...
Contact Us

FortifyIQ Announces CAVP‑Validated ML‑DSA Verification Library for Post‑Quantum Secure Boot

webinars and news on cybersecurity
Newsroom hexa-yellow icon

Compact verification‑only ML‑DSA implementation with minimal code size and stack usage, engineered for secure boot in highly memory-constrained embedded and long‑life devices.

FortifyIQ today announced that its PQC signature verification library has successfully completed CAVP validation, confirming alignment with NIST’s FIPS 204 standard for post‑quantum digital signatures. Engineered exclusively for verification, FortifyIQ’s technology enables the industry’s minimal code size and stack usage (ROM/RAM), providing a practical path to post-quantum secure boot for legacy and memory-constrained platforms.

Post‑quantum migration is becoming an essential requirement across embedded systems, including cost‑sensitive IoT devices and long‑life infrastructure already deployed in the field. ML‑DSA, standardized in FIPS 204, is the post‑quantum digital signature algorithm designated for secure boot and authenticated firmware updates.

FortifyIQ’s compact pure-software verification-only profile allows device manufacturers to integrate NIST-standardized PQC trust without expanding bootloader memory or redesigning existing hardware platforms. The implementation is optimized for bootloaders, OTA firmware validation, and legacy systems where every byte of RAM and ROM is counted.

This verification-only library joins FortifyIQ’s broader suite of hardened CAVP-validated post-quantum cryptography, reinforcing the company’s commitment to high-assurance, standards-aligned security across resource-constrained environments including industrial control and SCADA systems, automotive ECUs, medical devices, and embedded MCUs.

“Our customers have been clear: they need a practical path to post‑quantum secure boot that fits into the devices they already ship,” said Alex Kesler, CEO of FortifyIQ. “We engineered this implementation for resource-constrained embedded systems, where memory budgets are tight, bootloaders must remain small, and long‑life devices cannot afford hardware changes.”

Key Features

  • CAVP‑validated ML‑DSA verification library
  • Small code size and small stack usage for highly memory‑constrained MCUs and embedded platforms, including industrial control, SCADA, and IoT devices
  • Verification‑only profile optimized for secure boot and firmware authentication
  • Deterministic verification behavior for predictable boot‑time performance
  • Designed for long‑life devices in industrial, automotive, medical, and energy sectors
  • Drop‑in upgrade path from RSA/ECC secure boot to ML‑DSA without hardware changes

 

Availability
The ML‑DSA verification library is available now for evaluation under NDA by qualified manufacturers and embedded security teams.

About FortifyIQ

FortifyIQ engineers certifiable cryptographic IP cores, cryptographic software libraries, and roots of trust with quantum-safe traditional and post-quantum algorithms, all algorithmically hardened against side-channel and fault injection attacks, without compromising performance, area, or energy efficiency. Our solutions are foundry- and platform-agnostic, integrating securely across a wide spectrum, from smart cards and IoT devices to AI accelerators and cloud systems.

Backed by a strong portfolio of granted and pending patents, deep cryptographic research, and formal and practical security proofs, FortifyIQ’s IP is developed and validated using both our own pre- and post-silicon EDA tools, enabling systematic evaluation of physical attack resilience, and independent evaluations.

FortifyIQ delivers advanced cryptography that is certifiable, reliable, and built to meet the challenges of high-assurance, real-world applications.
For more information contact: info@fortifyiq.com

SGS certification logo
FortifyIQ AES Algorithm
AVA_VAN.5 Evaluation & Validation Summary
SGS Brightsight Common Criteria Laboratory
“Summary. The leakage analysis (Welch t-test) on over 30 million traces did not show statistically significant first- and second-order differences between trace sets with fixed and random inputs. The template-based DPA analysis, on the pseudo-random trace set for the profiling phase (15 million traces) and on a sub-set of 300k fix input traces for matching phase targeting the first-round S-box output, and template attack on ciphertext, did not indicate any potential information leakage.”
“The results for the soft IP presented in the report were obtained on the TOE which is the basic hardware implementation of the soft IP without additional levels of security (e.g. that are present in a secure silicon layout). Therefore the internal strength of the soft IP itself was evaluated. This indicates that the investigated features and parameters of the soft IP implementation should be robust against SCA and fault injection attacks in different implementations including ASIC. Nevertheless, according to the Common Criteria rules, the strength of the final composite product must be evaluated on its own”
Request Technical Details