wolfSSL at the Toradex Booth: Post-Quantum the SMARC iMX95 SoM

    • Heading to Embedded World North America (September 22–24)? Stop by Toradex at Booth 6222 to see wolfSSL’s live Post-Quantum Cryptography (PQC) demo on the Toradex SMARC iMX95 module. Afterward, visit the wolfSSL booth (#6027) to say hi and talk with our team.

    The Demo at a Glance

    We demonstrate post-quantum security across both halves of the NXP i.MX95 SoC. The chain runs from the boot ROM up to a Linux login prompt. All output routes to a single serial console.

    • Replacing U-Boot SPL: wolfBoot runs directly from the boot ROM. It sets up clocks and pin muxing over SCMI. Next, it reads the eMMC and places ARM Trusted Firmware and OP-TEE. Finally, it verifies the Linux FIT image using ML-DSA-87 before execution.
    • Cortex-M7 Real-Time Core: A second wolfBoot instance verifies a Zephyr RTOS image with ML-DSA-87. This step takes 15.7 ms.
    • Cortex-A55 Cluster: wolfCrypt ML-KEM and ML-DSA benchmarks run inside a container on Torizon OS.

    Both boot chains stay on the board. Stock U-Boot sits in one eMMC partition, while wolfBoot sits in the other. This setup allows direct side-by-side performance comparisons on identical hardware.

    Key Performance & Security Highlights

    • Fast PQC Boot: Verifying the 56 MB Linux FIT image takes 13 ms for the ML-DSA-87 signature and 134 ms for hashing. The post-quantum check is the fastest part of the verified boot process.
    • Blazing Fast Key Exchange: On the Cortex-A55 cluster, ML-KEM-768 encapsulates at 17,108 ops/sec. Classical ECDHE P-256 performs at 2,833 ops/sec. Post-quantum key exchange acts as the fast path. It is not a performance tax.
    • Hardware-Backed Security:
      • wolfCrypt’s DRBG seeds directly from the EdgeLock Secure Enclave TRNG.
      • wolfSSL generates and signs with ECC P-256 keys inside the OP-TEE PKCS#11 token. Private keys never touch normal-world memory.
    • Containerized Deployment: Powered by Torizon OS, the Cortex-A55 demo uses a single docker-compose.yml file. It deploys easily via Torizon Cloud. Standard SMARC form-factor support ensures portability to any compatible carrier board.

    Resources & PRs
    Try it yourself or explore the open-source changes behind the demo:

    What’s Next?

    We are expanding our i.MX95 support:

    1. Bare-metal wolfCrypt execution on Cortex-A55 outside of Linux.
    2. AHAB container signing so the boot ROM authenticates wolfBoot directly.
    3. Deeper EdgeLock integration for hardware-backed key storage and attestation.

    Stop By and Say Hi!

    wolfSSL and wolfBoot are dual-licensed under GPLv3 or a commercial license.

    • Toradex Booth (#6222): See the demo live.
    • wolfSSL Booth (#6027): Meet our team to discuss PQC and embedded security.

    If you can’t make it to embedded world North America and have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

    Download wolfSSL Now