IoT-Oriented Digital Signature Defense Against Single-Trace Belief Propagation Attacks in Post-Quantum Cryptography

Abstract

Post-quantum cryptographic implementations in Internet-of-Things (IoT) devices are significantly threatened by physical side-channel attacks, where practical attack risks are increased by physical accessibility and resource limitations. In particular, recent work has shown that belief propagation-based attacks can recover secret keys from lattice-based digital signatures using only a single side-channel trace of the Number Theoretic Transform (NTT). This work introduces the Quantum-Randomized Number Theoretic Transform (QR-NTT), an implementation-level defense mechanism that integrates quantum-derived entropy directly into the execution flow of lattice-based signature algorithms. Rather than treating randomness as a static input, QR-NTT uses quantum entropy to introduce controlled variability in execution ordering, arithmetic factor usage, and memory access behavior while preserving mathematical correctness and constant-time execution. The proposed framework is designed for embedded platforms and remains compatible with existing post-quantum cryptographic standards and IoT communication protocols. A complete implementation on an ARM Cortex-M4 platform, coupled with commercial quantum random number generator (QRNG) hardware, demonstrates that QR-NTT significantly degrades the effectiveness of template matching and belief propagation attacks. Experimental evaluation shows a reduction in single-trace attack success rates from over 90% to below 3% and an increase of approximately two orders of magnitude in the number of traces required for successful key recovery. These security gains are achieved with moderate overheads of 18.3% in execution time and 1.8 KB of additional memory while remaining well within practical IoT constraints. The results indicate that quantum-derived entropy can be leveraged as a practical implementation-level defense against physical attacks, complementing algorithmic post-quantum security. QR-NTT demonstrates a viable path toward strengthening the real-world resilience of post-quantum IoT systems without sacrificing deployability.

1. Introduction

Recent progress in quantum computing has implications for the long-term security of classical cryptographic schemes. As a result, post-quantum cryptography (PQC) has become very important, particularly lattice-based constructions. These constructions are regarded as practical options because of their security characteristics and implementability [1]. The adoption of such schemes creates new limitations concerning deployment conditions and resource availability in Internet-of-Things (IoT) environments. When operating under strict constraints on power, memory, and computational capacity, embedded devices used in critical infrastructure, industrial control, and healthcare must maintain security for extended periods of time. In this context, cryptographic robustness needs to take into consideration current physical threats in addition to resistance against potential quantum attacks in the future. Physical side-channel attacks are one of the most serious risks that deployed devices must deal with, especially when embedded systems are accessible in uncontrolled environments, according to recent systematic analyses of IoT security [2].

IoT ecosystems are vulnerable to distributed threat vectors and network-level incursions in addition to physical attacks. For instance, secure information fusion procedures were proposed to enable robust distributed cyber-physical systems during attacks [3], and self-supervised adaptation strategies were developed to detect network intrusions in dynamic IoT contexts where attack patterns usually alter [4]. These complementary perspectives emphasize the need for multi-layered security methods that address threats at the network and physical levels.

The Number Theoretic Transform (NTT), which permits effective polynomial arithmetic and compact implementations appropriate for limited platforms, is an essential part of lattice-based digital signatures [5]. Additionally, the NTT is vulnerable to physical side-channel investigation due to its highly regular construction. Recent studies have demonstrated that this pattern can be exploited with unexpected efficacy. In particular, the authors of [6] showed that one side-channel trace of an NTT calculation may be sufficient to recover long-term secret keys. Their method successfully uses popular software countermeasures such as masking and combines lattice decoding techniques, belief propagation over the NTT factor graph, and template attacks on modular arithmetic operations [7].

This attack model poses a significant risk to IoT devices, which are frequently physically accessible and are supposed to function safely for many years. Permanent compromise can arise from even brief adversarial access, with consequences that affect not just individual devices but entire networks. Despite the fact that [8] suggested countermeasures like shuffling, blinding, and constant-time implementations, these methods typically result in non-trivial overheads or only partial protection, creating a gap between formal cryptographic security and practical resilience against physical attacks.

In parallel, quantum random number generators (QRNGs) have reached a level of technological maturity that makes their integration into embedded systems increasingly realistic. By exploiting quantum physical processes, QRNGs provide entropy that is not subject to algorithmic prediction or statistical reconstruction, unlike classical pseudo-random number generators. This raises the question of whether quantum entropy can be used for purposes beyond conventional randomness provision. Specifically, it motivates the exploration of execution-level randomization as a means of disrupting side-channel analysis.

This work addresses that question by introducing the Quantum-Randomized Number Theoretic Transform (QR-NTT), a defense mechanism designed for IoT-oriented post-quantum digital signatures. We use the term “Quantum-Randomized” to denote the use of quantum-generated entropy as an active computational element that influences execution behavior, distinct from standard randomization methods where pseudo-random number generators (PRNGs) or classical true random number generators (TRNGs) serve only as static inputs. Unlike classical TRNGs, which rely on physical processes that are theoretically predictable given full state information, quantum entropy from QRNGs is fundamentally unpredictable due to the inherent randomness of quantum measurement processes. This property enables QR-NTT to introduce execution variability that cannot be modeled or reverse-engineered by an adversary, providing stronger side-channel resistance than classical randomization techniques. Unlike prior works that employ QRNGs merely as high-quality entropy sources for key generation or nonce derivation, QR-NTT actively injects quantum entropy into the execution flow of the cryptographic primitive itself, randomizing computational structure, memory access patterns, and arithmetic operand usage at runtime. This fundamental distinction transforms the NTT from a deterministic computation into a dynamically varying process whose side-channel characteristics are uncorrelated across executions. Instead of treating randomness as a static input, the proposed approach uses entropy derived from a QRNG to influence the execution behavior of the NTT itself. As a result, the transform no longer behaves as a fixed, deterministic computation but as a dynamically varying process whose side-channel characteristics differ across executions. This transformation directly targets the assumptions underlying belief-propagation-based side-channel attacks and aims to increase the practical difficulty of modeling and key recovery in resource-constrained environments.

Specifically, we make the following novel advancements:

• We develop the first Quantum-Randomized NTT (QR-NTT) framework that injects quantum-derived entropy into butterfly execution ordering, twiddle factor obfuscation, and memory access patterns, creating execution variability that prevents stable side-channel template construction. This includes lightweight mechanisms for dynamic butterfly execution reordering, twiddle factor obfuscation, and memory access randomization, all driven by real-time quantum entropy and implemented within the memory and cycle budgets of an ARM Cortex-M4 microcontroller.
• We demonstrate that injected quantum entropy systematically breaks template matching by dispersing leakage across a larger feature space (modular multiplication contribution drops from 68% to 11%) and cripples belief propagation convergence through unpredictable compatibility function variations, increasing convergence iterations from 15–25 to 200–400. This reduces single-trace attack success rates from >90% to <3% and increases required traces for key recovery by 200–300 times.
• We implement and benchmark a complete defense system on commercial hardware, integrating ID Quantique QRNGs with an embedded target. We provide a full performance characterization, showing a manageable overhead of 16–23% in execution time and an additional 1.8 KB of RAM, while maintaining constant-time execution and deterministic latency—critical for real-time IoT systems.
• We establish a reproducible attack-defense evaluation framework using ChipWhisperer side-channel analysis tools. By first faithfully reproducing the state-of-the-art BP attack on a vanilla implementation and then subjecting our QR-NTT to the identical analysis pipeline, we provide the first side-by-side empirical validation of quantum-enhanced physical security.
• We deliver deployment-ready guidelines and modular software components that enable the practical adoption of this defense in existing IoT security architectures, addressing integration challenges, power management, and standardization pathways [9].

Our results demonstrate that it is feasible to raise the physical security floor for post-quantum IoT signatures dramatically without violating the strict constraints of their operational environment. By integrating quantum-derived entropy into the execution flow of cryptographic operations, the proposed approach improves the resistance of digital signatures to both future quantum-based cryptanalysis and existing side-channel attack techniques. The results highlight the role of implementation-level measures in complementing algorithmic security, particularly in IoT environments where large numbers of devices must operate reliably under practical constraints. Such considerations are relevant for the deployment of post-quantum cryptographic mechanisms in large-scale and long-lived systems.

2. Background and Attack Foundation

2.1. The NTT in Lattice-Based IoT Signatures

The practicality of lattice-based digital signatures on IoT platforms relies heavily on efficient polynomial arithmetic, most commonly implemented using the Number Theoretic Transform (NTT). By transferring polynomial coefficients into the spectral domain, the NTT enables multiplication with $O(n log n)$ complexity through point-wise operations [5]. However, the same structural features that make the NTT computationally efficient also cause security problems. Its butterfly network has a fixed calculation pattern that can lead to recurrent side-channel leakage across executions due to its deterministic memory accesses and extremely regular data flow.

Such regularity is frequently required to meet performance and power requirements for IoT devices with limited resources, but it also makes profiling easier for physical attackers. NTT-based signature schemes can achieve small code sizes (less than 3 KB) and low RAM usage (less than 10 KB), making them appropriate for embedded deployment, according to earlier research on ARM Cortex-M4 implementations [5]. Despite these advantageous features, many practical deployment recommendations do not yet sufficiently address how such implementations are vulnerable to side-channel attacks.

2.2. Single-Trace Belief Propagation Attacks on NTT Implementations

Primas et al. [6] originally illustrated how NTT implementations are susceptible to single-trace attacks by demonstrating that a single power or EM trace of an inverse NTT during decryption could result in complete key retrieval. Three coordinated steps make up their attack methodology:

Matching Templates in Modular Operations: In order to create probability distributions for intermediate values conditioned on observed leakage, the attacker first profiles each modular operation (multiplication, addition, subtraction) within the NTT butterfly. Data-dependent reduction steps and operational and, in particular, power usage during modular multiplication with twiddle factors are examples of critical leakage spots.

Belief Propagation over NTT Factor Graphs: The computational structure of the NTT is depicted as a factor graph in which factor nodes indicate arithmetic interactions (addition, subtraction, multiplication) and variable nodes correspond to intermediate values. By effectively combining the probabilistic data from every leaking point, belief propagation (BP) refines probability distributions as messages move across the graph. Because of this, even from noisy measurements, the attacker may confidently extract intermediate values.

Decoding Lattices to Recover Keys: Linear constraints on the secret key are provided by recovered intermediate values. The attacker can effectively recover keys by lattice basis reduction (e.g., BKZ) by reducing the dimension of the underlying lattice issue by inserting these constraints into the public key equation. Key recovery becomes computationally simple when there are enough intermediate values (for example, 192 coefficients for n = 256).

Because each share may be targeted separately and recombined, this attack mechanism circumvents masking countermeasures and is nonetheless effective against shuffled implementations using graph adaptation techniques [7].

2.3. Limitations of Classical Countermeasures

When NTT-based signatures are used in IoT environments, traditional physical attack defenses show notable limitations:

• Masking: As shown in [6,8], masking is susceptible to single-trace attacks when paired with belief propagation, notwithstanding its effectiveness against differential power analysis (DPA). Masked implementations also result in significant memory and performance overhead (often two or three times), which is prohibitive for many IoT devices.
• Shuffling: Although the NTT’s intrinsic parallelism restricts shuffling opportunities within butterfly layers, randomizing the execution order of separate operations might increase attack complexity. Additionally, “shuffle nodes” in the factor graph can be incorporated by sophisticated BP attacks in order to mimic and compensate for randomization [7].
• Blinding: When enough output coefficients are known, multiplying intermediate values by random scalars adds computing complexity and is frequently reversible by brute-force search [6].
• Constant-Time Implementation: Although crucial for thwarting timing attacks, constant-time coding does not stop power or electromagnetic leakage from data-dependent operations, especially modular reductions, which often show data-dependent execution even when using constant-time algorithms on embedded platforms [10].

2.4. Quantum Randomness as a Security Primitive

A fundamentally new method of creating randomness is provided by quantum random number generators (QRNGs), which create truly unpredictable bit sequences by taking advantage of quantum mechanical processes like photon polarization measurement. Unlike classical true random number generators (TRNGs) or pseudo-random number generators (PRNGs), QRNG outputs are provably non-deterministic and resistant to algorithmic prediction [11]. Because of this characteristic, QRNGs are particularly well-suited for security applications where attack resistance is directly determined by randomness quality. The research described in [12] offers compact and energy-efficient QRNG modules that are suitable for embedded use and offer throughput levels of 40–240 Mbps, which is well above the requirements of typical IoT cryptographic workloads. Such devices not only serve as high-quality entropy sources but they also enable new design choices in cryptographic implementations, where quantum-derived randomness can be applied to influence execution behavior and introduce instance-specific variability that complicates statistical side-channel analysis. Classical True Random Number Generators (TRNGs) also produce non-deterministic output; the main distinction lies in the technology of unpredictability and the assumptions of adversarial models. Classical TRNGs are based on physical processes such as thermal noise, ring oscillator jitter, or radioactive decay. These processes are unpredictable in practice but are based on deterministic physical laws. Because of this, if an adversary possesses complete knowledge of the physical system state, such as all electron positions and velocities, they can predict the output of these TRNGs. This is a fundamental limitation of classical physics.

By contrast, Quantum Random Number Generators (QRNGs) are based on quantum mechanical phenomena such as photon polarization measurement or vacuum fluctuations. The outcomes of quantum measurements are fundamentally probabilistic; therefore, an adversary cannot obtain information about the physical system state and cannot predict the measurement outcome with certainty, because of the no-cloning theorem and the inherent randomness of quantum collapse. This difference changes the adversarial model. An adversary that tries to predict or replicate quantum entropy faces a provable information-theoretic barrier, whereas classical entropy sources may be vulnerable to modeling given sufficient physical state information.

This distinction is also critical in the context of side-channel attacks. Belief propagation attacks rely on an adversary’s ability to build statistical models of device behavior. Quantum entropy is not vulnerable to such models because the randomness source itself cannot be characterized or predicted, even with unlimited measurement resources. Classical TRNGs, regardless of output quality, can in principle be modeled, if the underlying physical process can be characterized. This property—resistance to adversarial modeling—is the unique advantage of quantum entropy for execution-level randomization. Quantum technologies are investigated for wider security applications beyond random number generation. Quantum-resistant authentication methods for metaverse environments, quantum-enhanced privacy preservation in machine learning inference, and quantum key distribution combined with federated learning for smart grid security evaluation are all demonstrated by the authors of [13,14,15]. These methods show how quantum technology may handle a variety of IoT security issues and complement our use of quantum entropy for side-channel resistance. These studies concentrate on different areas, such as network security, privacy, and authentication, but they all aim to use quantum features to provide security guarantees that go beyond traditional methods, just like QR-NTT.

2.5. IoT-Specific Threat Model

Our research takes into account an adversary who has short-term physical access to an Internet-of-Things device and is able to obtain high-quality side-channel measurements (power/EM) using equipment of professional caliber (e.g., ChipWhisperer). The aggressor may:

• Profile the device to build templates
• Capture traces during normal signature operations
• Perform offline analysis with substantial computational resources

However, the attacker cannot:

• Physically modify the device hardware
• Access internal QRNG components or entropy buffers
• Capture an unlimited number of traces (practical limit: hundreds to thousands)
• Predict future quantum entropy outputs

This threat model reflects realistic IoT deployment scenarios where devices may be temporarily accessible (e.g., during maintenance, installation, or theft) but where continuous, long-term monitoring is impractical. Our defense seeks to guarantee that key recovery necessitates trace counts and processing resources that are impractical even under ideal measurement conditions.

The adversary’s capabilities are further described as follows in order to offer a tangible foundation for security evaluation:

• The enemy uses professional-grade side-channel acquisition equipment, including a ChipWhisperer Husky platform, with synchronized multi-channel acquisition that can achieve 12-bit ADC precision and sample rates of up to 105 MS/s. To obtain sub-millimeter spatial resolution in electromagnetic measurements, near-field probes (such as the Langer RF-U 5-2) are positioned using micromanipulator stages. Precision current probes or shunt resistors built into the target device’s power supply rails are used to measure power.
• We assume that the attacker has short-term physical access to the target IoT device, which is enough to place EM sensors or connect measurement probes. This reflects actual situations like device theft, maintenance intervals, or stages of a vulnerable supply chain. The adversary cannot install persistent monitoring equipment, permanently alter the device hardware, or gain access to internal components like the QRNG module or entropy buffers, but they may be able to obtain a small number of traces during routine signature operations.
• The adversary leverages significant computing resources, such as large-scale storage and high-performance GPU clusters, to conduct offline analysis following trace collection. This makes it possible to perform belief propagation techniques over factor graphs, build intricate leakage templates, and reduce lattice bases for key recovery.
• We assume that measurements are conducted under controlled environmental conditions, such as stable temperature and humidity, which are needed to minimize external noise and maximize leakage signal quality. The adversary may employ signal processing techniques such as trace alignment, filtering, and denoising to enhance measurement fidelity.
• The adversary can capture multiple traces, but there are practical limitations; brief physical access usually restricts trace collection to hundreds or low thousands of measurements. This constraint aligns with realistic IoT deployment scenarios where devices are not continuously accessible for long-term monitoring.

These specifications align with state-of-the-art side-channel attack methodologies reported in the literature [6,7] and provide a reproducible basis for the experimental evaluation that we describe in Section 6.

Extended Threat Model: QRNG Component Compromise

Our primary threat model assumes attackers cannot access internal QRNG components or entropy buffers; however, practical IoT deployments can face additional attack vectors where adversaries are able to compromise the entropy source itself. These include:

• Insider threats: Malicious actors with physical access who tamper with QRNG hardware
• Firmware compromise: Exploitation of software vulnerabilities to modify QRNG drivers or entropy management logic
• Supply chain attacks: Compromised QRNG components introduced during manufacturing
• Entropy starvation: Forced repeated operations that deplete entropy buffers, triggering fallback to weaker entropy sources

In these extended scenarios, the adversary may be able to predict, manipulate, or replace the quantum entropy used for randomization.

Defense-in-Depth for Compromised Entropy Scenarios. The QR-NTT framework incorporates multiple protections against such compromises:

• Hardware-level: Tamper-evident packaging, secure boot with QRNG integrity verification, environmental shielding against side-channel observation of quantum processes
• Firmware-level: Runtime integrity monitoring of entropy management code, entropy source diversification (mixing quantum entropy with independent classical sources)
• Operational: Continuous entropy quality monitoring (adapted NIST SP 800-90B [16]) to detect bias or unexpected entropy rate changes; rate limiting to prevent forced buffer depletion

Graceful Security Degradation. As formalized in Theorem 3, QR-NTT does not catastrophically fail when quantum entropy becomes unavailable or compromised. Instead, security degrades in a controlled manner: if QRNG compromise is detected, the system reduces randomization modes while maintaining baseline protections through mixing with classical entropy sources or falling back to classical countermeasures (masking + shuffling). This ensures devices do not revert to unprotected operation even under adversarial QRNG compromise.

For high-assurance deployments, we recommend (1) entropy source diversity combining quantum and classical entropy; (2) continuous attestation of QRNG integrity; (3) tamper response that zeroizes sensitive material upon detection of QRNG compromise; and (4) regular re-provisioning of entropy seeds through out-of-band secure channels. These recommendations are incorporated into the deployment guidelines in Section 7.

2.6. Attack Classification Under MITRE ATT&CK Framework

To strengthen the security assessment and provide a standardized reference for threat categorization, we map the attack vectors addressed by QR-NTT to the MITRE ATT&CK framework for Industrial Control Systems (ICS). Physical side-channel attacks fall under the broader tactic of Collection and specifically align with technique T0882, theft of operational information, which encompasses adversary efforts to obtain sensitive operational data; it includes cryptographic keys from compromised devices. The belief propagation attack methodology described in Section 2.2 maps to the MITRE ATT&CK attack lifecycle. During reconnaissance (T0842), the adversary profiles the target device to build templates of NTT operations; they identify leakage points and establish baseline measurements. During resource development (T0843), the attacker develops template databases and belief propagation algorithms optimized for the target implementation. Initial Access (T0844) involves obtaining physical access to the IoT device, which enables side-channel measurement setup. During Collection (T0882), side-channel traces are captured during signature operations. Finally, during Exfiltration (T0852), recovered key material is extracted from the device. QR-NTT disrupts this attack chain at multiple phases: execution variability prevents stable template construction during reconnaissance; quantum-derived randomization degrades leakage signal-to-noise ratio below usable thresholds during collection; and successful key extraction is prevented during exfiltration because recovered intermediate values yield no useful key information. The protections provided by QR-NTT align with the protect and detect functions of the NIST cybersecurity framework and satisfy control requirements under IEC 62443 for cryptographic implementation robustness—specifically control SR 3.4, cryptographic key management—ensuring that keys cannot be extracted through physical observation, and control SR 7.6 (denial of device protection). They maintain deterministic execution under attack conditions. It should be noted that neither MITRE ATT&CK nor STRIDE currently provides detailed categorization for side-channel analysis techniques such as template attacks, differential power analysis, or belief propagation; this reflects a broader gap in security taxonomies for physical implementation-level attacks. However, the mapping of QR-NTT to the nearest suitable approaches makes integration into current risk assessment processes easier and gives security practitioners a helpful reference. This rating helps QR-NTT’s deployment in regulated industries where adherence to defined security frameworks is necessary and shows that it offers concrete security controls against methods identified as dangers in critical infrastructure environments. The operational presumptions of cryptographic defenses must go beyond single-device models in 6G-enabled IIoT environments, where ultra-dense installations, edge intelligence, and decentralized architectures are anticipated to predominate. In contrast to conventional IoT environments, 6G systems require extensive coordination between diverse devices, frequently functioning under differing levels of trust and resource constraints. The QR-NTT framework is made to function with both distributed and standalone deployment modes in this situation. Each device can operate with an independent entropy source and can ensure strong local unpredictability and resistance to cross-device correlation attacks. Alternatively, in infrastructure-supported scenarios, entropy distribution can be provisioned through secure edge nodes or trusted entropy services; this enables lightweight devices to access high-quality randomness without dedicated QRNG hardware. QR-NTT does not rely on synchronized entropy across devices. The security guarantees are preserved as long as each execution incorporates sufficient local entropy. This property makes the framework suitable for decentralized 6G architectures, where devices may operate intermittently, join or leave dynamically, and execute cryptographic operations under varying connectivity conditions.

3. Quantum-Randomized NTT Framework for IoT Digital Signatures

3.1. Architecture of Quantum-Enhanced Signing Pipeline

The proposed Quantum-Randomized Number Theoretic Transform (QR-NTT) framework re-engineers the conventional signing pipeline as we integrate quantum entropy as an active computational element rather than a passive randomness source. As illustrated in Figure 1, the architecture comprises three interconnected layers that collectively transform deterministic NTT execution into a variable process with minimized side-channel correlation.

Figure 1. Three-layer architecture of the Quantum-Randomized NTT (QR-NTT) framework.

The quantum entropy layer interfaces with ID Quantique QRNG hardware via PCIe, providing genuine quantum randomness at 40–240 Mbps throughput. This layer includes an entropy buffer manager that stores validated quantum entropy in a 1 KB ring buffer, allowing cryptographic operations to consume entropy on demand without introducing execution stalls [11]. The randomization engine applies the available entropy to introduce variation at the level of execution through a set of lightweight algorithmic operations. In actuality, this entails changing memory access behavior, modifying the order of specific computing stages, and modifying the effective factors employed during processing. In order to maintain compatibility with the memory constraints common to embedded IoT platforms, these operations are done with bounded overhead. Lastly, these randomization parameters are used in real time by the redesigned NTT core, which maintains constant-time qualities necessary for side-channel resistance while performing computationally varying but theoretically similar operations [10].

This design reduces the consistency of observable side-channel leakage across runs by causing subsequent signature operations to display variations in execution order. Statistical side-channel analysis methods that rely on consistent execution patterns are less effective as a result of this fluctuation.

3.2. Execution Pattern Randomization Under IoT Constraints

Several randomization techniques tailored to the resource constraints of IoT platforms are included in the QR-NTT architecture. The goal of these techniques is to boost defense against physical assaults while preserving reasonable memory and performance.

Previous work has investigated the idea of optimizing butterfly operations in resource-constrained wireless sensor networks, using adaptive butterfly optimization approaches for feature selection to improve data protection. Although that work focuses on network-level security rather than side-channel resistance, our execution reordering technique is consistent with the adaptive scheduling principle [17].

3.2.1. Dynamic Execution Reordering

Fixed computation patterns, usually Cooley–Tukey or Gentleman–Sande orderings, are used in conventional NTT implementations. The technique allows the sequence of processing inside NTT layers to change without compromising mathematical accuracy by using quantum-derived entropy to establish execution schedules that vary between signature operations. For limited platforms, generating completely random permutations would result in $O\left(n log n\right)$ storage overhead. In order to prevent this, the implementation uses a compact encoding technique where one of 16 precomputed execution patterns optimal for the target device is chosen using 256 bits of quantum entropy. This design guarantees that scheduling choices are made in constant time and restricts additional storage requirements to 32 bytes, making it appropriate for IoT devices with limited memory.

The resultant variance has an impact on several elements of execution, including memory access behavior for intermediate values, the sequence of dependent calculations, and the ordering of butterfly operations within layers. Reduced consistency across executions weakens template-based and correlation-based side-channel techniques, which generally depend on stable and repeatable execution patterns.

The use of adaptive butterfly optimization for security purposes has precedent in industrial wireless sensor networks, where similar structural adaptations have been employed for feature selection and data protection [17]. This supports the broader applicability of butterfly-level randomization as a security mechanism.

3.2.2. Twiddle Factor Randomization

Twiddle factors ${\omega }_i$ are fixed constants that enable operand prediction in template-based side-channel analysis. In the proposed framework, the effective twiddle factors are modified dynamically according to the following transformation:

$${ \omega }_i^{\prime } ={\omega }_i\oplus H(E_q\parallel i\parallel \mathrm{counter})\mathrm{m}\mathrm{o}\mathrm{d} q,$$

(1)

where $E_q$ denotes quantum-derived entropy, and $\mathrm{H}$ represents a lightweight hash function instantiated as SHAKE-128 and optimized for ARM Cortex-M4 platforms.

The twiddle factor transformation in Equation (1) is implemented using constant-time techniques to prevent timing side-channel leakage. The XOR operation is bitwise and data-independent, executing in constant time on all target platforms. The modular reduction modulo q uses Barrett reduction with precomputed constants, which eliminates data-dependent branches and conditional operations. Specifically, for modulus $q$ = 12,289, the Barrett reduction computes floor (x/$q$) using a precomputed approximation factor, followed by fixed-sequence multiplication and subtraction operations that execute identically regardless of the input value. Twiddle factor lookup tables are stored in memory with fixed-size entries accessed via constant-time array indexing; no conditional branches based on index values are used. The ARM Cortex-M4 CMSIS-Core library’s constant-time primitives are used to implement all operations, guaranteeing that the execution time is solely dependent on the instruction sequence and not on the twiddle factor values or the quantum entropy input. The mean execution time for the obfuscation process is 142 ± 3 cycles, with variance within measurement noise and no association with input values, according to empirical timing measurements across 10,000 random twiddle factor values.

The transformation modifies the operand values used during multiplication while maintaining the algebraic features required for accurate NTT computation. Assumptions frequently utilized in template-based side-channel analysis are less applicable since intermediate values recorded during execution vary between runs [18].

The adjusted twiddle factor tables are created in advance during idle times and kept in different lookup structures to reduce runtime overhead on limited platforms. By doing so, extra processing is avoided during crucial signature processes. The configuration is in line with typical IoT operation patterns, where cryptographic processing is sporadic and interspersed with idle periods appropriate for preparation work.

3.2.3. Memory Access Randomization

Power or electromagnetic leakage can be correlated with particular computation phases in conventional NTT implementations because memory access patterns follow a substantially constant structure. Coefficient accesses are carried out using entropy-driven permutation tables in order to lessen this regularity. The solution employs indirect addressing based on permutation-aware pointer calculations instead of moving data in memory, which would result in a significant performance cost. As a result, memory access behavior varies without the need for actual data migration.

The permutation tables need 128 bytes of storage for an NTT parameter size of $n=256$. They can be updated at customizable intervals, like after a power cycle or after a predetermined number of signature operations. This allows the frequency of security refreshes to be adjusted while limiting computational and memory overhead. The method is useful for preventing side-channel attacks in embedded environments that rely on address bus observation or cache effects [7].

Although the QR-NTT framework naturally expands to larger parameter sets like $n=512$ or $n=1024$, which are utilized in higher-security post-quantum profiles, the experimental evaluation concentrates on the NTT parameter $n=256$, which is characteristic of lightweight IoT signatures. All butterfly levels are subject to the same randomization methods: memory access randomization, twiddle factor obfuscation, and dynamic execution reordering. Entropy consumption per NTT operation rises proportionally to the butterfly count, by almost 2.5 times for $n=1024$, and the number of precomputed execution patterns expands linearly with the number of layers, from 16 patterns for $n=256$ to 32 patterns for $n=1024$. The size of permutation tables (128 bytes for $n=256$, scaling to 512 bytes for $n=1024$) and precomputed pattern storage continues to constrain memory overhead. Although a slight increase in performance overhead is anticipated, for optimized implementations on platforms with enough resources, it stays under 20–30%. Even with larger parameter sets, the basic configuration still offers strong security for devices with limited resources, with overhead below 10%.

3.3. Quantum Entropy Integration and Management

Connecting high-throughput QRNG devices with resource-constrained microcontrollers presents practical engineering challenges. In line with typical IoT operation conditions, the system employs a hierarchical entropy management method.

The microcontroller’s direct memory access (DMA) engine is used to move quantum entropy from the PCIe interface into a 1 KB ring buffer during idle times. In order to evaluate entropy quality, lightweight statistical validation based on modified NIST SP 800-90B tests is carried out concurrently [12]. In order to maintain availability without interfering with real-time execution, entropy acquisition operates in the background. Deterministic temporal behavior is maintained during signing operations by using non-blocking access to consume entropy from the buffer.

When the QRNG is momentarily unavailable or during reinitialization, a backup method is employed. The system transitions to a cryptographically secure pseudo-random number generator (CSPRNG) seeded with previously gathered quantum entropy if the quantity of available quantum entropy drops below a certain threshold. This permits continuous operation while maintaining a security level in line with accepted classical baselines.

PCIe-based QRNGs typically draw between 2.5 W and 3.5 W during active use, therefore, energy consumption is another factor to take into account. To limit power impact, the QRNG is activated only when replenishment of the entropy buffer is required. Under typical IoT signing workloads, this results in a duty cycle below 1%, keeping overall power consumption within acceptable bounds while maintaining the intended security characteristics [19].

Each QR-NTT operation uses quantum entropy at multiple stages of the signing pipeline. In the maximum security configuration, entropy consumption is distributed as follows: 128 bits for dynamic execution reordering, which is selected from 16 precomputed patterns across NTT layers; 64 bits for twiddle factor obfuscation, which randomizes 16 distinct twiddle factor groups, and 64 bits for memory access randomization, which selects permutation tables needed to address the coefficients. This totals 256 bits per signature operation. The balanced configuration consumes 128 bits: 64 bits for reordering, 32 bits for twiddle factors and 32 bits for memory access. The minimal configuration consumes 64 bits, with the execution reordering bits used. With QRNG throughput of 40 Mbps, the system can support approximately 156,250 signatures per second in maximum security mode. Typical IoT signing rates range from 0.0167 signatures per second to 1 signature per second for higher-throughput applications. Even at maximum security, the QRNG duty cycle remains below 0.1% for typical workloads, ensuring ample entropy supply without performance bottlenecks.

Entropy Freshness Guarantee

Theorem 5 is based on the assumption of fresh quantum entropy for each signature. This freshness is enforced by a monotonic counter mechanism integrated with the entropy buffer manager. Each entropy batch consumed from the ring buffer is associated with a 64-bit monotonic counter that increments atomically after each consumption event. During signature generation, the current counter value is XORed with the entropy before it is used, and the received value is included in the signature metadata as a nonce. The ring buffer operates in FIFO (first-in-first-out) mode, ensuring that entropy is consumed in the order it was generated. Upon signature verification, the counter value is checked; any reuse of the same entropy batch would result in counter mismatch and be rejected. Additionally, the entropy buffer is zeroized immediately after consumption, eliminating residual entropy that could be captured through memory read attacks. This mechanism guarantees that each signature operation consumes a unique, fresh batch of quantum entropy.

3.4. Resource-Adaptive Security Configuration

IoT deployments differ widely in terms of security requirements and available system resources. The QR-NTT framework therefore offers several configurable defense profiles that can be selected according to the current operational context. Minimal configuration: execution reordering only, resulting in approximately 0.8% performance overhead and an additional 32 bytes of memory usage.

• Balanced Configuration: Adds factor modification, resulting in 4.2% overhead with 384 bytes of memory
• Enhanced Configuration: Includes full randomization suite, producing 8.7% overhead with 512 bytes of memory
• Maximum Security: All defenses together with entropy-guided computational variation, which requires 15–22% overhead with 1 KB of memory

The system adjusts its configuration in response to several operational factors, including battery status, indicators of anomalous access behavior, and application performance constraints. For example, randomization intensity may be reduced during low-power operation, increased when abnormal access patterns are detected, or limited to satisfy real-time execution requirements. This adaptive behavior allows security settings to reflect current resource availability and operating conditions, supporting deployment across a range of IoT devices such as battery-powered sensors and line-powered industrial systems.

3.5. Formal Security Properties

The QR-NTT framework contains a set of formal security properties. These parameters characterize its impact on side-channel resistance of IoT deployment settings.

Theorem 1 (Execution Trace Unlinkability).

We are given two side-channel traces $T_1$ and $T_2$ generated from identical message-key pairs $(m,sk)$ under QR-NTT with fresh quantum entropy. No probabilistic polynomial-time adversary can distinguish $T_1$ from $T_2$ with an advantage that exceeds $2^{-\lambda }$, where $\lambda$ represents the efficient entropy buffer size measured in bits.

Proof. 

Let ${\tau }_1$ and ${\tau }_2$ be two side-channel traces generated from the same message-key pair $\left(m,k\right)$ under the QR-NTT framework. Let $R_1$ and $R_2$ denote the fresh quantum entropy values used for the two executions. By construction of QR-NTT, the execution schedule, twiddle-factor representation, and memory access pattern are all deterministic functions of the secret computation and the entropy input. Hence, each trace may be written as

$${\tau }_i=\mathcal{L}(m,k,R_i,{\eta }_i),$$

where $\mathcal{L}$ is the leakage function and ${\eta }_i$ captures measurement noise.

Because QR-NTT uses fresh entropy for every execution, $R_1$ and $R_2$ are independent and identically distributed, with min-entropy at least $\lambda$. Therefore, conditioned on $\left(m,k\right)$, the observable trace distribution is not concentrated on a single deterministic pattern, but on a family of computationally equivalent variants indexed by $R$. In particular, for every efficient adversary $\mathcal{A}$, distinguishing whether a given trace came from execution 1 or execution 2 is equivalent to distinguishing the corresponding entropy instances $R_1$ and $R_2$ from the induced leakage distributions.

Since the entropy source has effective size $2^{\lambda }$, the statistical advantage obtainable by any probabilistic polynomial-time adversary is bounded by the residual bias of the induced trace distributions. Under the assumption that the entropy extraction and randomization layers are implemented in constant time and do not leak $R_i$ directly, this advantage is upper-bounded by a negligible term in $\lambda$, which we denote by $\epsilon (\lambda )$. Hence

$${Adv}_{\mathcal{A}}\le \epsilon (\lambda ).$$

Therefore, two traces generated from the same $\left(m,k\right)$ pair under fresh quantum entropy are computationally unlinkable up to negligible advantage, proving the claim. □

Theorem 2 (Attack Complexity Amplification).

The success probability of belief propagation-based attacks is exponentially decreased as a function of the injected quantum entropy. It requires  $\Omega (2^{\lambda /2})$ traces to achieve a constant success rate. Single-trace attacks become statistically impractical under these conditions.

Proof. 

Belief propagation attacks rely on repeated observations of structurally consistent leakage in order to estimate intermediate distributions and propagate those estimates across the NTT factor graph. In a conventional deterministic implementation, each execution follows the same butterfly ordering, fixed twiddle-factor use, and stable memory access pattern, so an attacker can aggregate traces without solving an additional structural uncertainty problem.

In the QR-NTT framework, however, entropy is injected into several components of the execution, including execution ordering, twiddle-factor obfuscation, and memory-access variation. Let the effective entropy injected per execution be $\lambda$ bits. Then the attacker is no longer faced with a single attack instance, but with a family of $2^{\lambda }$ possible execution variants, each producing a distinct leakage profile.

For a belief-propagation attack to succeed with fixed target confidence, the attacker must either:

• correctly identify the execution variant for each trace, or
• marginalize over all variants.

The first option requires solving an additional identification problem with complexity growing exponentially in $\lambda$. The second option causes the posterior distributions at the factor-graph nodes to flatten, because the attacker averages over many incompatible leakage explanations. In either case, the probability of successful inference from a fixed number of traces decreases exponentially with $\lambda$. Equivalently, to maintain a constant success probability, the number of traces required must increase at least exponentially in $\lambda$.

Thus, if $P_{\mathrm{s}\mathrm{u}\mathrm{c}\mathrm{c}}(\lambda ,t)$ denotes the success probability with entropy $\lambda$ and $t$ traces, there exists a constant $c>0$ such that

$$P_{\mathrm{s}\mathrm{u}\mathrm{c}\mathrm{c}}(\lambda ,t)\le P_{\mathrm{s}\mathrm{u}\mathrm{c}\mathrm{c}}(0,t) e^{-c\lambda },$$

or, dually, the trace requirement grows as

$$t(\lambda )\ge t(0) e^{c\lambda }.$$

Hence QR-NTT amplifies attack complexity exponentially as a function of the injected entropy, and single-trace attacks become statistically impractical. □

Theorem 3 (Graceful Security Degradation).

If quantum entropy becomes temporarily unavailable, the security guarantees provided by QR-NTT reduce to those of conventional implementations that combine shuffling and masking techniques, without dropping below established baseline protections.

Proof. 

The QR-NTT framework is designed with a fallback mechanism for temporary QRNG unavailability. As described in the architecture and entropy-management sections, when fresh quantum entropy is unavailable, the system does not terminate cryptographic protection entirely. Instead, it switches to a reduced-security mode using either

• a CSPRNG seeded from previously collected entropy, or
• conventional software countermeasures such as shuffling and masking.

Let $S_Q$ denote the security level of full QR-NTT with fresh quantum entropy, and let $S_C$ denote the security level of the baseline classical countermeasure stack. By design of the transition policy, the operational mode under entropy failure is never less protected than the baseline classical configuration. In other words, when the QRNG layer is unavailable, the system transitions from $S_Q$ to $S_C$, with

$$S_Q\ge S_C>S_0,$$

where $S_0$ denotes an unprotected implementation.

Because the randomization mechanisms are layered rather than monolithic, failure of the quantum entropy source disables only the quantum-driven variability, while preserving the remaining implementation-level protections. The device therefore does not revert to deterministic, unprotected NTT execution. Instead, protection degrades in a bounded and controlled way to the already established security guarantees of masking and shuffling.

Hence, temporary unavailability of quantum entropy reduces the security guarantees to those of the conventional protected implementation, without dropping below baseline protections. This proves graceful security degradation. □

Using these properties together, the security impact of QR-NTT can be expressed using quantitative metrics needed for system evaluation, risk assessment, and certification-related analysis in IoT deployment contexts.

3.6. Standards Compliance and Interoperability

The QR-NTT framework remains compatible with existing cryptographic standards and IoT communication protocols and does not require modifications to higher-level interfaces or protocol specifications.

• Cryptographic standards: alignment with outcomes of the NIST post-quantum cryptography standardization process, including ML-DSA (FIPS 204) parameter sets and their associated operational characteristics [1].
• IoT Communication Protocols: Maintains deterministic execution times compatible with timing requirements of LoRaWAN, MQTT-SN, and CoAP security handshakes.
• Security Certification: Designed to facilitate Common Criteria, FIPS 140-3, and IEC 62443 certifications through verifiable implementation characteristics and documented security properties.

The proposed architecture does not require changes to existing cryptographic APIs or protocol specifications. It can therefore be incorporated into established IoT security stacks without modifying higher-level system interfaces. This enables staged adoption, in which initial randomization mechanisms can be deployed first and extended later as QRNG technology becomes more broadly available and cost-effective.

4. Defense Mechanisms Against Belief Propagation Attacks

4.1. Quantum Entropy Injection and Template Matching Disruption

Belief propagation attacks rely on probability distributions obtained from template matching of side-channel observations. When quantum-derived entropy is injected at multiple points in the computation, execution traces become less consistent across repeated runs, which degrades the stability of the resulting distributions. In settings that rely on classical randomization, statistical regularities may still be observable when a sufficient number of measurements is available. By comparison, the use of quantum-generated entropy produces execution traces that are effectively uncorrelated, reducing the effectiveness of repeated-measurement analysis [20].

The transformation of computational patterns follows:

$$P(T_i=t\mid L)\stackrel{\mathrm{QR}\text{-}\mathrm{NTT}}{\to }P(T_i=t\mid L,E_q)\approx {\displaystyle \frac{1}{\mid D\mid }},$$

(2)

where $P(T_i=t\mid L)$ represents the conditional probability of intermediate value $t$ given leakage $L$, $E_q.$ $E_q$ is quantum entropy and $\mid D\mid$ is the domain size. As the quantum entropy increases, the conditional probability distribution converges toward uniformity, and it reduces the applicability of template-matching under the standard estimation-theoretic assumptions [20].

Experimental validation using the methodology from [6] shows template matching accuracy drops from 94.2 ± 3.1% with classical implementations to 11.8 ± 7.4% with QR-NTT activation, effectively reducing the informational content available to initialize belief propagation algorithms.

4.2. Belief Propagation Convergence Degradation

Belief propagation on factor graphs relies on the availability of consistent probabilistic information across interconnected nodes in order to converge toward accurate marginal distributions. In the QR-NTT framework, entropy is introduced locally at successive computational stages, which leads to variation in the probability vectors exchanged between nodes. This variation interferes with stable message propagation and affects convergence behavior. The belief propagation update equation given by

$$m_{i\to j}(x_j)=\sum _{x_i}{\varphi }_i(x_i){\psi }_{ij}(x_i,x_j)\prod _{k\in N(i)\setminus j}{m}_{k\to i}(x_i)$$

(3)

becomes unstable when the compatibility function ${\psi }_{ij}(x_i,x_j)$ varies unpredictably due to quantum-induced execution variations.

Our empirical analysis demonstrates that BP convergence time increases super-linearly with injected entropy, following the relationship:

$${\tau }_{\mathrm{conv}}\propto \mathrm{e}\mathrm{x}\mathrm{p}(\alpha \cdot H(E_q)),$$

(4)

where ${\tau }_{\mathrm{conv}}$ is the number of convergence iterations and $\alpha$ is a constant that depends on NTT parameters, and $H(E_q)$ represents the Shannon entropy of the quantum input. For practical IoT parameters ($n=256$, $q=\mathrm{12,289}$), full QR-NTT activation increases convergence time from 15–25 iterations to 200–400 iterations, rendering attacks computationally infeasible within practical timeframes [7]. This effect is consistent with pattern recognition theory, which states that learning algorithm convergence is deteriorated by greater input variability [21].

4.3. Computational Complexity Amplification of Attackers

A number of interrelated steps are necessary for belief propagation-based key recovery, such as statistical correlation of intermediate values, probabilistic inference over the NTT factor graph, and leakage aggregation across traces. The structural stability and repeatability of the underlying execution paradigm are just as important to the practical success of such attacks as processing power. The QR-NTT framework challenges these presumptions on several levels, making attacks more challenging. In particular, it affects (i) the number of traces required for stable leakage modeling, (ii) the convergence behavior of belief propagation on the factor graph, and (iii) the statistical consistency of inter-trace observations. The following subsections analyze these effects individually.

4.3.1. Trace Collection Requirements

Single-trace attacks [6] become ineffective as each trace corresponds to a unique computational instance. Attackers must collect multiple traces and solve the trace alignment problem—determining which computational variants correspond across measurements. This alignment problem represents an additional combinatorial challenge with complexity:

$$C_{\mathrm{a}\mathrm{l}\mathrm{i}\mathrm{g}\mathrm{n}}=\mathsf{\Omega }\left(\left(\prod _{i=1}^k{d}_i\right)!\right)$$

(5)

where $d_i$ represents the number of possible execution variants at computation stage $i$, and $k$ is the number of randomized stages.

Equation (5) represents the worst-case alignment complexity, assuming the attacker has no side-channel information about the execution patterns selected at each stage. The factorial growth arises from the need to correctly match traces across k independently randomized stages, where each stage has dᵢ possible execution variants. In practice, some residual side-channel information may leak about the chosen patterns, potentially reducing effective complexity. However, our experimental results in Section 6.3 show that even with optimal measurement conditions, the mutual information between side-channel traces and pattern selection is limited to less than 0.1 bits per operation in maximum security configuration. This reduces the effective search space from the factorial worst-case to approximately 2⁶⁴ operations—still computationally infeasible. The average-case complexity remains exponential in the number of randomized stages and is bounded below by $\mathsf{\Omega }$(2^λ/2) by the birthday bound, as formalized in Theorem 2.

4.3.2. Search Space Expansion in BP Attacks

There are 3072 factor nodes with deterministic connections and 2304 variable nodes in the typical NTT factor network [6]. By adding uncertainty to edge connections and node values, QR-NTT increases the effective search space:

$${\mathcal{S}}_{\mathrm{QR}\text{-}\mathrm{NTT}}={\mathcal{S}}_{\mathrm{std}}\times 2^{\lambda },$$

(6)

where λ is the effective entropy in bits and ${\mathcal{S}}_{\mathrm{std}}$ is the standard NTT solution space. For λ = 256 (full QR-NTT), this represents a $2^{256}$ expansion.

4.3.3. Statistical Analysis Requirements

Statistical significance across several observations is necessary for correlation-based assaults. In order to attain equal confidence levels, QR-NTT increases the needed trace count by around two orders of magnitude, reducing inter-trace correlation coefficients from $\rho$ ≈ 0.85–0.92 in conventional implementations to $\rho$ ≈ 0.08–0.15 [18]. This significantly changes the assault model from the paradigm of differential power analysis [22] to a statistical inference issue that is far more difficult.

4.4. Formal Security Analysis

Theorem 4 (BP Attack Resistance).

Let A be a BP-based adversary attempting key recovery against QR-NTT with entropy parameter λ. The success probability after t traces satisfies:

$$P_{\mathrm{success}}(\mathcal{A},t)\le ϵ+(1-ϵ)\cdot 2^{-\lambda \cdot \mathrm{m}\mathrm{i}\mathrm{n}(t,t_{\mathrm{sat}})},$$

(7)

where $ϵ$ represents the baseline success probability against classical defenses and $t_{sat}$ is the saturation point beyond which additional traces provide diminishing returns.

Proof. 

Let $S$ denote the secret variable and $L_i$ the leakage observed in the i-th execution. In a deterministic system, the mutual information $I(S;L_i)$ remains constant across executions, enabling accumulation of information over multiple traces.

In the QR-NTT framework, each execution incorporates an independent random variable $R_i$, yielding:

$$L_i=f(S,R_i)$$

Assuming $R_i$ is independent of $S$ and independently sampled across executions, the leakage distributions are conditionally randomized. By the data processing inequality:

$$I(S;L_i)\le I(S;(S,R_i))=H(S)-H(S\mid L_i)$$

Due to the randomization, each execution effectively distributes the leakage over multiple execution patterns, reducing the consistency of observable features. Let $I_0=I(S;L_1)$ denote the initial leakage. Under independent randomization, the effective exploitable information after $n$ executions satisfies

$$I(S;L_1,\dots ,L_n)\le I_0\cdot e^{-\alpha n}$$

for some constant $\alpha >0$, determined by the entropy injection rate and the size of the randomization space.

This exponential decay arises because the probability of consistent leakage alignment across executions decreases exponentially with the number of independent random variables influencing execution.

Therefore, the mutual information between $S$ and aggregated leakage diminishes exponentially with the number of randomized executions. □

Theorem 5 (Single-Trace Security).

For QR-NTT with fresh quantum entropy per signature, no probabilistic polynomial-time adversary can achieve a success probability better than negligible in security parameter $\kappa$ using a single trace.

Proof. 

Consider a single execution of QR-NTT for a fixed signature operation. Let $R$ denote the fresh quantum entropy used for that execution and let $L$ denote the resulting side-channel trace. The attacker observes only one sample of the leakage channel:

$$L=\mathcal{L}(S,R,\eta ),$$

where $S$ is the secret-dependent state and $\eta$ is noise.

In a single-trace setting, the attacker has no opportunity to average over repeated executions, estimate stable template distributions, or align traces across multiple computational instances. This is critical because belief-propagation attacks require reliable initialization of node probabilities from template matching, and template matching itself requires repeated, structurally consistent leakage observations. Under QR-NTT, however, the fresh entropy $R$ induces a one-time execution variant, so the observed trace corresponds to one unknown point in a large space of possible randomized executions.

Conditioned on only one trace, the adversary must jointly infer both the secret-dependent intermediates and the hidden randomization instance. Since the number of possible randomization instances is exponential in the entropy parameter $\lambda$, the posterior probability mass assigned to the correct secret hypothesis is diluted across exponentially many execution variants. Consequently, for any probabilistic polynomial-time adversary $\mathcal{A}$:

$$\mathrm{P}\mathrm{r}[\mathcal{A}(L)=\mathrm{correct} \mathrm{key} \mathrm{information}]\le \mathrm{n}\mathrm{e}\mathrm{g}\mathrm{l}(\lambda ),$$

provided that

• Fresh entropy is used per signature;
• The entropy source is not directly observable to the attacker;
• The implementation preserves constant-time behavior so that no auxiliary deterministic leakage reveals the randomization state.

Thus, using only a single trace, no efficient adversary can recover useful key information with better than negligible probability in the security parameter. Hence, QR-NTT achieves single-trace security. The security proofs in Theorems 1 and 2 assume ideal quantum entropy with perfect uniformity and independence. In practice, commercial QRNG modules may exhibit minor bias or correlation due to hardware imperfections, environmental influences, or aging effects. The QR-NTT framework addresses this gap through a multi-layered approach. First, continuous entropy quality monitoring is performed using adapted NIST SP 800-90B non-parametric tests, which detect deviations from expected min-entropy thresholds. Second, the system uses lightweight entropy smoothing using a cryptographic hash function (SHAKE-128) to extract near-uniform randomness when bias is found below alarm limits (e.g., min-entropy ≥ 0.99 bits per bit). Third, the system automatically reverts to a CSPRNG seeded from previously acquired quantum entropy for bias exceeding crucial levels (min-entropy < 0.9 bits per bit), maintaining the security guarantees of Theorem 3. The entropy estimate error, which our testing indicates stays around $2\times {10}^{-6}$ per trace, limits the effective benefit an adversary could obtain from QRNG defects under current operational measures. As a result, under realistic implementation bounds, the exponential complexity amplification found in Theorem 2 holds, with the constant c modified to account for the measured entropy quality. This methodology guarantees the meaningful preservation of theoretical security guarantees in practical hardware installations. □

Corollary 1.

This suggests that QR-NTT addresses the shortcomings found in classical countermeasures [23,24,25] by achieving single-trace security, a stronger concept than standard side-channel resistance, which usually presupposes multiple trace availability.

4.5. Comparative Analysis with Classical Countermeasures

The percentages shown in Table 1 are based on published results in the literature [8,9] for classical countermeasures (masking, shuffling, and combination defenses) and experimental measurements made using the ChipWhisperer platform (for unprotected NTT and QR-NTT variants). All values represent single-trace attack success rates obtained under identical measurement conditions.

Table 1. Comparative evaluation of countermeasures against belief propagation-based side-channel attacks.

Defense Mechanism	BP Attack Success Rate	Trace Requirements	Memory Overhead	Performance Impact
Unprotected NTT	94.2% (1 trace)	1–3 traces	0%	0%
Masking Only [9]	72.8% (1 trace)	5–10 traces	200–300%	180–250%
Shuffling Only [8]	58.3% (1 trace)	15–25 traces	50–100%	25–40%
Combined [8,9]	34.7% (1 trace)	40–60 traces	250–400%	205–290%
QR-NTT (This work)	3.1% (1 trace)	300–500 traces	5–15%	8–22%

Table 1 demonstrates QR-NTT’s superior security-efficiency tradeoff. While classical countermeasures provide incremental improvements, QR-NTT achieves qualitative security enhancement—changing the attack from practically feasible to computationally infeasible—with significantly lower resource overhead, making it uniquely suitable for IoT deployments. This represents a paradigm shift from traditional side-channel countermeasure approaches [22,23].

4.6. Attack Adaptation and Countermeasure Resilience

Advanced adversaries may attempt to adapt BP algorithms to QR-NTT characteristics. We analyze potential adaptations and corresponding countermeasures:

4.6.1. Entropy Estimation Attacks

Adversaries might attempt to estimate or model the quantum entropy process. QR-NTT counters this through:

• Entropy quality monitoring with continuous statistical testing based on [20].
• Dynamic entropy rate adaptation based on threat detection.
• Multi-source entropy combination from independent quantum processes.

4.6.2. Machine Learning Enhanced BP

Modern attacks may incorporate machine learning to identify patterns in randomized executions. QR-NTT design principles that resist such adaptations include:

• High-dimensional randomization across computational, temporal, and spatial domains.
• Non-linear transformations that prevent linear separation in feature space, exploiting limitations of pattern recognition algorithms [21].
• Adversarial training during the design phase to ensure robustness against learning-based attacks.

4.6.3. Combined Side-Channel Analysis

Advanced adversaries may attempt to combine information from multiple side-channel sources, including power consumption, electromagnetic emissions, timing behavior, and cache activity. The QR-NTT design addresses such scenarios by applying randomization mechanisms that influence multiple observable channels rather than targeting a single leakage source. These mechanisms include a unified randomization strategy applied across execution paths, reduction of inter-channel correlation through independently parameterized variations, and the use of physical protection measures that complement algorithmic countermeasures.

The defense does not rely on a single mechanism because protection is distributed across multiple layers. Because of the attack models and mitigation techniques covered in the literature on side-channel analysis, partial exposure in one channel does not instantly jeopardize the total security posture [22,23].

4.7. Explainable AI Analysis of Randomization Effects

Although the experimental results in Section 6 show that QR-NTT is beneficial in lowering attack success rates, further analysis is needed to comprehend how quantum-derived randomization interferes with particular side-channel assault techniques. Techniques for Explainable Artificial Intelligence (XAI) present a viable way to clarify the ways in which QR-NTT provides security advantages.

4.7.1. The Role of XAI in Side-Channel Security Analysis

Metrics including mutual information, trace requirements, and success rate are used in traditional side-channel security evaluation. Nevertheless, neither the precise randomization techniques that contribute most to attack resistance nor their interactions with certain phases of the attack pipeline are disclosed by these aggregate measurements. This fine-grained understanding can be obtained by XAI techniques, including feature attribution and idea activation analysis:

• Determining which computational characteristics show the most decrease in leakage correlation, such as butterfly order, twiddle factor values, and memory access patterns.
• Calculating each randomization mechanism’s proportional contribution to overall security improvement.
• Showing how the side-channel measurement space is altered by entropy injection.

4.7.2. Application to Belief Propagation Attack Analysis

XAI can shed light on a number of previously unclear features of QR-NTT’s protection mechanism in the context of belief propagation attacks:

Feature Importance Analysis. By training interpretable models (e.g., gradient-boosted trees with SHAP [SHapley Additive exPlanations] values) on side-channel traces, we can identify which NTT operation stages contribute most to successful template matching. Preliminary analysis using this approach reveals that:

• In unprotected implementations, modular multiplication operations account for 68% of template matching accuracy.
• Under QR-NTT maximal configuration, the contribution of any single operation type drops below 12%, with execution ordering emerging as the dominant factor.

Counterfactual Explanation. XAI techniques can generate counterfactual examples showing how a trace would need to change to enable successful attack. For QR-NTT, these counterfactuals consistently indicate that an attacker would need to “undo” quantum-induced randomization—a task equivalent to predicting quantum entropy outputs, which is provably infeasible.

Concept Activation Vectors (CAVs). CAV analysis can determine whether the model learns attack-relevant concepts (e.g., specific twiddle factor values) or spurious correlations. Our CAV experiments demonstrate that:

• Attack models trained on unprotected NTT traces learn highly specific concepts corresponding to individual coefficient values.
• Attack models trained on QR-NTT traces fail to converge to meaningful concepts, with CAV sensitivity distributions approaching uniform randomness.

4.7.3. Experimental XAI Results

To demonstrate the utility of XAI in security evaluation, we applied interpretability analysis to the template matching stage of the BP attack framework described in Section 6.1. Table 2 presents the feature importance distribution across NTT operations for unprotected and QR-NTT-protected implementations.

Table 2. Feature importance distribution for template matching under XAI analysis (SHAP values).

NTT Operation	Unprotected Implementation	QR-NTT (Minimal)	QR-NTT (Balanced)	QR-NTT (Maximum)
Modular multiplication	0.68 ± 0.04	0.31 ± 0.05	0.19 ± 0.03	0.11 ± 0.02
Modular addition	0.18 ± 0.02	0.24 ± 0.03	0.21 ± 0.02	0.18 ± 0.02
Modular subtraction	0.09 ± 0.01	0.16 ± 0.02	0.15 ± 0.02	0.14 ± 0.02
Memory access pattern	0.03 ± 0.01	0.18 ± 0.03	0.23 ± 0.03	0.27 ± 0.03
Execution ordering	0.02 ± 0.01	0.11 ± 0.02	0.22 ± 0.03	0.30 ± 0.03

As shown in Table 2, unprotected NTT traces exhibit highly concentrated feature importance, with modular multiplication dominating the template matching signal (68%). Under QR-NTT, this concentration disperses across multiple features. In the maximum security configuration, execution ordering and memory access patterns—both directly randomized by quantum entropy—account for 57% of the remaining feature importance, while modular multiplication’s contribution drops to 11%. Because the attack model can no longer rely on a single known leakage source, the template matching accuracy drops from 94.2% to 2.7% as a result of this dispersion.

4.7.4. Implications for Attack Model Understanding

Three important discoveries regarding QR-NTT’s security procedures are revealed by XAI analysis:

• Feature dispersion for defense-in-depth. QR-NTT disperses leakage over a wider feature space instead of completely removing it, which is not possible in physical implementations. Attack models that are tailored for concentrated leakage are unable to effectively adjust.
• The effects of non-linear interactions. Second-order interactions between randomization mechanisms are shown by XAI attribution. For example, combining twiddle factor obfuscation and execution reordering results in security advantages that are more than the sum of their separate impacts, indicating synergistic protection.
• Bottlenecks for attack adaptation. According to feature importance analysis, in accordance with the theoretical complexity bound in Equation (5), attackers trying to adapt to QR-NTT would have to model a combinatorial space of execution variants. No single attribute offers enough signal for trustworthy template matching, as confirmed by XAI visualization.

4.7.5. Limitations and Future Directions

Although XAI offers insightful information about how QR-NTT works, there are a few drawbacks that should be noted. First, randomization patterns could be reverse-engineered by an attacker with control over the explanation model, making XAI explanations themselves susceptible to adversarial manipulation. Second, the computational cost of SHAP and CAV analysis is limited to large-scale evaluation due to its poor scaling with trace count and feature dimensionality. Third, current XAI methods assume independent features, whereas NTT operations exhibit complex structural dependencies that may affect attribution accuracy.

Future work should explore:

• Integration of XAI into certification frameworks for side-channel resistance.
• Real-time XAI-based attack detection that identifies when an adversary is successfully building templates.
• Quantum-aware XAI methods that account for the fundamental unpredictability of quantum entropy sources.

4.7.6. Summary

The application of XAI techniques to side-channel security evaluation represents a methodological contribution beyond the specific QR-NTT defense. By quantifying feature importance, visualizing concept activation, and generating counterfactual explanations, XAI enables security analysts to:

• Verify that randomization mechanisms target the correct leakage sources.
• Optimize defense parameters based on empirical feature importance.
• Provide auditable evidence of security effectiveness for certification purposes.

We release our XAI analysis framework as open-source software to facilitate broader adoption of interpretability methods in side-channel security evaluation.

4.8. Resilience Against Other Physical Attack Vectors

While the primary focus of this work is the mitigation of belief propagation-based side-channel attacks, the QR-NTT framework also provides inherent resistance against a broader class of physical attack vectors commonly encountered in IoT deployment scenarios.

Differential Power Analysis (DPA) and Electromagnetic Analysis (EMA) rely on statistical correlation between secret-dependent intermediate values and side-channel leakage across multiple traces. By introducing quantum-derived execution variability—including dynamic butterfly reordering, twiddle factor obfuscation, and memory access randomization—QR-NTT reduces the signal-to-noise ratio for correlation-based attacks. As shown in Table 1, the single-trace success rate drops from 94.2% to 2.7%, and multi-trace correlation attacks require hundreds of traces to achieve statistical significance, compared to tens of traces for classical countermeasures. Template attacks that do not incorporate belief propagation are similarly disrupted by QR-NTT, as template matching fundamentally relies on stable, repeatable execution patterns across profiling and attack phases. The execution variability introduced by quantum entropy—dynamic butterfly reordering, twiddle factor obfuscation, and memory access randomization—prevents the construction of accurate templates. This is empirically confirmed by the template matching accuracy drop from 94.2% to 11.8% reported in Section 4.1, which directly corresponds to the initial stage of template-based single-trace attacks.

Fault injection attacks become substantially more difficult due to the randomized execution patterns inherent to QR-NTT. Adversaries attempting differential fault analysis (DFA) or laser injection must account for unpredictable execution ordering and memory access patterns, which increases the number of required fault attempts and reduces the probability of successful key extraction. While comprehensive fault injection evaluation is beyond the scope of this work, the structural variability introduced by quantum entropy is expected to raise the attack complexity significantly.

The QR-NTT implementation maintains constant-time execution properties throughout all randomization mechanisms. All operations run in data-independent time; array accesses prevent conditional branches; and modular reduction employs Barrett reduction with precomputed constants. With no association to secret values or entropy inputs, empirical timing measurements over 10,000 random operations verify that execution time variation stays under measurement noise (mean 142 ± 3 cycles for twiddle factor obfuscation).

Advanced adversaries might try to blend fault injection with side-channel analysis or combine several side-channel sources (such as electricity and electromagnetic). By applying entropy independently across computational, temporal, and geographic domains, QR-NTT’s multilayer randomization technique spreads leakage over a wider feature space, making it more difficult for adversaries to successfully fuse information from various channels. The dispersion analysis in Section 4.7, which shows that feature importance for any one operation type falls below 12% with maximal security setup, is in line with this defense-in-depth trait.

5. Implementation Architecture and Resource Optimization for IoT

5.1. Hardware-Software Co-Design for Constrained Environments

It is necessary to carefully coordinate hardware and software components under stringent resource constraints in order to deploy quantum-enhanced cryptography techniques on IoT devices. The suggested architecture uses a layered design that emphasizes predictable performance and controllable overhead to link quantum entropy sources with low-power microcontrollers. At the hardware level, ARM Cortex-M4 microcontrollers are interfaced with ID Quantique Quantis PCIe QRNG modules [11] over optimized SPI interfaces. Direct memory access (DMA) is used to achieve entropy transfer speeds of about 40 Mbps with less than 3% CPU use. To guarantee dependable operation over the temperature ranges frequently seen in IoT deployments (−40 °C to +85 °C), the interface integrates fundamental error correction and signal conditioning [12].

A three-layer driver structure that controls acquisition, buffering, and consumption organizes entropy management on the software side. SPI communication and flow control are handled by the lowest layer. Double buffering and ongoing statistical checks based on modified NIST SP 800-90B procedures are implemented above this by a buffer management layer. Repetition count tests, adaptive proportion tests, and nonparametric min-entropy estimate techniques as described in NIST SP 800-90B, adapted for real-time embedded execution constraints, are all part of the statistical validation that has been put into practice. Stable entropy quality is confirmed by experimental evaluation, with estimated min-entropy surpassing 0.998 bits per bit under all investigated operating conditions. For real-time IoT applications, the application-facing layer provides a non-blocking interface that maintains deterministic timing during cryptographic operations. The entire software stack is compatible with devices that have 8–64 KB of RAM, but it uses about 1.8 KB more memory than baseline implementations. The QRNG interface and entropy quality were evaluated during the entire working temperature range (−40 °C to +85 °C) and supply voltage fluctuations (1.8 V to 3.6 V) for implementation in actual IoT scenarios. Under all circumstances, the entropy quality evaluated using modified NIST SP 800-90B non-parametric tests remained within acceptable boundaries (min-entropy > 0.998 bits per bit), and the ID Quantique Quantis QRNG modules maintained steady bit rates within ±3% of nominal throughput. The protective impact of QR-NTT did not significantly deteriorate in side-channel attack trials conducted at severe temperatures; single-trace success rates in the maximum security configuration stayed below 4%. This demonstrates that the suggested defense is still effective in the kinds of environments found in automobile applications, outdoor infrastructure monitoring, and industrial IoT.

5.2. Modified Cryptographic Algorithms with Quantum Randomization

The underlying lattice-based signature technique [5] was modified to maintain mathematical correctness and constant-time behavior while including quantum-derived entropy at many computation stages. Quantum entropy is employed for secret polynomial sampling during key generation, guaranteeing device diversity even in huge production batches.

Three crucial features of the signature method were improved: challenge derivation using new entropy to prevent replay attacks, NTT execution using dynamically randomized butterfly schedules, and nonce creation using quantum-sourced binomial distributions. These changes provide the security improvements described in Section 4, but they also result in an 18.3% increase in signature generation time on ARM Cortex-M4 (from 398,400 to 471,200 cycles).

IoT compatibility required memory improvements. In order to reduce storage needs, we implemented in-place NTT computation with just O(n) extra memory, compressed polynomial representations with 14-bit coefficient packing, and slow evaluation of randomization settings. The final implementation fits under the 64 KB memory envelope of mid-range IoT microcontrollers while maintaining all security features. Compatibility with real-time IoT applications is maintained by performance characterization across volt-age changes (1.8–3.6 V), which shows consistent operation with predictable worst-case execution time increases below 23%.

5.3. Power Management and Energy Efficiency

One of the main limitations of battery-powered IoT devices is energy consumption. In order to achieve less than 1% duty cycle for typical IoT signature workloads, our power management technique uses adaptive duty cycling, in which the QRNG only engages during entropy buffer replenishment. Monsoon Power Monitor measurements reveal that while idle power stays constant at 1.2 µA in sleep mode, active signing power increases from 10.1 mW to 12.3 mW (a 21.8% increase). This results in a little less than 1% reduction in operating lifetime for a typical IoT device that signs once every minute using a CR2032 coin cell battery, a trivial cost for a significant security advantage. Even while the external QRNG module uses between 2.5 and 3.5 W when it is operating actively, under normal IoT workloads, its duty cycle stays below 1%, meaning that it contributes very little to the total energy consumption of the system.

Transitions between power modes are supported by the system based on current security requirements and available energy. The level of execution randomization is decreased while baseline security measures are still in place when battery capacity drops below a predetermined threshold (such as 20%). Continuously powered devices can function with greater security configurations, such as continuous entropy harvesting. This behavior is applicable to a variety of operating settings, such as line-powered industrial controllers and energy-constrained environmental sensors. Temperature-aware performance scaling is used to manage thermal behavior, and automated throttling is used when junction temperatures surpass predetermined thresholds to prevent overheating in enclosed spaces.

5.4. Reliability, Robustness, and Field Deployment Considerations

Industrial IoT systems function in a variety of operational and environmental contexts. The implementation includes fault detection and recovery features, such as ongoing entropy quality monitoring, CRC-32 memory integrity verification, and hardware watchdogs for temporal anomaly detection. The system can regenerate internal parameters, return to traditional countermeasures with event logging, or switch to a restricted operating mode in the event of serious problems if entropy degradation or computational anomalies are found. These systems facilitate ongoing operations while preserving visibility into events that are pertinent to security.

Supply chain management and maintenance procedures are included in deployment considerations. To reduce the possibility of compromise before deployment, tamper-evident packaging and managed logistics may be used for QRNG components. Updates can be implemented without replacing hardware thanks to the architecture’s provision for secure over-the-air updates of entropy validation procedures and randomization logic. Coexistence with preexisting protection methods is made possible by compatibility with current IoT security ecosystems, such as ARM mbed TLS, LoRaWAN security frameworks, and industrial control protocols.

Documented security claims, verification artifacts, and testing under pertinent operational settings are used to provide certification under schemes like Common Criteria, FIPS 140-3, and IEC 62443.

6. Experimental Evaluation: Attack Reproduction and Defense Validation

6.1. Comprehensive Attack Reproduction Framework

The complete single-trace attack methodology presented by Primas et al. [6] was replicated in order to create a benchmark for assessing security enhancements. Using the same algorithmic parameters and optimization decisions described in previous work, the implementation adheres to the original three-stage procedure: template generation for modular operations, belief propagation over NTT factor graphs, and lattice-based key recovery. The attack framework’s behavior was verified against published results to ensure accuracy. It was mainly implemented in Python 3.14 with performance-critical components written in C. In order to reflect common deployment setups, target implementations were compiled using standard commercial IoT toolchains with optimization enabled and debugging disabled.

A ChipWhisperer Husky platform with four synchronized acquisition channels running at 105 MS/s was used to gather side-channel measurements. Langer RF-U 5-2 probes (Langer EMV-Technik GmbH, Bannewitz, Germany) placed with micromanipulator stages to achieve submillimeter placement accuracy were used to record electromagnetic leakage. Hardware-synchronized triggering provided about 2 ns of jitter, and each experimental run comprised 1000 traces recorded under regulated ambient conditions (25 ± 0.5 °C, 45 ± 5% relative humidity). Concurrent power and electromagnetic signal acquisition was made possible by this design, which supported multi-channel side-channel analysis in accordance with accepted evaluation procedures [22]. Three identical ARM Cortex-M4 target boards were used for the experimental evaluation in order to guarantee reproducibility and take device-to-device manufacturing variances into consideration. Cross-validation of attack results across several physical instances was made possible by populating each target board with the same microcontroller version and QRNG interface circuitry. Standard deviations are presented to indicate inter-device variability, and all reported measures are averages of the three devices’ results.

Figure 2 shows a picture of the entire experimental setup [5]. High-bandwidth probes are attached to the target device being tested, and the ChipWhisperer Husky acquisition platform is situated in the middle. The electromagnetic probe (Langer RF-U 5-2) can be precisely positioned in relation to the microcontroller die since it is mounted on a micromanipulator stage. To reduce electromagnetic interference from the surroundings, the target board is protected by a shielded container. A precision current probe that is synchronized with the trigger output of the ChipWhisperer and attached to the target’s power supply rail is used to measure power. To ensure constant leakage characteristics throughout measurement sessions, all acquisitions are carried out under temperature-controlled settings (25 ± 0.5 °C) using a humidity-controlled airflow system.

Figure 2. Experimental setup for side-channel evaluation of the QR-NTT framework.

The ChipWhisperer Husky platform with synchronized acquisition channels, the ARM Cortex-M4 target board with QRNG interface, the Langer RF-U 5-2 electromagnetic probe positioned via micromanipulator, the shielded enclosure and environmental controls, and the host workstation for trace capture and offline analysis comprise the experimental setup for side-channel acquisition shown in Figure 2.

6.2. Defense Performance Under Varied Attack Scenarios

To isolate the contribution of quantum-driven randomization, the experimental evaluation tested four implementation options under identical attack conditions. The single-trace attack success rate for the unprotected NTT implementation was 94.3%, which is in line with earlier findings [6] and suggests a significant degree of vulnerability. The single-trace success rate was lowered to 34.7%, and the number of traces needed to achieve 90% success was increasd to between 40 and 60 using traditional countermeasures that combined masking [9] and shuffling [8]. The resulting security level is still insufficient for situations demanding strong physical resistance, even if this is a measurable improvement. Conversely, QR-NTT decreased single-trace success rates to 2.7% in the maximum configuration and 11.2% in the minimal configuration, which corresponds to a 97.3% decrease in comparison to the unprotected baseline.

When trace requirements for high-probability key recovery are taken into account, differences become more noticeable. One to three traces were needed for unprotected implementations, 40–60 traces were needed for conventional defenses, and 480–620 traces were needed for the QR-NTT maximum configuration. Compared to traditional methods, this is an increase of about two orders of magnitude. Computational effort shows a similar trend: template databases grew from 78 GB to 3.2 TB, and belief propagation convergence climbed from 18.2 ± 3.1 iterations in the unprotected scenario to 312.5 ± 45.2 iterations with maximum QR-NTT protection. When combined, these enhancements significantly increase the practical cost of attacks against IoT devices deployed in the field.

6.3. Statistical Analysis of Security Enhancement

The identified security disparities are further supported by statistical analysis. Between unprotected and QR-NTT traces, two-sample Kolmogorov–Smirnov tests show statistically significant distribution shifts (p < 0.001), with Kullback–Leibler divergence rising from 0.12 ± 0.03 to 2.87 ± 0.41, indicating decreased template matching reliability [20]. The predicted mutual information between secret keys and side-channel traces drops from around 0.89 bits per trace for unprotected implementations to 0.07 bits per trace under the QR-NTT maximum configuration using the information-theoretic paradigm outlined in [20].

The behavior of belief transmission also varies significantly. It usually takes 15–25 iterations for unprotected implementations to converge to accurate marginal distributions. Convergence is slower and sometimes oscillatory under QR-NTT, needing 200–400 iterations and often ending in inaccurate local optima. Regarding entropy-induced instability in message-passing algorithms, this behavior is in line with theoretical predictions [21]. Further tests against more sophisticated attack variations, such as integrated side-channel analysis [22] and machine-learning-assisted template creation [23,24,25], reveal that attack success rates stay below 5% for all tested configurations.

6.4. Performance and Resource Overhead Characterization

The introduced protections are nevertheless compatible with IoT limitations, according to performance tests conducted on an ARM Cortex-M4 processor running at 120 MHz. Verification took 9.7% longer (from 287 k to 315 k cycles), key generation took 12.1% longer (from 102 k to 114 k cycles), and signature generation took 18.3% longer (from 398 k to 471 k cycles). Although memory consumption increased by 1.8 KB of SRAM (21.4%) and 4.2 KB of flash (24.7%), it was still significantly less than the overheads associated with traditional masking-based defenses, which sometimes surpass 200–400% [8,9].

Energy measurements reveal that while idle power consumption stayed constant at 1.2 µA, active signing power increased from 10.1 mW to 12.3 mW. This translates to a decrease in operating lifetime of less than 1% for bat-tery-powered IoT devices that perform one signature per minute. Testing shows steady functioning with automatic scaling to maintain time determinism throughout environmental extremes (−40 °C to +85 °C, supply voltages from 1.8 V to 3.6 V).

7. Deployment and Integration Guidelines for IoT Systems

7.1. Practical Deployment Considerations for IoT Ecosystems

Moving from prototype evaluation to deployment requires consideration of cost, supply chain security, and maintenance procedures. The additional hardware cost associated with QRNG integration must be evaluated relative to application risk. In industrial control, medical, and critical infrastructure contexts, this cost represents a small proportion of overall system cost and may be justified by the added resistance to physical attacks. In contrast, large-scale consumer IoT deployment will likely depend on cost reductions achieved through QRNG integration at the system-on-chip level and economies of scale [26,27,28].

Supply chain considerations introduce further constraints. QRNG components benefit from tamper-evident packaging, controlled logistics, and hardware attestation mechanisms to reduce pre-deployment risks. The architecture includes support for hardware-based roots of trust and secure boot mechanisms used to verify QRNG integrity during system initialization. Maintenance considerations also include the need to balance operational continuity with ongoing security adaptation. Field updates of entropy validation routines and randomization logic are supported, allowing security mechanisms to be adjusted over time without requiring device replacement and while maintaining compatibility with deployed device fleets. A quantitative risk-cost analysis further motivates the adoption of QR-NTT in cost-sensitive IoT deployments. The additional bill-of-materials (BOM) cost for integrating a discrete QRNG module (e.g., ID Quantique Quantis) ranges from $20 to $30 per device in low-to-medium volumes, which represents approximately 1–2% of the total system cost for industrial gateways and critical infrastructure controllers. For high-volume consumer IoT devices, this premium remains prohibitive; however, the hierarchical entropy distribution model described in Section 7.3 eliminates the need for per-device QRNG hardware by provisioning quantum entropy from trusted edge gateways. The marginal cost for Class C and D devices is almost negligible. For systems where a physical breach would have serious operational, safety, or financial repercussions, the cost is justifiable when compared to the security benefit—a reduction in single-trace attack success rates from over 90% to less than 3%. The incremental cost per device is anticipated to drop below $1 as QRNG technology advances toward system-on-chip integration, allowing for broad adoption across all IoT tiers. Different IoT device classes and application domains have varying levels of QR-NTT deployment economic viability. Discrete QRNG modules suitable for embedded integration, such as the ID Quantique Quantis series, carry unit costs ranging from $20 to $30 in low-to-medium volumes (thousands of units). For industrial gateways, programmable logic controllers (PLCs), and critical infrastructure controllers—where total system costs often exceed $1000–$5000—this represents a marginal increase of 0.5–2%. For such applications, the security benefit of reducing single-trace attack success rates from over 90% to below 3% justifies the incremental expense.

For high-volume consumer IoT deployments (millions of units), discrete QRNG modules remain cost-prohibitive. However, the hierarchical entropy distribution model described in Section 7.3 eliminates the requirement for per-device QRNG hardware. In this model, one QRNG-equipped edge gateway serves 100–500 downstream devices, distributing entropy via secure channels. The per-device amortized QRNG cost drops to $0.05–$0.30, which is competitive with classical secure elements. Furthermore, major semiconductor vendors are developing QRNG functionality integrated directly into microcontroller units (MCUs) and system-on-chip (SoC) designs, with projected marginal costs below $1 per device as volume production scales.

The total cost of ownership encompasses development, integration, certification, and maintenance in addition to hardware purchasing. In order to reduce development overhead, the QR-NTT software (custom implementation, version 1.0) stack is built as a drop-in replacement for conventional NTT implementations (Section 3.6). Compared to be-spoke security systems, certification paths under Common Criteria, FIPS 140-3, and IEC 62443 have lower certification costs thanks to defined security attributes and verifiable implementation characteristics (Section 7.2). Over-the-air update capabilities for entropy validation procedures and randomization algorithms save maintenance costs by preventing hardware replacement cycles.

A security breach can cost more than $100,000 per event for critical infrastructure, healthcare, and industrial control applications, including operational downtime, regulatory fines, and reputational harm. In light of this, the extra expense of integrating QRNG offers a good return on security investment. Future SoC integration or the hierarchical entropy distribution approach will allow for cost-effective deployment without sacrificing security guarantees for lower-risk consumer applications.

7.2. Standards Alignment and Certification Pathways

Integration into regulated contexts is made easier by QR-NTT’s alignment with certain IoT security standards and certification frameworks. The design satisfies IEC 62443 standards for industrial control system security, ETSI Cyber Security for Consumer IoT criteria for strong cryptographic implementation, and NIST IoT Cybersecurity Guidance by offering device-level defense against physical attacks. Our experimental results and analysis provide the formal verification of randomization algorithms, statistical validation of entropy sources, extensive testing across environmental conditions, and documented security claims with empirical evidence required for certification under Common Criteria, FIPS 140-3, or regional equivalents [17,29,30,31].

Practical deployment requires interoperability with current IoT security infrastructures. QR-NTT maintains compatibility with timing requirements of major IoT protocols such as LoRaWAN 1.1, Thread/802.15.4, and MQTT-SN [2]. It also integrates seamlessly with ARM mbed TLS as a drop-in replacement for standard NTT implementations, requiring only configuration changes in commercial IoT security stacks. This compatibility guarantees that quantum-enhanced security may be gradually incorporated into current installations, causing the least amount of disturbance while offering instant security advantages.

7.3. Scalability Challenges and Solutions

Additional scalability considerations are brought forth by large-scale deployment across thousands or millions of devices. Although it increases reliance on network availability, centralized supply of quantum entropy via cloud-based services can reduce hardware requirements per device. The architecture facilitates hierarchical security domains where operational conditions, risk exposure, and device role determine the level of randomization. While less critical sensors can function with intermediate configurations that periodically get entropy from network-based sources, devices deployed in critical infrastructure may rely on local QRNGs with better protective settings. Quantum-enhanced techniques can be integrated without interfering with conventional processes because key management is still in line with current IoT public key infrastructures.

The usage of adaptable setups is further motivated by differences across IoT platforms. While line-powered industrial controllers can maintain greater security settings backed by continuous entropy availability, battery-powered sensors typically choose lower degrees of randomization combined with aggressive power management. Parameters may be changed by gateways and mobile IoT nodes in response to resource availability, environmental factors, or connection. This method preserves operational viability while matching security measures to deployment limits.

Practical IIoT deployments have heterogeneous device classes with different access to quantum entropy sources, whereas the experimental validation in Section 6 concentrates on a single ARM Cortex-M4 target board (STMicroelectronics, Geneva, Switzerland). We examine how QR-NTT scales across various IIoT network designs in order to close this gap.

7.3.1. Device Classification by Entropy Access

The ability of IIoT devices to access quantum energy can be used to classify them. This classification is shown in Table 3, which links different device types to suitable QR-NTT configurations according to their resources and entropy source availability.

Table 3. Classification of IIoT devices by quantum entropy access and recommended QR-NTT configuration.

Device Class	Example Devices	QRNG Access	Typical Resources	Recommended QR-NTT Mode
Class A	Edge gateways, industrial controllers, IIoT servers	Dedicated QRNG (PCIe/SPI)	High compute (>100 MHz), line power, >128 KB RAM	Maximum security
Class B	PLCs, smart meters, industrial routers	Periodic entropy from Class A via secure channel	Medium compute (50–100 MHz), intermittent connectivity, 32–128 KB RAM	Balanced configuration
Class C	Environmental sensors, actuators, wearable devices	Pre-provisioned seed + occasional refresh	Low compute (<50 MHz), battery-powered, <32 KB RAM	Minimal configuration
Class D	Legacy field devices, simple sensors	No quantum access	Constrained (<32 MHz), <16 KB RAM	Classical countermeasures only

The suggested QR-NTT mode varies according to device capabilities, as Table 3 illustrates. Class C devices with severe resource limits are restricted to minimal configuration, whereas Class A devices with dedicated QRNG hardware can function at maximum security. Without requiring consistent hardware updates, our tiered strategy guarantees that the advantages of quantum entropy may be extended across heterogeneous IIoT networks.

7.3.2. Hierarchical Entropy Distribution

We suggest a hierarchical distribution architecture in which Class A devices act as entropy distribution sites for Class B devices without specialized QRNG hardware. Quantum entropy is distributed at predetermined synchronization intervals after being bundled into verified payloads:

• Entropy payload size: 4 KB per distribution event
• Distribution frequency: Configurable (hourly to daily) based on security requirements
• Authentication: Ed25519 signatures with pre-shared keys
• Consumption guarantee: Monotonic counters prevent entropy replay

Class C devices receive entropy seeds during manufacturing or maintenance windows, with updates performed over LoRaWAN or NB-IoT when available. According to Theorem 3 (Graceful Security Degradation), the security level for such devices gradually deteriorates, preserving baseline protection even in the absence of new entropy.

The practical difficulty of implementing QR-NTT across various IoT device classes is addressed by the hierarchical entropy distribution approach. Dedicated QRNG hardware can be hosted by Class A devices (edge gateways, industrial controllers), utilizing the available power, computation, and physical space to function in maximum security mode. During predetermined synchronization intervals, Class B devices (PLCs, smart meters, and industrial routers) without dedicated QRNGs get entropy from Class A peers, allowing balanced security operation with low hardware overhead. Entropy is pre-provisioned during production or maintenance cycles and refreshed opportunistically across low-bandwidth networks like LoRaWAN or NB-IoT for Class C devices (environmental sensors, actuators, wearables), which are severely limited in power, memory, and compute. Class D old devices might only use traditional countermeasures. This tiered approach preserves the graceful security degradation condition defined in Theorem 3 while guaranteeing that the advantages of quantum-enhanced security can be extended across heterogeneous deployments without requiring uniform hardware upgrades.

7.3.3. Performance Across Device Classes

We used the previously mentioned hierarchical entropy model to assess QR-NTT on representative devices from each class in order to verify scalability across various hardware platforms. The performance attributes for each of these platforms are compiled in Table 4.

Table 4. QR-NTT performance across heterogeneous IIoT device platforms.

Platform	Device Class	Clock	RAM	QR-NTT Mode	Time Overhead	Memory Overhead	Single-Trace Success Rate
ARM Cortex-M0+	Class C	48 MHz	16 KB	Minimal	8.3%	1.2 KB	11.2%
ARM Cortex-M4	Class B	120 MHz	64 KB	Balanced	14.1%	1.6 KB	5.8%
ARM Cortex-M7	Class A	480 MHz	512 KB	Maximum	12.7%	2.1 KB	2.7%
RISC-V RV32IMC	Class B	160 MHz	128 KB	Balanced	16.2%	1.9 KB	6.1%
ESP32-S3	Class B	240 MHz	512 KB	Balanced	13.5%	1.7 KB	5.2%
ARM Cortex-M23	Class C	64 MHz	32 KB	Minimal	9.8%	1.4 KB	9.4%

With overhead inversely linked with processing capacity, Table 4’s results show that QR-NTT scales well across device classes. Class C devices provide good security (single-trace success rates below 12%) despite having a higher proportionate overhead (8.3–9.8%). Class A devices have a low overhead (12.7%) and the best security (2.7% single-trace success). These findings validate the deployment of QR-NTT with predictable, class-appropriate security and performance characteristics across heterogeneous IIoT networks.

7.3.4. Network-Level Security Implications

In a hierarchical IIoT network with N devices, the adversary’s success probability against any single device remains bounded by the per-device analysis in Theorem 4 (BP Attack Resistance). However, network-level risk must account for the fact that compromising a Class A device could affect downstream entropy distribution. We mitigate this through:

• Entropy source diversity: Class B devices can receive entropy from multiple Class A peers, reducing single-point-of-failure risk
• Attestation: QRNG integrity verified via secure boot and runtime monitoring, as described in Section 5.4
• Fallback independence: Entropy cache depletion triggers independent classical countermeasures, ensuring security does not collapse to zero even under prolonged entropy starvation

7.3.5. Bandwidth and Energy Considerations

For a typical IIoT deployment with 100 Class B devices receiving hourly entropy updates (4 KB each), total network overhead is approximately 9.6 MB per day—negligible for industrial Ethernet or 5G networks. For cellular-connected Class B devices (NB-IoT, LTE-M), hourly updates consume approximately 0.3 MB per device per month, well within typical data plans.

Class C devices operating on LoRaWAN consume approximately 100 bytes per entropy refresh. With daily refreshes, this adds 3 KB per device per month—approximately 1–2% of typical LoRaWAN duty cycle allowances. Energy impact for battery-powered Class C devices is estimated at 0.5 mAh per day, reducing operational lifetime by less than 2% for a typical CR2032-powered sensor.

7.4. Limitations, Attack Evolution, and Future Resilience

Practical deployment necessitates a clear awareness of underlying limitations, and no solution may be presumed to offer protection against all attack vectors. The quality of the entropy source determines the security advantages of QR-NTT; compromised QRNG hardware or persistent bias in entropy generation will diminish the defense’s efficacy. Because mistakes in randomization logic or departures from constant-time execution might reintroduce exploitable structure, implementation quality is also crucial [13]. Because insufficient tamper resistance can allow direct key extraction regardless of cryptographic design, physical protection techniques continue to be an essential supplement.

It is anticipated that these features will be the focus of future attacks. Attempts to define entropy source behavior, the use of machine-learning techniques to find residual regularities in randomized executions, or the combination of side-channel analysis with fault-injection techniques as outlined in [7] are examples of potential directions. Randomization systems must be periodically adjusted and continuously monitored in order to counter such threats. These modifications can be made gradually due to QR-NTT’s modular design, which enables defensive updates without needing hardware replacement.

7.5. Mapping to NIST Cybersecurity Framework

Aligning security mechanisms with established frameworks makes risk assessment, compliance, and certification easier for deployments in critical infrastructure. The QR-NTT defense corresponds to the following basic tasks of the NIST Cybersecurity Framework (CSF):

Identify: By continuously monitoring entropy quality, QR-NTT helps identify asset risk by identifying possible assaults or hardware issues by detecting a decline in randomness quality. Accurate risk characterization for vital assets is made possible by the system’s capacity to evaluate its own security condition.

Protect. QR-NTT’s main contribution is related to the Protect function. The framework protects cryptographic keys from physical side-channel attacks by using quantum-derived execution randomization. This enhances current IoT implementations’ data protection and access controls.

Detect. The framework includes anomaly detection features that can detect ongoing side-channel attack attempts, such as entropy consumption rate analysis and temporal anomaly monitoring. Prior to successful key extraction, early detection allows for quick intervention.

Respond. QR-NTT provides automated fallback methods to respond to entropy deterioration or abnormal execution patterns. These mechanisms include isolating the device from important operations until reprovisioning, switching to decreased randomization modes, and mixing with conventional entropy sources.

Respond (continued). In order to facilitate forensic analysis and post-incident assessment, the system keeps audit logs of anomalous events and entropy quality.

Recover. By securely re-initializing entropy buffers, regenerating internal randomization settings, and securely re-provisioning quantum entropy seeds from reliable sources, QR-NTT enables recovery after an entropy source compromise or identified attack. This mapping is summarized in Table 5.

Table 5. QR-NTT mapping to NIST cybersecurity framework functions.

IST CSF Function	QR-NTT Contribution	Implementation Mechanism
Identify	Entropy quality assessment	Continuous statistical testing (NIST SP 800-90B)
Protect	Side-channel attack resistance	Quantum-driven execution randomization, constant-time operations
Detect	Attack anomaly detection	Timing monitoring, entropy consumption rate analysis
Respond	Automated security adaptation	Fallback to classical countermeasures, device isolation
Recover	Secure state restoration	Entropy buffer re-initialization, secure re-provisioning

IoT devices are becoming increasingly important for monitoring and controlling critical infrastructure sectors, such as electricity, water, transportation, and healthcare. Frameworks like IEC 62443 and NIST SP 800-82 (Guide to Industrial Control Systems Security) impose strict security standards on these systems. The alignment of QR-NTT with NIST CSF functions facilitates its incorporation into regulated contexts through:

• Giving compliance documentation a clear mapping to security controls;
• Making risk-based security decisions possible with quantifiable security attributes;
• Encouraging the cycles of ongoing observation and development that are essential to CSF implementation.

Organizations may gradually implement these capabilities thanks to QR-NTT’s modular design, which prioritizes functions according to their unique risk profile and compliance needs.

7.6. Implications for 6G-Enabled IIoT Environments

In 6G-enabled IIoT, decentralized architectures with massive device connectivity raise the question of whether every device requires its own QRNG. We address this through a hierarchical model where dedicated QRNG hardware is required only at edge gateways—typically numbering orders of magnitude fewer than end devices.

Edge gateways equipped with QRNGs distribute quantum entropy to downstream devices (controllers, sensors, actuators) over 6G’s ultra-reliable low-latency communication (URLLC) channels. For a factory floor with 1000 sensors, this reduces QRNG hardware costs by 99.9% compared to equipping every device. Downstream devices maintain entropy caches (512 bytes sufficient for ~1000 signatures) that are replenished periodically.

6G’s device-to-device (D2D) communication enables ad hoc entropy sharing among peers when network connectivity is lost. Devices within proximity can redistribute cached entropy using authenticated mesh protocols, ensuring continued QR-NTT protection during disconnection.

The security level of downstream devices is maintained as long as at least one edge gateway in their trust domain remains uncompromised and entropy distribution channels are authenticated. This distributed model does not introduce vulnerabilities beyond those of individual QR-NTT devices.

For 6G deployments, we recommend: (1) one QRNG-equipped gateway per 100–500 downstream devices; (2) entropy cache sizes of 512 bytes per device; (3) configurable update frequencies from hourly to daily based on criticality; (4) fallback to classical countermeasures when entropy cache falls below threshold.

This approach enables widespread QR-NTT protection across massive IIoT deployments without requiring QRNG hardware on every device.

7.7. Deployment in Distributed IoT Architectures

Devices are rarely deployed in isolation in real-world IoT scenarios; instead, they form dispersed networks with edge processing, hierarchical topologies, and cooperative learning processes. The hierarchical entropy distribution model (Section 7.3.2) and re-source-adaptive security configuration (Section 3.4) of the QR-NTT framework naturally apply to such situations.

The deployment scenarios where QR-NTT is useful are exemplified by a number of modern distributed IoT architectures:

Sensor nodes in BSSN topologies gather information and send it to edge gateways, which keep blockchain ledgers for integrity checks. While gateways run in highest security mode with specialized QRNG hardware, QR-NTT may be implemented on sensor nodes with minimal configuration (execution reordering only) using pre-provisioned entropy seeds. By aligning the entropy distribution channels with the blockchain synchronization intervals, quantum-derived randomness is refreshed on a regular basis without interfering with consensus procedures.

IoT federated learning frameworks preserve data privacy while aggregating model updates from dispersed devices. Cryptographic signatures authenticate client contributions in such situations. The signature keys on participating devices, which are frequently physically accessible and have limited resources, are protected using QR-NTT. The hierarchical entropy model ensures that signature operations benefit from quantum-driven execution randomization without requiring per-device QRNG hardware by enabling edge aggregators to transfer quantum entropy to leaf nodes during model synchronization rounds.

Differentiated QR-NTT setups based on zone criticality can be implemented via hierarchical edge-cloud designs that divide IoT networks into security zones, such as public access zones and industrial control zones. While lower-security monitoring zones use balanced or minimum configurations that receive entropy from zone controllers, high-security zones (such as safety-critical control loops) may use maximum security configuration with local QRNGs. This is consistent with IEC 62443’s zone and conduit paradigm for industrial control system security.

In all these distributed contexts, the key enabling factor is the hierarchical entropy distribution mechanism described in Section 7.3.2, which decouples quantum entropy generation (performed at gateways) from entropy consumption (performed at edge devices). This architectural compatibility ensures that QR-NTT can be integrated into existing distributed IoT deployments without requiring fundamental redesign of the communication or security infrastructure.

7.8. Practical Integration in Distributed IoT Environments

In real-world IoT scenarios, devices are rarely deployed in isolation. The QR-NTT framework, with its hierarchical entropy distribution model and resource-adaptive security configuration, fits well in such environments. In blockchain-based secure sensor network (BSSN) architectures, sensor nodes collect data and edge gateways maintain blockchain ledgers for verification of integrity [32]. QR-NTT can be deployed in the following manner: sensor nodes operate in minimal configuration using pre-provisioned entropy seeds, and the gateways operate in maximum security mode with dedicated QRNG hardware. In the case of cooperative federated learning frameworks, where distributed devices collaboratively train models and do not share raw data, cryptographic signatures authenticate client contributions [33]. Edge aggregators can serve as entropy distribution points; they transform quantum entropy to leaf nodes during model synchronization rounds. They ensure that signature operations benefit from quantum-driven randomization and do not require per-device QRNG hardware. For hybrid zone security models that organize large-scale deployments into differentiated protection zones [33,34], QR-NTT supports configurable defense profiles. It allows high-security zones to deploy maximum configurations with local QRNGs and lower-security zones to utilize balanced configurations that receive entropy from zone controllers. In these distributed paradigms, when we decouple quantum entropy generation from consumption, we generate entropy at trusted infrastructure points and distribute it to edge devices over authenticated channels. Therefore, we minimize hardware costs, accommodate heterogeneous device capabilities, maintain security during intermittent operation, and align with existing IoT security architectures. During this process, we do not require fundamental protocol redesign.

8. Conclusions and Future Directions

8.1. Summary of Contributions and Key Findings

This study investigated the use of quantum-derived randomness as an implementation-level technique for improving the physical security of IoT digital signatures under resource constraints. In a way that is compatible with embedded platforms, the Quantum-Randomized NTT (QR-NTT) framework uses quantum entropy in lattice-based cryptography solutions. Results from theoretical analysis and experimental evaluation indicate that QR-NTT lowers the success rate of single-trace attacks and increases the computational effort required for belief propagation-based attacks, while introducing moderate overheads in execution time (18.3%) and memory usage (1.8 KB).

The evaluation’s findings highlight a number of the approach’s features. In terms of side-channel resistance, the variability introduced by quantum-derived entropy is different from that generated by classical randomization. The practical threat model for physically accessible deployments is impacted by the increased attack complexity that results from the accompanying processes operating within the resource limits typical of IoT devices. Real-time operation is still compatible with the observed overheads. When combined, our findings demonstrate that post-quantum cryptography systems can achieve implementation-level security improvements in IoT settings without going beyond realistic deployment constraints.

8.2. Broader Implications for IoT Security and Quantum Technology

Beyond the specific implementation analyzed, the results indicate that quantum entropy sources can be incorporated into near-term security mechanisms without dependence on large-scale quantum computing infrastructure. The use of quantum randomness at the implementation level increases the range of countermeasures available for mitigating physical attacks and operates alongside existing algorithmic protections. In IoT contexts, this allows security mechanisms to be adjusted incrementally in response to changes in threat assumptions and hardware capabilities.

From an evaluation standpoint, the study highlights the value of combining formal analysis with implementation-specific detail and empirical measurement when assessing resistance to physical attacks. As certification and deployment processes increasingly require evidence of robustness at the implementation level, such combined evaluation approaches remain applicable. The interaction between post-quantum cryptographic techniques and quantum entropy sources also identifies directions for further investigation spanning cryptography, hardware design, and side-channel analysis.

The findings show that quantum entropy sources can be integrated into short-term security measures without relying on extensive quantum computing infrastructure, independent of the particular implementation examined. In addition to existing algorithmic defenses, the application of quantum randomness at the implementation level broadens the spectrum of countermeasures possible for mitigating physical attacks. This enables security methods to be gradually modified in IoT environments in response to shifts in threat assumptions and hardware capabilities.

When evaluating resistance to physical attacks, the study emphasizes the importance of integrating formal analysis with implementation-specific information and empirical assessment. Such combination evaluation methodologies are still relevant as certification and deployment procedures increasingly demand proof of robustness at the implementation level. The interplay between quantum entropy sources and post-quantum encryption methods also points to areas for future research in side-channel analysis, hardware design, and cryptography.

8.3. Future Research Directions

There are several areas that require more research. Short-term deployment costs can be reduced and adoption in large-scale IoT systems made easier by integrating QRNG capability into chip-based system designs. Formal interface definitions and security presumptions pertaining to execution-level randomization could also be taken into account by standardization activities. Deployment trade-offs would be further clarified by a more comprehensive examination across different platforms, operational conditions, and attack types.

Longer-term studies could look into methods that modify execution behavior in response to detected attack conditions and use quantum-assisted randomization across larger protocol stacks. As part of a larger, developing IoT security ecosystem, these approaches seek to improve implementation-level security. Confidence in quantum-enhanced security will be strengthened by more thorough testing across larger IoT systems, attack strategies, and environmental circumstances.

In the next three to five years, quantum improvement should be extended to all IoT security protocols, such as TLS 1.3, DTLS, and protocol-specific optimizations. Developing high-volume production methods for quantum-enhanced security hardware, possibly incorporating QRNG capabilities directly into microcontroller units, is necessary for manufacturing scalability. Regular deployments in critical infrastructure, healthcare, and finance will require certification frameworks that specifically address quantum-enhanced systems.

Coordinated usage of quantum-related security technologies may become more feasible over longer time horizons. In some high-assurance settings, end-to-end protection may be supported by combinations of quantum key distribution, quantum random number generation, and post-quantum cryptographic algorithms. As threat models change, adaptive security systems based on data-driven analysis and ongoing monitoring may help to modify protection levels. Standardization efforts addressing quantum-enhanced security for critical infrastructure could further contribute to the definition of common assurance baselines across sectors.

8.4. Concluding Remarks

IoT systems are deployed in application domains with stringent security requirements, including healthcare, industrial automation, and infrastructure monitoring. In such environments, protections limited to algorithmic properties alone are insufficient in practice. This work examined the use of quantum-derived entropy as an implementation-level protection mechanism and showed that it can be applied within resource constraints typical of embedded platforms. The QR-NTT framework combines execution-level randomization with post-quantum cryptographic algorithms in a way that increases resistance to physical side-channel attacks while maintaining practical performance and memory overhead.

Experimental results show that improvements in implementation robustness can be achieved without conflicting with efficiency requirements in IoT environments. Incorporating selected emerging technologies increases the range of security configurations available to system designers. As quantum hardware and post-quantum standards mature, approaches that account for implementation-level behavior remain applicable to the design of secure IoT systems.