From January 1, 2027, all new National Security Systems acquisitions must be CNSA 2.0 compliant by default, and software and firmware signing must be CNSA 2.0 exclusively by 2030. Military avionics is NSS. Are you ready?
Airframes then run 30 to 50 years. A DAL A root of trust certified on RSA-2048 today outlives every published PQC drop dead estimate, and re-certification after entry into service is the expensive event, not the initial certification. Can you afford re-certification?
PQC Verify-Only Builds Already Exist
Secure boot and field-loadable software verification on the aircraft need signature verification only. Key generation, signing and state management stay on the ground. wolfCrypt has supported verify-only builds of the PQC signature algorithms since the beginning. This removes keygen, signing, the DRBG and the entropy source from the build entirely — and therefore from anything you would have to certify.
LMS at the CNSA 2.0 recommended parameter set, verification only:
./configure --enable-cryptonly --enable-lms=verify-only,sha256-192
That emits WOLFSSL_HAVE_LMS, WOLFSSL_LMS_VERIFY_ONLY and WOLFSSL_LMS_SHA256_192. No bignum, no rejection sampling, no unbounded loops — hashing and Merkle path recomputation. It is about as small as a certifiable signature verifier gets.
ML-DSA-87 verification only, with the other parameter sets compiled out:
./configure --enable-cryptonly --enable-mldsa=verify-only,87
That gives WOLFSSL_HAVE_MLDSA, WOLFSSL_MLDSA_VERIFY_ONLY, WOLFSSL_NO_ML_DSA_44 and WOLFSSL_NO_ML_DSA_65. Add WOLFSSL_MLDSA_VERIFY_SMALL_MEM via CFLAGS where boot RAM is tight. The equivalents exist for XMSS as well.
On the KEM side, WOLFSSL_MLKEM_NO_MAKE_KEY, WOLFSSL_MLKEM_NO_ENCAPSULATE and WOLFSSL_MLKEM_NO_DECAPSULATE trim by direction, and WOLFSSL_NO_ML_KEM_512 / WOLFSSL_NO_ML_KEM_768 leave ML-KEM-1024 alone for CNSA 2.0.
CNSA 2.0 is itself a trim specification; one parameter set per purpose, and NSA has said it does not plan to add further NIST PQC standards to the suite, so the boundary is stable for the life of the type certificate.
Are you seeing PQC show up in avionics requirements yet? Reach out at do178@wolfssl.com.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now