Project results and personal reflections from our OC#1 winners. From implementation to challenges and impact to PQ-REACT support and selection opportunities.
CREAPLUS story
We’re proud to announce the successful completion of our PQ-REACT Open Call 1 – Develop project: “Application of PQC Cryptography in Smart Grid deployments.” The goal of the project was to benchmark post-quantum digital signature algorithms for firmware signing on smart meters—devices that operate under strict memory and processing constraints. As the quantum threat draws closer, understanding how post-quantum cryptography (PQC) performs in such constrained environments is critical for ensuring secure future deployments.
The project ran from November 2024 to May 2025 and involved testing a range of signature schemes: classical ECDSA, and post-quantum candidates including ML-DSA, LMS, XMSS, and SLH-DSA. We evaluated verification performance across various firmware sizes (1–512 kB), focusing on operations such as file loading, hashing, verification, and additionally AES encryption for better comparison of results. Due to their structural complexity, LMS and XMSS were benchmarked only for the verification of 512 kB files.
One of the most consistent findings was the solid performance of ML-DSA, which delivered stable and reliable results across all tested parameters. In contrast, LMS, XMSS, and SLH-DSA showed irregularities in performance—likely due to unoptimized or incomplete reference implementations, a trend we had already noticed in our initial review of available PQC libraries. Notably, even SHA and ECDSA operations—usually well-understood—performed significantly worse than expected when implementations from PQC libraries were used, reinforcing the need for production-grade implementations.
Unexpected verification time drops in XMSS (particularly between 4–32 kB) and noticeable inconsistencies in SLH-DSA suggest that further investigation is needed, ideally under more controlled conditions. We dearly hope to continue this work with a real-life smart meter deployment, where testing on physical infrastructure over longer periods could eliminate environmental noise and offer deeper insights.
Without the funding and support of PQ-REACT Open Call 1, allocating the resources for a project of this scope would not have been possible for our team. Thanks to this initiative, we were able to gain both hands-on experience and actionable knowledge, while contributing to the growing understanding necessary for the PQC migration ahead.
Being part of the PQ-REACT ecosystem has been invaluable. The project structure, expert input, and collaboration opportunities enabled us to address practical challenges of PQC deployment that are often overlooked. Most importantly, it gave us the chance to contribute concrete data toward the global effort of securing our digital infrastructure in the post-quantum era.
