Nuvoton M2354 Brings Post-Quantum Cryptography to the Cortex-M23 Edge

Background: The Quantum Threat Clock and PQC's Engineering Phase

On August 13, 2024, NIST released its first three finalized post-quantum cryptography (PQC) standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). FIPS 206 (FN-DSA, formerly Falcon) is expected to follow. The shift from research to deployment has begun.

NIST officially warns of the "Harvest Now, Decrypt Later" threat: "Some secrets remain valuable for many years. Even if an adversary can't crack the encryption today, it could still be beneficial to capture encrypted data and hold onto it, in the hopes that a quantum computer will break the encryption later." For industrial IoT, smart meters, medical devices, and automotive ECUs with 15–20 year lifecycles, shipping without PQC support means shipping an expired device.

M2354 Series: Arm TrustZone + PSA L3 + SESIP L3 Foundation

Nuvoton's NuMicro® M2354 series targets IoT security with an Arm® Cortex®-M23 core (Armv8-M with TrustZone®) running up to 96 MHz. The latest M2354xJFBE and M2354CJFAE parts add TCG DICE (Device Identifier Composition Engine), baking an immutable device identity into factory provisioning and deriving per-device key chains at boot.

Memory: 1024 KB dual-bank Flash (read-while-write) and 256 KB SRAM (first 32 KB hardware-parity protected)
Secure storage: 16 KB Secure Boot ROM, 16 KB LDROM, 8 KB Data Flash (with scrambling), 2 KB Secure Key Storage, 12 KB Secret OTP
Voltage / temperature: 1.7V–3.6V, -40°C to +105°C
Power: as low as 39.6 μA/MHz in DC-DC active mode; Standby Power-Down < 2 μA; Deep Power-Down 0.1 μA
Certifications: PSA Level 3 and SESIP Level 3 — aligned with the EU Cyber Resilience Act (CRA)
Classical crypto engines: hardware-accelerated AES, DES/3DES, SHA, HMAC, ECC (including NIST P-521), RSA-4096, SM2/SM3/SM4 national ciphers, plus a hardware TRNG

MicroPQC: 8+ PQC Algorithms in Pure Software

On June 11, 2026, Nuvoton announced that its MicroPQC framework successfully deploys more than eight PQC algorithms (NIST FIPS standards plus Korean K-PQC candidates) inside the M2354 TrustZone Secure World. The implementation is pure software (no hardware acceleration), with an NTT (Number-Theoretic Transform) optimization that reduces cycle counts by roughly 30% versus reference implementations.

Signature algorithm performance (measured, ms):

ML-DSA-44 (formerly CRYSTALS-Dilithium2, FIPS 204): KeyGen 71 / Sign 334 / Verify 80
FN-DSA-512 (formerly FALCON, FIPS 206): KeyGen 9,807 / Sign 2,245 / Verify 13
SLH-DSA-SHAKE128F (formerly SPHINCS+ Fast, FIPS 205): KeyGen 3,138 / Sign 72,736 / Verify 4,583
AIMer128F (K-PQC candidate, ultra-low memory): SK 48 B / Sig 5,888 B
HAETAE2 (K-PQC candidate)

Key encapsulation performance (KEM, ms):

ML-KEM-512 (formerly Kyber512, FIPS 203): KeyGen 23 / Encaps 24 / Decaps 19 — fits in under 12 KB RAM
NTRU+768: KeyGen 14 / Encaps 18 / Decaps 13
SMAUG-T1 (K-PQC candidate, ultra-low stack)

Application Scenarios: Smart Locks to Quantum-Resistant V2X Handshakes

Per Nuvoton and MicroPQC documentation:

IoT firmware signing and FOTA: use SLH-DSA or FN-DSA-512 — short verification path, 17 KB signature
TLS 1.3 quantum-resistant handshake: ML-KEM-512 encapsulation, both Encaps and Decaps under 25 ms
Smart locks: DICE-derived device identity combined with long-term PQC keys, resilient to physical tampering
V2X: ML-DSA-44 signing plus ML-KEM KEM for C-V2X long-lifecycle security
Drones, robotics, smart home: AIMer128F or SMAUG-T1 for memory-constrained endpoints
Smart grid and AMI 2.0 metering: 15–20 year device lifecycles demand PQC at shipment

Competitive Landscape: Where M2354 Differentiates

STMicro STM32 with X-CUBE-PQC: covers the full STM32 family, software library plus hardware crypto cooperation, FIPS 140-3 target
NXP LPC55Sxx: EdgeLock secure enclave approach, PQC examples via application code hub
Infineon PSoC 64: separate secure-element architecture (Optiga Trust M) rather than PQC inside the MCU
Nationz N32H473, Renesas RA8: no public PQC implementation announcement at the time of writing

Where M2354 stands out: the only MCU vendor with explicit K-PQC (Korean) algorithm support, ML-KEM-768 RAM below 12 KB, triple certification (PSA L3 + SESIP L3 + DICE), and an open-source MicroPQC framework for downstream customization — providing a hybrid migration path from strong classical roots to PQC algorithms.

HSY Perspective: How an Authorized Distributor Helps

As Nuvoton's authorized distributor, Hengsen Technology (恒森科技) supports customers with:

Development kit supply: NuMaker-M2354 (base) and NuMaker-M2354KJB (2025 DICE-enabled), plus Nu-Link debug probe
PQC software porting services: integrating ML-KEM and ML-DSA into customer TLS 1.3 stacks, OTA modules, and firmware signing pipelines based on the open-source MicroPQC framework
TrustZone partition reference design: Secure World / Non-Secure World partitioning templates plus a PSA L3 / SESIP L3 compliance checklist
Mass-production inventory: full M2354 part-number coverage with sample availability and large-order scheduling
Bilingual technical liaison: direct line to Nuvoton HQ FAE plus the MicroPQC open-source community (GitHub: TestOpenSPI/MicroPQC)

For customers planning to ship quantum-resistant IoT devices in 2026–2027, M2354 plus MicroPQC offers a "start today" path: the silicon is in volume production, the framework is open-source, and Hengsen can bridge customers from sample to reference design to mass production.

Content compiled from Nuvoton official press releases, the M2354KJFAE product page, the MicroPQC open-source GitHub repository, NIST FIPS 203/204/205 documentation, and English-language press coverage. Contact Hengsen Technology for further detail.