Post-quantum cryptography for IoT and constrained devices

Post-quantum cryptography has an awkward fit with the Internet of Things, and pretending otherwise helps no one. The lattice-based NIST standards trade larger keys and signatures for quantum resistance: a Dilithium-2 public key is around 1.3 KB and a signature around 2.4 KB, versus tens of bytes for an elliptic-curve equivalent. On a cloud server that is a rounding error; on a battery-powered sensor with kilobytes of RAM, a constrained radio link, and a ten-year deployment life, it is a genuine engineering constraint. Yet IoT is precisely where the long-lived-secret problem bites hardest, because these devices are deployed for a decade or more and are very hard to update in the field.

The honest approach starts with triage. Not every device needs the same treatment. A smart meter that signs a billing record which must be auditable for years has a real post-quantum requirement; a temperature sensor publishing a reading that is worthless in an hour mostly does not. For the devices that matter, prefer key encapsulation (ML-KEM, FIPS 203) for establishing session keys over frequent signature verification, and consider where a gateway can carry the heavier cryptography on behalf of the smallest nodes. Where signatures are unavoidable on long-lived records, budget the flash and bandwidth for ML-DSA rather than assuming it will fit.

Firmware-update signing deserves special attention: a device that will accept updates for a decade should verify them with a post-quantum signature now, or an attacker who breaks the classical signing key in the future can push malicious firmware to your entire fleet. Be precise about the limits: post-quantum schemes are resistant to all known classical and quantum attacks per NIST, not unbreakable, and the size overhead is real, not marketing spin you can wish away. The practical path is to prototype the primitives against a simple API first, measure the actual byte and timing cost on your target hardware, and design the migration around the devices whose secrets genuinely need to outlive classical cryptography.