Published findings from the lab
Open access. Peer-reviewed papers, technical briefs, and field notes on post-quantum cryptography for the automotive stack.
Peer-Reviewed Papers & Technical Reports
ML-KEM and ML-DSA Performance on Automotive-Grade ARM Cortex-M7 MCUs Under AUTOSAR OS Scheduling Constraints
Benchmark measurements for NIST FIPS 203 (ML-KEM-768) and FIPS 204 (ML-DSA-65) on the NXP S32K344 (Cortex-M7 at 160 MHz) and STM32H573 (Cortex-M33 at 250 MHz) microcontrollers, measured under AUTOSAR OS scheduling conditions. Will cover stack usage, code size, and cycle counts relevant to AUTOSAR integration planning. Hardware measurements are currently in progress.
CryptoBOM: Automated Cryptographic Bill of Materials for Automotive ECU Firmware
CryptoBOM scans automotive ECU firmware binaries (ELF, Intel HEX, S-record, raw binary) and produces a Cryptographic Bill of Materials identifying every instance of classical cryptographic algorithms vulnerable to Shor's algorithm. Detection uses YARA rules and Ghidra headless analysis. Validated against Zephyr RTOS with mbedTLS, OpenBLT bootloader, and NXP S32K3 MCAL demo binaries.
Technical Briefs
HNDL and the Automotive Fleet: Why Your OTA Traffic Is Already Recorded
Every OTA firmware update your vehicles have ever received has been copied by someone. When the quantum computer arrives, those recordings decrypt. The attack is called Harvest Now, Decrypt Later and it is operational right now…
Download PDFFIPS 203 for Automotive Engineers: What Changes, What Stays, What You Need to Order Today
ML-KEM replaces ECDH key exchange across your ECU fleet. AUTOSAR has reserved the API slots. The silicon is orderable today. Here is exactly what FIPS 203 means for an automotive ECU programme…
Download PDFFIPS 204 for Automotive Engineers: What Changes, What Stays, What You Need to Order Today
ML-DSA replaces ECDSA signatures for OTA firmware, secure boot, and V2X. The change touches every signing key in your programme. Here is exactly what FIPS 204 means for an automotive ECU programme…
Download PDFWhy Your AUTOSAR TARA Does Not Include a Quantum Adversary
ISO/SAE 21434 threat methodology was finalised before NIST published its post-quantum standards. The quantum-capable nation-state adversary is missing from most current TARAs. Here is what that gap looks like in practice, and how to close it…
Being written — available Q2 2026UNECE R155 and Post-Quantum: What Your Annual Review Auditor Will Start Asking
Regulatory pressure around PQC migration evidence is building. The questions your R155 auditor has not asked yet are coming. Here is what to prepare before your next annual review…
Being written — available Q2 2026Field Notes & Analysis
New research when we publish something worth reading.
No newsletter. No noise.
No marketing. One email per publication.