Post-quantum semiconductor hardware vendor SEALSQ Corp (NASDAQ: LAES) and embedded cryptography developer wolfSSL Inc. have announced native wolfTPM software support for SEALSQ’s QVault TPM hardware security chip. Designed to implement post-quantum cryptography (PQC) primitives in silicon under the Trusted Computing Group’s (TCG) TPM 2.0 v1.85 specification, the integration provides an open-source software layer to execute hardware-isolated PQC operations across embedded systems and edge hardware.
| [ SEALSQ QVault TPM & wolfTPM Architecture Overview ] | ||
|---|---|---|
| Silicon & Hardware Features | Software & Tooling Integration | PQC Algorithm Implementations |
| • 80 MHz 32-bit RISC-V Secure Core (QFN32) | • Native wolfTPM Driver Stack (GitHub PR #570) | • ML-DSA-44/65/87 (FIPS 204 / Dilithium) |
| • TCG TPM 2.0 Spec v1.85 / PC Client Compliant | • Interactive pqc_ctrl Diagnostic CLI Tool | • Hash-ML-DSA (Pre-Hashed Message Signing) |
| • Pre-Provisioned RSA2048/ECC EK Certificates | • Unified Wrapper APIs (wolfTPM2_*) | • ML-KEM-512/768/1024 (FIPS 203 / Kyber) |
Hardware Core Architecture and Cryptographic Key Isolation
The QVault TPM architecture centers on an 80 MHz 32-bit RISC-V secure core designed for Common Criteria (CC) EAL5+ assurance levels, FIPS 140-3, and NIST SP 800-90B entropy validation. As classical public-key infrastructure (RSA and ECC) faces degradation from quantum algorithms, the integration bridges physical silicon security with low-level software control:
- Hardware Isolation Boundary: Private keys for ML-DSA and ML-KEM are generated, stored, and executed inside the QVault TPM hardware boundary. Private keys are never exported to system memory, mitigating side-channel key extraction vulnerabilities.
- Pre-Provisioned Chain of Trust: Devices ship factory-provisioned with Endorsement Keys (EK) and signed EK Certificate Chains (RSA2048, ECC P256, ECC P384) tied directly to SEALSQ’s Root Certificate Authority for platform attestation.
- Developer Diagnostic Tooling: Incorporates a dedicated
pqc_ctrlCLI utility within wolfTPM, allowing developers to execute hardware self-tests, verify parameter sets across all NIST key strengths, generate entropy, and evaluate Platform Configuration Registers (PCRs). - Physical Silicon Verification: The software stack underwent functional verification on physical SEALSQ QVault TPM silicon and wolfSSL’s firmware TPM test framework, validating ML-DSA signing/verification and ML-KEM encapsulation/decapsulation cycles.
Target Verticals and Commercial Rollout Timeline
The combined architecture targets high-integrity embedded platforms requiring secure boot, firmware update validation, and encrypted telemetry across automotive ECUs, industrial SCADA gateways, smart grid meters, telecom CPEs, and connected medical instruments. Sampling and general hardware availability for the QVault TPM silicon are scheduled for November 2026. The wolfTPM software layer is available open-source via GitHub repository PR #570.
Review official technical details on SEALSQ here, inspect platform specifications on SEALSQ QVault TPM here, and inspect software pull requests via wolfTPM GitHub.
September 3, 2026