The automotive ecosystem is rapidly transitioning into a fully software-defined environment, with vehicles relying on complex software stacks and deeply interconnected systems. Features such as OTA updates, V2X communications, and digital keys enable unprecedented convenience and personalization – yet they also heighten dependence on secure connectivity infrastructure, particularly Public Key Infrastructure (PKI).
As emerging technologies like quantum computing threaten to break the classical cryptographic foundations that secure software-defined vehicles (SDVs), reinforcing PKI has become essential to protecting next-generation mobility. In this blog, we explore how quantum computing introduces new risks to SDVs, why OEMs must strengthen the PKI trust layer in preparation for future threats, and how AUTOCRYPT is addressing this need through post-quantum solutions.
Rising Threat of Quantum Computing to Automotive PKI
Software-defined vehicles rely heavily on cryptographic trust. Every interaction between the vehicle and its environment – whether OTA updates, V2X messages, or digital key exchanges – requires authentication and verification. PKI sits at the heart of this trust layer, ensuring that all messages, components and services the vehicle interacts with are legitimate.
The emerging problem is that sufficiently powerful quantum computers can break cryptographic algorithms such as RSA* and ECDSA**, which currently form the backbone of today’s automotive PKI.
*RSA (Rivest–Shamir–Adleman): One of the most widely used public-key cryptographic algorithms
**ECDSA (Elliptic Curve Digital Signature Algorithm): A lightweight digital signature algorithm used extensively in automotive systems
In our previous blog post “Post-Quantum Cryptography, and the Future of Automotive Cybersecurity,” we addressed the growing necessity of PQC technology. Attackers are already employing Harvest Now, Decrypt Later (HNDL) tactics – capturing encrypted automotive data today with the intent to decrypt it once quantum capabilities mature. Given that vehicles remain in operation for 10-15 years, OEMs must proactively secure the trust layer before quantum risks materialize.
The Essential Need for Transition to Post-Quantum PKI
The foundation of future-ready vehicle security begins with adopting post-quantum cryptography (PQC) — algorithms designed to remain secure even against quantum-enabled attacks.
Global standardization efforts reflect this urgency. Most notably, the National Institute of Standards and Technology (NIST) published FIPS 204 (Link) in August 2024, formally defining the Module-Lattice Digital Signature Algorithm (ML-DSA) as a U.S. federal PQC standard. With this milestone, ML-DSA became one of the first globally recognized digital signature baselines for national security and critical infrastructure systems.
Unlike traditional IT systems which transition to PQC through software updates, the automotive domain faces structural challenges:
- ECU Compute Constraints: ECUs operate with limited memory, CPU capacity, and power. PQC algorithms are larger and require more computation, necessitating optimized implementations for embedded automotive hardware.
- Scalability Across Global Fleets: Modern vehicles depend on millions of certificates across ECUs, sensors, V2X modules, telematics units, and digital keys. Securing these at PQC scale demands a horizontally scalable PKI infrastructure capable of mass certificate issuance and rotation.
- Hybrid Coexistence: Automotive systems must support classical and post-quantum algorithms concurrently during a multi-year transition, ensuring compatibility without disrupting manufacturing or aftersales systems.
These constraints make it essential for OEMs to have an automotive-grade, production-ready PKI ecosystem, capable of supporting PQC at scale.
Evolving Solutions for the Post-Quantum Era
Building on our long-standing expertise in automotive-grade PKI and cryptographic key management, AUTOCRYPT introduced AutoCrypt PKI-Vehicles, a next-generation solution designed to provide future-proof cryptographic resilience and establish a unified trust infrastructure across manufacturing, OTA, digital keys, and V2X.
As one of the earliest commercial solutions enabling ML-DSA-based certificate issuance, AutoCrypt PKI Vehicles arrives at a pivotal moment — aligning with NIST standards and offering OEMs a timely response to emerging quantum-era security demands. The solution enables post-quantum vehicle key management, supporting ML-DSA based X.509 certificate issuance, PQC-enhanced digital key workflows, secure ECU onboarding and lifecycle authentication.
AUTOCRYPT will showcase its future-proof solutions, including AutoCrypt PKI-Vehicles at the 2026 Consumer Electronic Show (CES) in Las Vegas from January 6-9. Meetings are available by reservation only. Book a meeting at https://calendly.com/autocrypt_global/.
