The quantum clock is ticking, and the root of trust is where the countdown matters most. Today we are excited to announce that wolfTPM now supports the SealSQ QVault TPM, one of the first TPM 2.0 modules to implement post-quantum cryptography in silicon. With this integration you can generate and use ML-DSA (FIPS 204) signatures and ML-KEM (FIPS 203) key encapsulation on real, dedicated secure hardware.
Why This Matters
Every device that trusts a TPM today trusts its RSA and ECC keys. “Harvest now, decrypt later” attacks and the eventual arrival of cryptographically relevant quantum computers put those classical keys on notice. NIST’s post-quantum standards, ML-DSA for signatures and ML-KEM for key establishment, are the answer, and moving them into the TPM keeps the private keys where they belong: generated on-chip, never exported, protected by hardware.
The SealSQ QVault brings the TCG TPM 2.0 v1.85 post-quantum command set to life on silicon, and wolfTPM works with it out of box.
What You Get
- Hardware ML-DSA-44/65/87 key generation, signing, and verification.
- Hardware ML-KEM-512/768/1024 key generation, encapsulation, and decapsulation.
- Hash-ML-DSA (pre-hash signing) for large messages.
- The familiar wolfTPM wrapper API: the same wolfTPM2_* calls you already use for RSA and ECC now target post-quantum keys.
- A new pqc_ctrl control tool that exercises every PQC operation and manages the board from a single command line.
Build it with one flag:
./configure --enable-sealsq --enable-pqc && make ./examples/pqc/pqc_ctrl --all
Available Now for Evaluation
wolfTPM is dual-licensed (GPLv3 and commercial) and runs everywhere. The SealSQ QVault TPM is in public pre-production. If you are building a device that needs a post-quantum root of trust, reach out to us at facts@wolfssl.com to get started.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now