PQCleanAutomotive

PQCleanAutomotive is planned as a collection of post-quantum cryptographic algorithms for automotive microcontrollers. The post-quantum cryptographic algorithms are based on the PQClean repository, which is a clean collection of the NIST post-quantum project.

Security and Audit Disclaimer

The cryptographic implementations in this repository have not undergone a formal security audit or an external security review. No security risk analysis, such as a TARA, has been carried out for the use of these implementations in an automotive system.

The implementations are based on cryptographic algorithms evaluated by NIST. This does not mean that the implementations, their integration, or their use in a specific system have been evaluated, certified, or approved by NIST.

The random numbers used by the example implementations are generated by software. This is provided for demonstration and testing purposes only and must not be used as-is for production security purposes.

The software is provided under the applicable license terms without warranty. See LICENSE, NOTICE, and the component-specific license files for further information.

Content

The PQCleanAutomotive is a fork of the PQClean repository. It includes the following post-quantum cryptographic algorithms:

• ML‑KEM (CRYSTALS-KYBER)
• ML‑DSA (CRYSTALS-DILITHIUM)
• SLH‑DSA (SPHINCS+)
• FN‑DSA (FALCON)
• HQC

SLH‑DSA and FN‑DSA based on the commit #504. HQC based on the commit #587. ML‑DSA based on the commit #592. Start to include changes from #592 for ML‑KEM.

Implementation

For the integration of PQCleanAutomotive, the file Crypto.c in the IAV_quantumSAR repository contains an example of the use of the ML‑KEM, HQC, ML‑DSA, SLH‑DSA and FN‑DSA algorithm.

In the SLH‑DSA algorithm, dynamic arrays had to be replaced by static arrays in various functions for the microcontroller implementation.

Integration, build and test

This repository provides algorithm implementations and public API headers. It does not provide a standalone application or a project-specific build system.

To use the algorithms, the required source files and headers must be integrated into the target project's build environment. Platform-specific components must be provided or adapted by the integrator.

An example integration can be found in the Crypto.c file of the IAV_quantumSAR repository.

License

PQCleanAutomotive contains third-party components with licensing information that differs from the Apache-2.0 license applicable to IAV contributions. License information, applicable license texts, and attribution notices are located in the respective component directories and in the root NOTICE file.

• ML‑KEM: PQClean Public Domain designation; see ML_KEM/LICENSE and NOTICE.
• ML‑DSA: PQClean Public Domain designation; see ML_DSA/LICENSE and NOTICE.
• SLH‑DSA: CC0 1.0 Universal; see SLH_DSA/LICENSE and NOTICE.
• FN‑DSA: MIT License; see FN_DSA/LICENSE and NOTICE.
• FIPS-202 / Keccak and SHA-2 support code: upstream Public Domain designation; see NOTICE and the source-file notices.
• HQC: upstream Public Domain designation; see Hqc/LICENSE and NOTICE.
• IAV-authored support code and modifications: Apache License, Version 2.0; see LICENSE.

Copyright [2026] [IAV GmbH]

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

MISRA

PQCleanAutomotive and the post-quantum cryptographic algorithms are checked with the 2012 version of MISRA. Not all MISRA findings could be resolved. An explanation has been written in the relevant places. Note: Rule 1.1 of MISRA was globally disabled because the IAV headers in each file are detected as macros, leading to numerous false positives. Disabling this rule ensures that these headers are not incorrectly flagged as violations.

Doxygen

The post-quantum cryptographic algorithms have been labelled with doxygen comments for documentation reasons.

Compiler

In this repository the post-quantum cryptographic algorithms are warning free compiled with TASKING Compiler with standard flags.

Measurement results

Our measurement results are documented in our open access paper for the 23rd escar Europe 2025:

   https://hss-opus.ub.ruhr-uni-bochum.de/opus4/frontdoor/index/index/year/2025/docId/13649