Espressif published esp-pqc on 14 October 2026, an ESP-IDF component that adds the two NIST post-quantum algorithms, ML-KEM (FIPS 203) and ML-DSA (FIPS 204), to existing Espressif chips. It runs entirely in software, so you can try post-quantum TLS 1.3 and an extra firmware signature check at boot without waiting for new silicon. Espressif positions it as a tool for evaluation and benchmarking, not as a drop-in production feature.
The threat it targets is long-lived hardware. A smart meter or sensor gateway can stay in service for 10-15 years. Traffic recorded today could be decrypted later once RSA and elliptic-curve keys fall to a quantum computer, and a forged vendor signing key could push malicious OTA updates.
What is in the component
esp-pqc ships an Espressif fork of liboqs, an mbedTLS build that understands hybrid TLS 1.3, and a small verify-only ML-DSA-65 build for the second-stage bootloader. It does not touch core ESP-IDF files. Requirements: ESP-IDF v6.0 or later. The TLS examples need Wi-Fi and 4 MB of flash, and the boot check currently supports the ESP32-C3, ESP32-C5 and ESP32-C6.
Four examples come with it: kem_basic, signature_basic, esp_hybrid_tls and pqc_boot_verify. Each one prints time, CPU cycles, heap and stack use to the serial monitor.
Hybrid TLS: bigger handshakes
Both features are hybrid, so an attacker has to break the classical and the post-quantum algorithm. For TLS, esp-pqc adds the X25519MLKEM768 key exchange and ML-DSA-65 certificates. The cost is size: the key share grows from 32 bytes to 1,216 bytes, an ML-DSA-65 public key is 1,952 bytes and a signature 3,309 bytes, against roughly 64 bytes each for ECDSA P-256. The CA certificate in Espressif's test was 7,571 bytes, and you have to enlarge mbedTLS I/O buffers, which costs SRAM. On an ESP32-C5 the full handshake took about 300 ms, including local network round trips.
Post-quantum check at boot
The ROM only knows classical Secure Boot V2 (RSA or ECDSA), so the post-quantum signature is checked in the second-stage bootloader. The build host signs the image twice, and the extra ML-DSA-65 block adds 8 KB on top of the 4 KB classical signature sector. Measured on an ESP32-C5 at 80 MHz with RSA-3072, the whole check took about 91 ms: roughly 30 ms of hardware SHA-256, 44 ms of software ML-DSA-65 and 13 ms of hardware RSA. Espressif puts the post-quantum overhead at about 78 ms of boot time and 8 KB of flash. The trusted ML-DSA key lives in the bootloader, so changing it means reflashing the bootloader, and the private key needs the same care as your Secure Boot key.
Who should care now
The post covers ESP-IDF only and does not mention ESPHome or Arduino, so a typical Home Assistant sensor will not change. It matters most if you build commercial ESP32 products with a long service life or have to answer questions about cryptographic agility. Espressif also says future SoCs will get dedicated post-quantum hardware acceleration and built-in post-quantum Secure Boot verification.