STMicroelectronics ST54M Adds Hardware Post-Quantum Crypto for Edge Agents

STMicroelectronics has shipped samples of the ST54M, the first secure-element member of the ST54 family — in use across Android for over a decade — that integrates dedicated hardware acceleration for post-quantum cryptography. The chip combines an NFC controller, secure element, eSIM support, and the company's K-Check PQC engine on one die. Volume production and formal certification are targeted for July 2026.

The K-Check accelerator runs ML-KEM (NIST FIPS 203) and ML-DSA (NIST FIPS 204), the lattice-based algorithms NIST finalized last year for key encapsulation and digital signatures. The secure element runs on an Arm Cortex-M35P core with 4.5 MB of secure nonvolatile memory and 800 kB of RAM — enough to host independent enterprise, banking, and government applets on one platform without cross-contamination. Classical cryptographic engines remain; the chip operates in hybrid mode, signing and encapsulating with both classical and post-quantum algorithms simultaneously until ecosystem migration completes.

The harvest-now-decrypt-later scenario drives the hardware investment, not imminent quantum capability. Laurent Degauque, Connected Security Business Lines director at STMicroelectronics, said in an EE Times interview: "Someone can collect encrypted data today without being able to read it. If quantum computers break that encryption in five or six years, and those secrets remain valuable, the data is exposed." STM estimates practical cryptographic break horizon at five to seven years.

For edge-inference architects, the ST54M matters on two fronts. First, agent credential management: the K-Check engine offloads ML-KEM key-encapsulation from the application processor, keeping PQC operations off the inference compute budget on memory-constrained devices. Signing agent ephemeral keys or attestation certificates in hardware eliminates the side-channel exposure of software-only lattice implementations on general-purpose cores. Second, the secure element is hardened against fault-injection and side-channel monitoring at the silicon level — the same threat surface relevant for model-weight extraction and key theft on deployed edge nodes.

The chip integrates an on-chip DC-DC converter previously requiring an external component, reducing BOM count and board area. RF performance gains let OEMs use smaller and frame antennas while maintaining NFC range — directly relevant for compact edge devices where antenna real estate is constrained.

Standards readiness is the other operational gate. ML-KEM and ML-DSA are finalized, not pre-standard drafts. Degauque noted that "OEMs can now deploy solutions based on established standards." The GSMA is working on PQC-enabled eSIM specifications; devices shipping with ST54M hardware will be accelerator-ready when those standards land without a hardware respin. Common Criteria 2022 EUCC and EMVCo certification evaluations are complete; formal certification is scheduled July 2026, the gate for payment-network and government-identity deployments.

Hybrid mode is transitional, not permanent. Running ML-KEM alongside ECDH doubles key-agreement overhead on the wire, and managing dual certificate chains adds complexity to PKI pipelines most edge deployments have not encountered. Firmware libraries NesLib-PQML and X-CUBE-PQC are available for ST54M, but integrating them into existing secure-enclave provisioning flows requires explicit engineering effort.

Architects with long-lived agent credentials or model attestation keys signed today with RSA or ECC should treat those as already harvested if the agent's operational life exceeds five years. Hardware that can re-issue those keys under ML-DSA without a board revision is the minimum viable mitigation. The ST54M's sampling availability means the design cycle can start now.