to pay some bills. A padlock icon appeared next to the address bar. Secure connection. I didn't think about it again. Somewhere, someone already has a copy of that session, sitting on a hard drive, waiting.

That padlock runs on a math problem: factor a huge number into its two prime components. A classical computer needs longer than the age of the universe to do that. A large enough quantum computer, running an algorithm built for exactly this job, does it in hours. That computer does not exist yet. It is being built right now, funded by billions of dollars, and no government or company controlling that funding will announce the day it works.

You do not get to wait for that announcement. Security researchers call the attack already underway harvest now, decrypt later. Think about what you have touched on the web this year: your bank, your medical portal, your voter registration, your immigration or legal filings, your tax return, your cloud photo backup. State-backed intelligence services and criminal groups are copying that same traffic from millions of other people today, and storing it cheaply. Almost none of it needs to be cracked now. It needs to still exist, on somebody's drive, the day a quantum computer catches up. Then all of it becomes readable at once.

NIST finalized three new encryption standards built to resist this and set 2035 as the deadline to retire the vulnerable ones. Cloudflare and Google are not waiting until then; they have committed to migrating by 2029. Banks, hospitals, and government agencies holding decades-long records are moving faster still, because for them the clock already ran out on some of what they are protecting.

The fix is not a patch on the old method. It replaces the math underneath it. Government researchers finalized a new set of encryption methods built to survive a quantum computer, the same way today's methods survive an ordinary one. Companies are not waiting to switch over all at once, either. Cloudflare, Google, and Apple already run two locks on the same connection at the same time: the old one and the new one. If someone finds a weakness in the new lock, the old one still holds. If a quantum computer breaks the old lock, the new one still holds. Traffic protected this way stops being worth harvesting, because breaking one lock alone gets an attacker nothing.

Getting every bank, hospital, and government agency onto the new locks is the slow part. It means finding every place the old encryption sits inside a system and replacing it without breaking what depends on it. The federal government has published a shared plan for doing exactly that, across every agency and industry. None of it requires anything from you. It happens inside the apps and websites you already use.

The fix only protects what gets encrypted after it is installed, though. Anything copied under the old lock before that happens is already sitting on somebody's drive, and nothing reverses that. New encryption prevents future harvesting. It does not undo what has already been taken.

Diagram claude.ai generated

Nothing solves the data that is already sitting on somebody's drive. There is no way to reach into another party's storage, revoke a copy, or make it unreadable again. The new locks protect what gets encrypted after they are installed. They have no effect on a copy that left your device years earlier.

How much that matters depends on what kind of data it is. A password can be changed after the fact, so a stolen password loses most of its value once you reset it. A medical record, a Social Security number, or a biometric scan cannot be changed. Whatever gets exposed on that front stays exposed for good. It also depends on how long the data needed to stay private in the first place. Something that only mattered for a few years is probably already safe by the time a quantum computer shows up. Something that needed to stay private for decades, a government file, a company's trade secrets, a hospital's records, is running on a clock that started the day it was copied, not the day the quantum computer arrives.

Most people are not personally worth the effort. A patient attacker spends storage on high-value targets: government communications, corporate research, hospital systems, banks. If you end up exposed, it is more likely through one of those institutions holding your data than through anyone singling you out.

There is not much a consumer can do about data that is already gone. A few things still help:

•   Rotate what can be rotated. Change passwords regularly. A password manager makes it cheap enough to do more than once.

•   Turn on two-factor authentication. It stops a harvested password from being enough to log in on its own, since an attacker also needs your phone, an authenticator app, or a security key. It does not protect the data itself. A hospital record, a legal filing, or an old email that already left your device is untouched by it, because it only fires at login, not on the traffic that carries the data.

•   Not every two-factor method is equal. A text message code can be intercepted or rerouted if someone tricks your phone carrier into moving your number to a new SIM. An authenticator app is safer, since the code generates on your phone instead of traveling over the phone network. A hardware security key is safer still, a small physical device that checks a site's real address before it responds, so it does not work on a convincing fake login page. Use one for your email, your bank, and your password manager itself.

•   Assume what cannot be rotated is already out. Watch for misuse instead of trying to prevent something that may have already happened. A credit freeze and fraud alerts catch someone using a stolen Social Security number long before you would otherwise notice.

•   Keep your software current. The new locks only work if your browser, phone, and apps are recent enough to use them. An old browser is still running the old lock alone.

•   Think twice about what you put online today. Anything sent through email, cloud storage, or a messaging app now can still be harvested under the old lock until your provider finishes switching over.

•   Ask the institutions holding your data. A bank or hospital's own migration timeline affects your exposure more than anything you do personally, and it is a fair question to put to them directly.

None of it undoes what has already been copied. It limits what is still worth harvesting and reduces the damage from what is not.

The padlock on my banking app will look exactly the same through all of this. Behind it, the locks are being swapped one at a time: bank by bank, cloud provider by cloud provider. The question left is not whether the new lock exists. It is how much of your data got copied before it arrived.

Quantum Keys Move Onto Production Routers

Quantum Keys Move Onto Production Routers

I led the telecommunications curriculum for Verizon's Next Step New England program and directed National Science Foundation, or NSF, funded Centers of Excellence at Springfield Technical Community College and the University of Central Florida through the transition from my Dad's Plain Old Telephone Service, or POTS, landlines to Internet Protocol, or IP, based voice, video, and data over copper, fiber and wireless. Our center worked closely with Cisco through that transition. The physics and the protocols changed rapidly snd it was a wild ride. What made the transition real was not the standards documents. It was carriers running the new transport on switches and routers in the central office, and technicians who did not need an advanced degree to keep it running.

Quantum key distribution, or QKD, is a way to generate an encryption key using the behavior of individual photons instead of math. Two machines exchange specially prepared light particles over fiber. If anyone taps the line and looks at those particles, the particles change in a way both ends can detect. That gives you a key exchange where eavesdropping does not stay hidden, which is a different from anything conventional encryption offers.

Aliro Technologies, the Vienna based quantum networking firm zerothird, and Cisco just ran a live version of this over Cisco's production routers at Cisco's Photonics Center in Vimercate, Italy. The hardware was Cisco's 8000 Series routers, the same platform Cisco sells into data centers today. That detail is the news. QKD has existed in labs for years. Running it on hardware a customer can already buy is the harder problem.

The system runs on the BBM92 protocol, which uses paired entangled photons rather than a transmitted key to establish a shared secret. Entangled photons are pairs of light particles created together so that measuring one instantly tells you something about the other, no matter the distance between them. A source creates these pairs and sends one photon from each pair to each end of the link. Both ends measure what arrives and use those measurements to build an identical key, without the key itself ever traveling across the fiber. zerothird supplies the hardware that does this: the photon source, the equipment that keeps the light polarized correctly, synchronizing clocks, and the software that cleans up errors and strengthens the final key. Aliro's Orchestrator software sits on top and manages the link, the way network management software already watches a conventional router. It tracks error rates and photon counts in real time and can reroute traffic or shut a link down safely if something looks wrong. The finished keys reach the routers through Cisco's Secure Key Integration Protocol, a standard interface, where they secure encrypted sessions between routers the same way a conventional key would, just generated a different way.

Diagram Gemini AI Generated

Chapter 1 of Quantum from the Ground Up covers the fiber problem in quantum networking through the University of Illinois work on ytterbium-171 emitters built for existing telecom infrastructure. That chapter is about getting a quantum signal onto fiber that already exists. This deployment answers the other half of the problem: getting the output of that signal into a router that already exists, with the monitoring and failover a network operations center can actually run day to day.

Chapter 14 frames quantum security as a race between two approaches. Post quantum cryptography, or PQC, keeps using math for encryption, just math that a quantum computer cannot easily break, and the National Institute of Standards and Technology, or NIST, has already published standards for it. QKD, the approach in this demonstration, does not rely on hard math at all. It relies on physics: any attempt to intercept the entangled photons changes them in a way both ends can detect. That is also its limit. A QKD key only protects the specific fiber link between two endpoints, while PQC can protect data anywhere the software runs. That is why Cisco is running both approaches rather than picking one. AT&T's coming quantum resilient Software-Defined Wide Area Network, or SD-WAN, service runs PQC on that same 8000 Series router line, which puts both approaches on the same hardware within the same product family.

The public announcement described the deployment as moving QKD out of isolated research setups and into standard enterprise infrastructure. Coverage of the announcement also framed the three way pairing as proof that quantum networking gear from separate vendors can interoperate in a live deployment, which matters more for enterprise adoption than any single performance number. A separate technical paper from the zerothird team tested the same entanglement based approach over a 22 kilometer fiber link between two data centers, which gives the enterprise demonstration a research paper trail worth reading alongside the press coverage.

What This Changes in the Book

Chapter 1 currently ends at the physics of getting quantum signals onto standard fiber. This deployment extends that story into the network operations layer: orchestration, telemetry, and automated remediation running on hardware already shipping. Chapter 14's framing of PQC and QKD as separate paths still holds, but the AT&T and Cisco pairing on the same 8000 Series router line is worth adding as a concrete case where one operator runs both approaches at once instead of choosing sides.

This post will fold into the next edition of the book, due September 1. The current edition is at gordostuff.com/p/quantum-from-ground-up-hardware.html.

POTS to IP took a decade of this kind of work: new transport riding on racked equipment. Quantum key distribution is passing the same tesst. The obstacle was never the physics. Here it's whether the keys can ride on a router Cisco already sells, watched by software a network operations center knows how to run.

The Second June 22, 2026 Quantum Executive Order

In a post Tuesday, I covered the executive order setting hard federal deadlines for post-quantum cryptography migration: key establishment by 2030, digital signatures by 2031. That order dealt with defense. On the same day, June 22, the president signed a second order that deals with offense.

Executive Order 14413, "Ushering in the Next Frontier of Quantum Innovation," directs the federal government to build a large-scale quantum computer for scientific use. The centerpiece is the Quantum Computer for Application Development and Discovery Science effort, called QC-ADDS. The order directs the Department of Energy to deliver at least one QC-ADDS system to a DOE facility and make it available to the scientific community.

Here's some details - within 90 days, DOE must publish the technical specifications required for QC-ADDS to perform transformative scientific applications beyond current classical computer capabilities. Within 180 days, DOE must explore private-sector partnership models and report on cost, scope, and delivery timeframe. DOE has already responded: its Quantum Genesis initiative targets a fault-tolerant, scientifically relevant quantum computing capability by 2028, with a National Quantum Supercomputing User Facility to give U.S. researchers access to systems across multiple qubit modalities.

The Commerce Department must develop a plan for advance market commitments to pull in commercial quantum vendors. The Defense Department gets its own track, establishing programs for national security applications of quantum computing, potentially including a dedicated center. The order also establishes a national center for quantum performance assessment and directs a government-wide quantum workforce recruitment strategy, including special pay rates and retention incentives.

The workforce section carries the most direct relevance for technical education programs. The order tasks NSF to stand up a network of National QIST Workforce Development Institutes within 180 days. Federal money for hands-on QIST training will flow somewhere; the question is where.

There is a thread connecting both orders. The PQC migration order sets a deadline for protecting existing systems. EO 14413 sets a timeline for building the systems that will eventually make those protections necessary. Both orders treat 2030 as the planning horizon. Harvard's Mikhail Lukin put fault-tolerant, large-scale quantum computers at end-of-decade in a recent assessment, five to ten years ahead of earlier estimates.

Inside the ST54M: One Chip, Three Jobs, and a Post-Quantum Upgrade

Yesterday I wrote about our government setting a new deadline for quantum-safe encryption. At the end of the post I briefly mentioned STMicroelectronics introduced the ST54M, the first mobile chip with a dedicated hardware accelerator for post-quantum algorithms. I got a question from a reader – what the heck does that mean....?!  Fair question! Here’s some detail on what that chip does, and how it works. If you use your phone for payments – this is a very good thing.

Tap your phone against a payment terminal and several things have to happen in well under a second. The device has to prove its identity, encrypt the exchange, and complete the transaction before you lift your hand away. Most people never think about the chip doing that work. STMicroelectronics just gave that chip a significant upgrade.

The new chip is called the ST54M. It is a single chip that combines three functions that used to live on separate pieces of silicon: an NFC controller, a secure element, and eSIM support. NFC is the short range radio that lets your phone talk to a payment terminal, a transit gate, or a hotel door lock. The secure element is a locked vault inside the chip that holds your credentials and keys. eSIM is the embedded SIM that lets your carrier profile live in the device itself instead of a removable card. Folding all three into one die (small piece of silicon that contains the electronic circuits needed) simplifies the phone and tightens the security boundary between them.

The bigger story is what ST54M adds on top: a hardware accelerator built for post-quantum cryptography. Today's encryption relies on math problems that are hard for ordinary computers to solve. A sufficiently capable quantum computer could solve some of those problems quickly, which would undermine the locks protecting your payments and your identity data. ST54M supports two newer algorithms, ML-KEM and ML-DSA, designed to resist that kind of attack. Building the acceleration into hardware means a phone can run this stronger cryptography without slowing down.

STMicroelectronics has samples available now, with production and certification targeted for July 2026. The certifications matter for adoption; payment networks and government identity programs will not deploy a chip until it clears those bars.

None of this changes what happens when you tap your phone tomorrow. It changes what is quietly defending that tap a few years from now.

Apple’s Corecrypto Proof And A Next Phase Of Quantum Migration

In the late 1990s, a new kind of encryption called elliptic curve cryptography started showing up in phones, websites, and game consoles. The math behind it was solid. The code that ran the math was not. Engineers made small mistakes deep inside the software, and attackers found them. In 2010, Sony lost the master signing key for the PlayStation 3 because the code reused a random number it was supposed to generate fresh every time. Once that key leaked, anyone could load any software they wanted onto the console. The math worked. The code did not.

I wrote in April about the two paths to post-quantum cryptography, software and hardware, and how moving everything over will take more than a decade. Post-quantum cryptography, or PQC, is the new family of encryption designed to survive future quantum computers. Today’s encryption depends on math problems that classical computers cannot solve in any reasonable time. A large enough quantum computer running Shor’s algorithm makes those problems easy.

On May 22, Apple released a major update to corecrypto, the encryption software running on more than 2.5 billion Apple devices. The update includes the new post-quantum algorithms standardized by NIST, called ML-KEM (for key exchange) and ML-DSA (for digital signatures). What makes this release different is that Apple also published a mathematical proof that the code does exactly what the standard says it should do. No surprises. No hidden mistakes. The technique is called formal verification, and it has been used for decades in chip design and aerospace software. Seeing it applied to cryptography on consumer devices is new.

It often takes years of work and very specialized math skills. Apple’s proof runs more than 50,000 steps and already caught a bug that normal testing would have missed. Apple open-sourced the tools, including software built by Galois Inc., so other companies can do the same thing. iMessage, Signal, Chrome, and Cloudflare are already shipping post-quantum protections, and more are coming.

For decades the pattern was ship first, fix later. The quantum migration is too important and too complicated for that. Apple just showed what doing it right looks like. The next step for us academics - colleges and training programs must prepare engineers who will do it.