Sovereign · S1-PQC
S1-PQC is the S1 Sentinel in its dedicated post-quantum configuration: an edge device that signs its own power and environmental records with NIST post-quantum signatures, the moment they are taken. It is running today on our S1 prototype, and every signature is checked by an independent implementation.
The running record
The prototype has been signing live sensor records since 10 October 2026. Counted from the ledger on 14 Oct 2026:
In the record’s first days there is one gap of nine readings on 10 October that were never captured, and no readings were recorded from late 10 October until the 12 October firmware update. Since then the device has logged every minute with no missing readings, and the count grows by one each minute it runs. Technical reviewers can receive the public key and the complete ledger and check every signature themselves with public tools.
What is running
The algorithms come from the PQClean reference project and are checked against independent implementations, so correctness is shown against the standard rather than against our own expectations.
ML-KEM-1024 (FIPS 203) for key exchange and ML-DSA-87 (FIPS 204) for signatures, each at its highest security level, run on the S1 prototype’s ESP32-S3 and pass 12 of 12 checks against independent reference implementations, including byte-for-byte known-answer tests.
The S1 firmware takes its sensor readings, signs the record with ML-DSA-87 once a minute, and sends it. Nothing is signed later or somewhere else.
Every record is checked on receipt by dilithium-py, an implementation we did not write. A tampered record or a wrong key fails.
The signing key is generated on the S1 from its hardware random-number generator and is never transmitted. Only the public key leaves, so anyone holding it can check a signature.
CNSA 2.0, the NSA’s algorithm suite for national security systems, names CRYSTALS-Kyber and CRYSTALS-Dilithium at their highest level (Level V) as its quantum-resistant public-key algorithms. NIST standardized them in 2024 as ML-KEM-1024 and ML-DSA-87: exactly the two S1-PQC runs, at that level.
Measured on the device
Timed on the S1 prototype’s ESP32-S3 at 240 MHz. A signature every minute uses a small fraction of the processor.
| Operation | Standard | Value | Unit |
|---|---|---|---|
| ML-DSA-87 sign | FIPS 204 | 110 | ms |
| ML-DSA-87 verify | FIPS 204 | 50 | ms |
| ML-DSA-87 key generation | FIPS 204 | 50 | ms |
| ML-KEM-1024 encapsulate | FIPS 203 | 13.7 | ms |
| ML-KEM-1024 decapsulate | FIPS 203 | 15.3 | ms |
| ML-DSA-87 signature size | FIPS 204 | 4,627 | bytes |
Key custody
A signature is only as trustworthy as the key behind it. S1-PQC is the S1 configured so the signing key is locked in hardware and vouched for by a secure element. It is the same S1 board design; what changes is how the key is kept. Proven on our S1-PQC test unit on 13 October 2026, and still to come, stated plainly:
The chip generates its own secret and fuses it into a slot the chip will not read out to software; the signing key is stored encrypted under it. Copy test on our S1-PQC test unit: before, the key was copied off over USB in under a second; after, a full scan of the device’s key storage finds no trace of it.
The chip runs only firmware signed with our key. Tested by loading unsigned firmware: the chip refused to start it. The debug port is permanently off and the USB port no longer allows memory to be read back.
Firmware encryption in its final mode, for units that ship to customers. It cannot be undone, so it runs on dedicated units only.
The S1 board design carries a Microchip ATECC608C secure element for device identity. The plan: its own key, which cannot be read out, signs a one-time certificate binding the device’s ML-DSA-87 public key to that unit. Arrives with the production S1 boards.