{
    "status": "pilot",
    "generated": "2026-11-04",
    "disclaimer": "Illustrative reference service. Readiness comes only from editor-approved PQC navigator assertions; a product that supports an algorithm does not mean the service can migrate. Dates are unknown unless published; nothing here is agreed between parties. Not compliance advice.",
    "service": {
        "id": "firmware-signing",
        "title": "Code signing and firmware updates from a supplier to an operator's devices",
        "illustrative": true,
        "summary": "A device supplier signs firmware and software updates with keys held in an HSM; devices in the operator's network verify the signature before installing. Devices must be able to verify new signatures before the signer can switch.",
        "limitations": "A generic template. Device bootloaders and update agents are not in the product navigator. Stateful hash-based signatures need strict state management by the signer.",
        "compiled": "2026-10-23"
    },
    "components": [
        {
            "id": "signing-hsm",
            "label": "Supplier's signing HSM",
            "controlled_by": "Supplier or vendor",
            "function": "HSM key storage and operations",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "device-verifiers",
            "label": "Bootloaders and update agents verifying signatures on the devices",
            "controlled_by": "Supplier or vendor",
            "function": "Code and document signing",
            "chosen_release": null,
            "readiness": "Not covered by the product navigator",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "code-signing-anchor",
            "label": "Code-signing certificate or trust anchor",
            "controlled_by": "Certificate authority or trust service provider",
            "function": "PKI / CA certificate issuance",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "signing-hsm"
            ],
            "blocked_by": [
                "signing-hsm"
            ]
        },
        {
            "id": "signing-library",
            "label": "Signing library in the supplier's build pipeline",
            "controlled_by": "Supplier or vendor",
            "function": "Algorithms in the cryptographic API",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [
                "signing-hsm",
                "device-verifiers"
            ],
            "blocked_by": [
                "signing-hsm",
                "device-verifiers"
            ]
        },
        {
            "id": "update-acceptance",
            "label": "Operator's acceptance and rollout of updates with new signatures",
            "controlled_by": "Own organisation",
            "function": "Code and document signing",
            "chosen_release": null,
            "readiness": "No agreement recorded between the parties",
            "assertion": null,
            "depends_on": [
                "signing-library"
            ],
            "blocked_by": [
                "signing-library",
                "signing-hsm",
                "device-verifiers"
            ]
        }
    ],
    "plan": [
        {
            "party": "supplier",
            "party_label": "Supplier or vendor",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "signing-hsm",
            "component_label": "Supplier's signing HSM",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Supplier's signing HSM and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "supplier",
            "party_label": "Supplier or vendor",
            "step": "statements",
            "step_label": "Supplier and counterparty statements obtained",
            "component": "device-verifiers",
            "component_label": "Bootloaders and update agents verifying signatures on the devices",
            "readiness": "Not covered by the product navigator",
            "action": "Obtain a dated statement on post-quantum support for Bootloaders and update agents verifying signatures on the devices; the product navigator has no record for it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "ca-trust-service",
            "party_label": "Certificate authority or trust service provider",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "code-signing-anchor",
            "component_label": "Code-signing certificate or trust anchor",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Code-signing certificate or trust anchor and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-signing-hsm"
            ],
            "waits_for_labels": [
                "Supplier's signing HSM"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "supplier",
            "party_label": "Supplier or vendor",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "signing-library",
            "component_label": "Signing library in the supplier's build pipeline",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Signing library in the supplier's build pipeline and record it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-signing-hsm",
                "c-device-verifiers"
            ],
            "waits_for_labels": [
                "Supplier's signing HSM",
                "Bootloaders and update agents verifying signatures on the devices"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "own-organisation",
            "party_label": "Own organisation",
            "step": "configuration",
            "step_label": "Compatible configuration agreed",
            "component": "update-acceptance",
            "component_label": "Operator's acceptance and rollout of updates with new signatures",
            "readiness": "No agreement recorded between the parties",
            "action": "Agree Operator's acceptance and rollout of updates with new signatures between the parties concerned and record who agreed and when.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-signing-library"
            ],
            "waits_for_labels": [
                "Signing library in the supplier's build pipeline"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "interop-test",
            "step_label": "Interoperability test",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Run a joint interoperability test of the whole chain in a test environment and record its scope and result.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-signing-hsm",
                "c-device-verifiers",
                "c-code-signing-anchor",
                "c-signing-library",
                "c-update-acceptance"
            ],
            "waits_for_labels": [
                "Supplier's signing HSM",
                "Bootloaders and update agents verifying signatures on the devices",
                "Code-signing certificate or trust anchor",
                "Signing library in the supplier's build pipeline",
                "Operator's acceptance and rollout of updates with new signatures"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "pilot",
            "step_label": "Pilot",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Pilot the service with a limited group, keeping the classical fallback.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-interop-test"
            ],
            "waits_for_labels": [
                "Interoperability test"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "rollout",
            "step_label": "Staged rollout",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Roll out in stages agreed by every party.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-pilot"
            ],
            "waits_for_labels": [
                "Pilot"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "validation",
            "step_label": "Validation",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Validate that the post-quantum mechanisms are actually negotiated or verified on every hop.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-rollout"
            ],
            "waits_for_labels": [
                "Staged rollout"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "retire-legacy",
            "step_label": "Retirement of the legacy fallback, when authorised",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Retire the classical-only fallback only when every party has authorised it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-validation"
            ],
            "waits_for_labels": [
                "Validation"
            ],
            "date": "Unknown: no date published or agreed"
        }
    ],
    "milestones": [
        {
            "id": "eu-pqc-milestone-2026",
            "date": "2026-12-31",
            "date_text": "By 31 December 2026",
            "title": "EU roadmap milestone 1: first steps and national roadmaps",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        },
        {
            "id": "eu-pqc-milestone-2030",
            "date": "2030-12-31",
            "date_text": "By 31 December 2030",
            "title": "EU roadmap milestone 2: high-risk use cases migrated",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        }
    ],
    "interop": [
        {
            "id": "hackathon-ml-dsa-65-certificates",
            "title": "IETF PQC Hackathon: ML-DSA-65 X.509 certificate artifacts",
            "result": "Passed within the stated scope",
            "scope": "Parsing and verifying self-signed ML-DSA-65 certificate artifacts from 17 producers with 4 verifiers (Bouncy Castle, a composite reference implementation, OpenSSL and QUBIP Aurora): all 68 pairs passed.",
            "limitations": "Artifact test, not a TLS handshake or a deployed service. The page names submitters, not product releases or builds, so it does not apply to a particular release listed here. Not a certification.",
            "url": "https://ietf-hackathon.github.io/pqc-certificates/pqc_hackathon_results_certs_r5_automated_tests.html",
            "results_date": "2026-10-06",
            "retrieved": "2026-10-23"
        }
    ]
}