wolfSSL (Booth 6027) is joining Toradex at their booth 6222 for Embedded World North America, September 22 to 24. We are demonstrating post-quantum cryptography running on both halves of the Toradex SMARC iMX95 module.
| pane | what it shows |
|---|---|
| left | wolfCrypt ML-KEM and ML-DSA benchmarks in a container on the six Cortex-A55 cores, under Torizon OS |
| right | wolfBoot performing ML-DSA-87 verified boot of the Cortex-M7, with its console relayed to Linux |
The pairing is the point. These are the same post-quantum algorithms at the same security level, running on two very different cores of one part, a Linux application cluster and a bare-metal real-time core, with nothing but the SoC doing the work.
What you will see on each side
On the left, ML-KEM-768 encapsulates at 17,112 ops/sec against 2,865 for a classical ECDHE P-256 agreement, and a TLS 1.3 handshake that is 13% faster with the post-quantum hybrid group than without it. Post-quantum key establishment on this part is the fast path, not a tax.
On the right, wolfBoot verifying an ML-DSA-87 signature at NIST level 5 and booting a Zephyr image in 7.4 ms, from a bootloader that is 940 bytes smaller than the ECDSA P-256 build of the same thing.
Toradex easy installer
The module arrives with the Toradex Easy Installer in eMMC, which comes up on HDMI and simultaneously exposes a network interface over USB. Installing Torizon OS 7.7.0 took under a minute:
tezictl image-list tezictl --accept-all-licenses image-install 0
Torizon OS is container-first, with a read-only OSTree root filesystem, OCI containers and atomic updates, so the A55 half of the demo is a plain docker-compose.yml that deploys to one board or to a fleet through Torizon Cloud with no bespoke packaging. And because SMARC is a standard form factor, the module drops into any compliant carrier, so this work moves with the SOM rather than being tied to one board design.
Hardware root of trust
Two hardware-backed pieces run on the board today. wolfCrypt’s DRBG can be seeded directly from the EdgeLock Secure Enclave TRNG rather than the kernel’s software entropy pool, and wolfSSL generates an ECC P-256 key inside the OP-TEE PKCS#11 token and signs with it there, so the private key never enters normal-world memory.
Run it yourself
The whole demo, including the benchmark container, the Zephyr RPMsg payload, the board-side orchestration and the two-pane renderer, is published as a package:
- Demo: wolfBoot-examples PR #13 (README)
- wolfBoot i.MX95 M7 target: wolfBoot PR #863 (branch)
- OP-TEE PKCS#11 examples: wolfssl-examples PR #618 (branch)
- Supporting wolfSSL changes: #11201, merged, which lets a PKCS#11 EC key both derive and sign, and #11216, which seeds the DRBG from a nominated hardware RNG
Coming next: wolfBoot replacing U-Boot on the A55 cluster with ML-DSA-87 verifying the Linux FIT image, bare-metal wolfCrypt on an A55 outside Linux, and deeper EdgeLock integration for hardware key storage and attestation.
wolfSSL and wolfBoot are dual-licensed under GPLv3 or a commercial license. Come find us at the Toradex booth 6222 or wolfSSL booth 6027, or reach us any time at facts@wolfssl.com or support@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now