PQC Chips & Hardware

Post-quantum cryptography is moving from libraries into silicon. Through 2025-2026 a wave of secure elements, TPMs, secure MCUs, and licensable IP cores arrived with ML-KEM, ML-DSA, SLH-DSA, and the stateful hash schemes XMSS/LMS built into hardware. This page snapshots confirmed chip and IP-core products versus roadmap intent, and flags where side-channel resistance and FIPS 140-3 validation still matter most.

Secure elements & secure MCUs

SEALSQ's QS7001 is notable as a general-availability PQC secure element rather than a demo: it puts both a lattice KEM and a lattice signature into a RISC-V part aimed squarely at wallet and IoT identity, where Harvest Now, Decrypt Later (HNDL) exposure is real today. Samsung's S3SSE2A (a vendor claim, with specifics pending official confirmation) points toward PQC reaching consumer handsets, while NXP and Microchip push ML-DSA/LMS verification into firmware-integrity and embedded-control roles, where the device must verify post-quantum signatures even if it rarely generates them.

TPMs & root-of-trust silicon

Infineon's SLB 9672 uses a stateful hash signature (XMSS) to protect its own firmware updates — a conservative, well-understood choice for long-lived devices, and a good example of why state management for XMSS/LMS is a hardware concern (see xmss-lms.html). OpenTitan is a significant open-source RoT whose roadmap includes a post-quantum (hash-based SLH-DSA) secure-boot chain; its actual rollout scope in volume consumer hardware and enablement status should be verified against official announcements, though it remains a notable transparency milestone.

Licensable IP cores

IP cores let SoC designers add PQC without a full chip respin. The headline trends are tiny footprints (PQShield's PQMicroLib-Core runs PQC TLS in under 5KB of RAM) and built-in side-channel hardening (FortifyIQ's FortiPQC is explicitly SCA/FIA-resistant and field-updatable). Combining a PUF with a PQC engine — as Synopsys and Crypto Quantique do — ties post-quantum keys to a hardware-unique identity. On the open ISA front, RISC-V PQC ISA-extension and RoCC accelerator SoCs were demonstrated at RISC-V Summit Europe 2025, though these remain research prototypes.

China: domestic PQC silicon

China's hardware path mirrors its software one: push PQC down into chips rather than leave it in libraries. Guoxin's AHC001 targets the automotive market, 问天量子's HUST collaboration delivers a chip-level PQC card that bundles post-quantum compute with a quantum random-number generator, and Hygon has stated CPU-level PQC intentions for 2026-2027. For the broader domestic vendor and 密码机 picture, see cn-vendors.html and pqc-hsm.html.

Side-channels & FIPS 140-3

Putting PQC in silicon does not by itself make it safe. Lattice and hash schemes have data-dependent operations — rejection sampling, NTT, decapsulation checks — that can leak through timing, power, or EM on embedded targets. The hardware story is therefore inseparable from masking, fault resistance, and constant-time design; see side-channels.html and the implementation notes in implementations.html. Most of these products advertise FIPS 140-3 (and CC) intent, but combined FIPS 140-3 hardware + PQC validations are largely still in process; treat "certified" claims as scoped to specific modes, algorithm testing, or firmware versions.

Standards & references

• NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), and SP 800-208 (stateful hash) — the standards these parts implement.
• NSA CNSA 2.0 — https://www.nsa.gov/ (the suite several vendors align to).
• side-channels.html — why constant-time and masking matter for these chips.
• implementations.html — implementation-level pitfalls and library notes.
• xmss-lms.html — stateful hash signatures and state management in hardware.
• cn-vendors.html / pqc-hsm.html — domestic vendors and the HSM / 密码机 picture.
• Resources — full standards register