Why Post-Quantum Security Starts with the Chip

By ICTK
October 15, 2026

A state-of-the-art lock won't help much if you leave the key under the doormat

Is New Encryption Enough to Stop Quantum Computers?

You've probably heard the warning by now: once quantum computers mature, they could break much of the encryption that protects the internet today. That's why organizations around the world are preparing to move to post-quantum cryptography (PQC), a new generation of encryption designed to hold up even against quantum attacks. In August 2024, NIST finalized its first PQC standards, including ML-KEM (FIPS 203) and ML-DSA (FIPS 204).

Upgrading to new encryption matters. But there's a question that's easy to overlook: where does that encryption actually run, and where are the keys kept? The answer is a tiny piece of silicon inside the device itself, whether that's your phone, your car, or a machine on a factory floor. No matter how strong the encryption is, if that chip is weak, security is compromised from the very first step. This post looks at why protecting the hardware itself is so important in the post-quantum era.

Security Works Like a Relay of Checks

Picture an office building with tight security. A guard at the front desk checks your ID and hands you a visitor badge. On each floor, people glance at the badge and let you through, and the badge opens the door to the office you're visiting. Nobody re-verifies your identity at every turn. Each checkpoint trusts that the one before it did its job.

Digital devices boot up the same way. Smartphones, laptops, industrial equipment, and cars all follow the same pattern: when the power comes on, the first piece of code that runs checks whether the next piece of software is genuine, and that software checks the next one, and so on. The security industry calls this sequence of handoffs a chain of trust.

The most important spot in that chain is the very first one: the guard at the front desk. Nobody checks the guard. If the guard is bribed or replaced by an impostor, every fake badge they hand out sails through every floor. That's why NIST says this starting point, known as the root of trust, must be secure by design. In a digital device, the chip plays the role of that front-desk guard.

Even Strong Encryption Depends on Where the Key Lives

Post-quantum cryptography wasn't adopted overnight. The new standards emerged from years of open, public scrutiny by cryptographers around the world, and they're built on math problems that even quantum computers are expected to struggle with. They're set to become the new foundation of digital security. But for encryption to protect anything in the real world, strong math isn't the whole story. The chip running that math has to be secure, too.

Attackers don't always try to break encryption head-on. Think of a safecracker who listens to the faint clicks of the dial instead of drilling through the door. In the same way, an attacker can study the subtle clues a chip gives off while it computes, such as how long an operation takes or how much power it draws. These are called side-channel attacks, and they're not unique to PQC. Back in 1996, research showed that secret keys in RSA and other established algorithms could be recovered just by measuring how long computations took. Since then, side channels have been a standard consideration for implementing any cryptographic algorithm.

PQC is going through the same kind of vetting. Researchers routinely put real-world implementations to the test so that weak spots get found and fixed before the standards are widely deployed. The KyberSlash research uncovered tiny timing variations in some implementations, and major libraries patched them quickly. Studies on analyzing a chip's power consumption and on deliberately inducing faults are likewise helping the industry build more robust implementations. Most of this work assumes lab conditions with direct physical access to the device, and it targets how the algorithms are implemented, not the underlying math.

The takeaway is simple. The stronger the lock, the more attackers focus on where the key is kept instead of trying to break the lock. If you've installed a state-of-the-art lock, you don't leave the key under the doormat. For PQC's strength to translate into real-world security, the chip that stores and uses those keys has to be protected as well.

Three Reasons Hardware Protection Matters

1. If the starting point falls, every check after it is meaningless

If a chip is compromised and the front-desk guard is effectively replaced, an attacker can stamp malicious software as "approved" and slip past every check that follows. Security software running higher up has a hard time noticing that the ground it stands on has already been poisoned. That's why NIST, in its report on hardware-enabled security (IR 8320), treats protecting the platform itself as the first layer of security.

2. The keys physically live on the chip

At the end of the day, secret keys are generated, stored, and used inside a chip. Servers in a locked data center are hard to get your hands on, but smart meters on the street, sensors on a factory floor, cars on the road, and medical devices in a hospital are all within someone's reach. For devices like these, the side-channel attacks described above become a realistic threat. Keeping keys from leaking off the chip and preventing clues from escaping during computation is not something a software patch can fully solve after the fact. It has to be designed into the chip from the start.

3. Once a chip ships, it's hard to change

Software can be updated. Chips, for the most part, can't. It's a bit like a building's foundation: you can renovate the floors above, but redoing the foundation later is a different story. In its CNSA 2.0 and Quantum Computing FAQ (updated October 2026), the NSA notes that the algorithm a device uses to verify its firmware often can't be easily updated, so it tends to be locked in for the life of the system. As a result, a quantum-resistant root of trust may be needed in firmware years before the rest of the system makes the switch. The same FAQ warns that some components, such as firmware update capabilities, likely can't be transitioned after purchase, and urges buyers to make sure they're quantum-resistant at the time of purchase.

Consider industrial equipment or vehicles that stay in service for a decade or more. If the chip in a device built today isn't ready for the quantum era, that device will be relying on a pre-quantum front-desk guard for the rest of its working life.

What the Front-Desk Guard Needs in the Quantum Era

So what should a trustworthy chip look like in the post-quantum era? It comes down to four essentials.

  1. It can verify with quantum-resistant algorithms: From the moment a device powers on, it should be able to check software using PQC.
  2. It resists side-channel and fault attacks: It should be designed to withstand physical attacks that exploit timing, power consumption, or induced faults.
  3. Keys never leave the chip: Generating, storing, and using secret keys should all happen inside the chip. One approach is PUF (physically unclonable function) technology, which avoids storing keys at all and instead derives them on demand from the unique physical characteristics of each individual chip.
  4. It's independently validated: The security level a chip claims should be backed by recognized certifications such as FIPS 140-3 or Common Criteria (CC).

Hardware that fills this role comes in many forms, including secure chips, TPMs, and HSMs, and the right choice depends on the use case. Whatever the form, it's worth re-evaluating it against these criteria with the quantum era in mind.

Explore ICTK IP:

Conclusion: Security Is Only as Strong as the First Link

Moving to post-quantum cryptography means changing the locks. But it also means taking a hard look at where the keys are kept and who's standing at the front desk. No matter how long or thorough the chain of checks may be, if the starting point is weak or stuck in the past, the whole system can't rise above it.

That's why hardware protection isn't a side item on the post-quantum checklist. It's the foundation everything else rests on. Protect the chips where keys actually live from side-channel attacks, and build quantum readiness into a starting point that's hard to change later. That's where trust that outlasts the quantum transition begins.

References

ICTK IP Selector PQC IP Selector

Related Semiconductor IP

Related Blogs

Latest Blogs

×
Semiconductor IP