Post-quantum: Espressif brings ML-KEM and ML-DSA to ESP32 chips

Espressif Systems, the maker of the ESP32 microcontrollers widely used in connected devices, released esp-pqc on October 14. This software component brings post-quantum cryptography to its current chips. It implements ML-KEM-768 (NIST standard FIPS 203, for key exchange) and ML-DSA-65 (FIPS 204, for signatures), without waiting for a new generation of hardware.

What esp-pqc contains

The component is added to an ESP-IDF project, Espressif's development framework, version 6.0 or later, without modifying the core of the framework. It relies on an Espressif version of the open-source library liboqs and on an adapted version of mbedTLS. Two uses are offered:

• Hybrid TLS 1.3: the X25519MLKEM768 key exchange combines the classical X25519 algorithm with ML-KEM, with a certificate chain signed using ML-DSA-65. On an ESP32-C5, the handshake takes about 300 milliseconds on a local network, according to Espressif.
• Hybrid secure boot: the firmware carries a classical signature (RSA or ECDSA) and an ML-DSA-65 signature, both verified at every boot. On an ESP32-C5 at 80 MHz with RSA-3072, full verification takes about 91 ms, of which 78 ms are added by the post-quantum layer. This feature is supported on the ESP32-C3, C5 and C6.

With the hybrid approach, an attacker must break both the classical algorithm and the post-quantum algorithm. This is also the approach recommended by several European agencies, including ANSSI (France's national cybersecurity agency), during the transition.

Limitations to know about

• Espressif presents esp-pqc as a tool for evaluation and measurement, not as a production-ready solution.
• The chips' read-only memory (ROM) only supports classical secure boot. ML-DSA verification is therefore added, in software, in the second-stage bootloader. Changing the trust key requires reprogramming this bootloader.
• Post-quantum elements are much larger: an ML-DSA-65 signature is 3,309 bytes. More RAM must be allowed for TLS buffers, along with 8 KB of flash memory for the post-quantum signature block (12 KB in total with the classical signature).
• The ML-DSA private key must be protected like the secure boot key: losing it or having it compromised would block legitimate updates.

Espressif says its future chips will include post-quantum hardware acceleration and secure boot, without giving a timeline.

Why test now

Connected devices often stay in service for many years, and their update chain is hard to change after the fact. With esp-pqc, a manufacturer or integrator can measure today what post-quantum costs in memory, boot time and network latency, then reserve the necessary room in their next boards. The code and four examples are published on GitHub, in the espressif/esp-pqc repository. The repository is released under the Apache 2.0 license.