The Bootloader Has the Room. The Firmware Update Does Not.

Why it matters

A post-quantum signature can look affordable when a device is starting up and much dearer when it is still doing its job. An IETF draft headed for a 5 November review forces buyers to specify which moment their update system uses.

Daniel Kade3 November 2026 at 20:36 UTCReading Time 2 minLast update: 3 November 2026

Post-quantum firmware verification has different resource costs at early boot and during dual-image operation. Conceptual editorial illustration.

Summary

The PQUIP constrained-device draft separates early bootloader verification, with exclusive system resources, from dual-image verification while the current firmware runs.
In the second case, the new image competes for CPU, RAM and energy. An algorithm benchmark taken only at boot answers the wrong operating question.

A device cannot use a new cryptographic algorithm until it accepts an update that carries it. The 29 October PQUIP draft puts this dependency in its firmware section. Conventional RSA or ECDSA firmware signatures face a future quantum forgery risk; a post-quantum update path therefore needs a verifier already trusted by the device. RFC 9019 describes the broader IoT update architecture, but PQUIP adds a practical fork inside the box: when does the box check the signature?

At early boot the bootloader has the machine to itself. The draft says resource constraints bite less there. A dual-image system can keep serving users while checking the candidate image before a switch. That is a different load case. Verification now shares CPU cycles, memory and battery with the old firmware's ordinary work. A signature scheme selected from an isolated boot benchmark can pass the wrong test. The cost may show up as a delayed update or a starved workload; these are engineering consequences to test on the actual device.

HSS/LMS verifies efficiently but its signer must track one-time keys. SLH-DSA avoids that signing state at a cost of larger signatures and slower operations; the draft describes ML-DSA as faster and more compact than SLH-DSA. Hybrid signatures add another design choice: RFC 9794 covers combinations, and PQUIP distinguishes separate from composite forms. The text is still an active Informational draft on the IESG's 5 November agenda. The latest revision introduced no new algorithm; it made the deployment choice hard to ignore.

No named device in the official record has a paired boot-time and live-update benchmark. A trace of latency, peak RAM and energy under normal workload would settle which signature plan fits.