Drones, Toll Roads, and Connected Vehicles: Post-Quantum Cryptography for Physical Systems

UAVs operate over open wireless channels — radio-frequency links, cellular networks, satellite uplinks — using protocols designed around classical cryptographic assumptions. A review of PQC for UAV security by Khan, Javaid, Mohsan, Tanveer, and Ullah surveys the threat landscape: MAVLink, the dominant open-source UAV communications protocol, has no native encryption; when encryption is layered on top, implementations typically rely on AES and ECDH, both of which are either weakened (AES key-size equivalence is halved by Grover) or directly broken (ECDH is broken by Shor) in the post-quantum threat model.

The operational attack surfaces include unauthorized command injection — an adversary who has broken the UAV's key exchange can issue arbitrary flight commands — data exfiltration from onboard sensors, and replay attacks against authentication tokens. For military and critical-infrastructure UAVs, those threats are not speculative. For commercial delivery drones and agricultural monitoring platforms operating under cellular or unlicensed-band radio, the exposure is lower but still real as quantum hardware capability matures.

The resource constraints that define the problem are tight: UAVs have limited onboard computation, battery power, and memory. The algorithms that work well on a 64-core server with AES-NI instructions do not necessarily fit in the flight controller of a fixed-wing drone running a Cortex-M4 at 168 MHz.

The Al Mamun et al. study evaluated ML-KEM against the security and performance requirements of electronic toll collection under the ARC-IT reference architecture for Intelligent Transportation Systems. Using Microsoft's Threat Modelling Tool, the team mapped quantum attack vectors to system components — identifying that the electronic toll collection subsystem relies on ECDSA for vehicle authentication and AES-128 for session encryption, both of which require migration.

Performance experiments on a wired Ethernet link showed that ML-KEM meets latency requirements. On a wireless channel simulating real TCPS operating conditions, the latency overhead of ML-KEM key operations exceeded the thresholds required for safety-critical V2X (vehicle-to-infrastructure) communications. The conclusion is not that ML-KEM is unsuitable — it is that wireless TCPS deployments require further work: hardware acceleration, lighter parameter sets, hybrid schemes that use ML-KEM only for long-term key establishment while relying on symmetric algorithms for session-layer encryption, or NIST-defined lightweight PQC profiles that have not yet been finalized.

IEEE 1609.2, the security standard for Wireless Access in Vehicular Environments, specifies ECDSA for certificate-based authentication, AES-128-CCM for data encryption, and ECDH/ECIES for key exchange. Every connected vehicle, every roadside unit, and every V2X infrastructure node that implements 1609.2 relies on asymmetric cryptography that Shor's algorithm breaks.

The migration path here is a standards-body problem before it is a vendor problem. IEEE must define PQC-capable successor specifications for 1609.2 that fit within the tight message-size budgets and latency constraints of V2X communication. Organizations deploying connected-vehicle infrastructure today should track the IEEE Intelligent Transportation Systems standards working group activity and design infrastructure refresh cycles around the migration timeline rather than against it.

The UAV and TCPS cases illustrate a general principle: post-quantum migration in resource-constrained physical systems is not an algorithm-selection problem but an engineering problem. Three approaches are active research directions.

First, hardware acceleration. Offloading the NTT to a dedicated coprocessor — even a modest one integrated into an SoC — eliminates the primary latency bottleneck without requiring software optimization. Multiple ASIC and FPGA designs for ML-KEM NTT acceleration have been demonstrated, including a 22nm ASIC implementation achieving over one million key operations per second at milliwatt power levels.

Second, hybrid classical/PQC schemes that reserve post-quantum operations for long-term key establishment while using standard AES for session encryption. This approach is already deployed in TLS and SSH, and can be adapted for constrained protocols by structuring PQC operations to occur on the ground station or infrastructure side, where compute is less constrained.

Third, algorithm diversity. Code-based schemes such as HQC have different performance profiles than lattice-based schemes; some embedded targets benefit from one or the other depending on their computational architecture.

Map your protocol dependencies to their cryptographic primitives. For TCPS and UAV operators, this means identifying every point in the system where ECDSA, ECDH, or ECDHE is used — in protocol stacks, firmware, ground-control software, and infrastructure authentication — and building a migration inventory.

Track IEEE 1609.2 standards activity. Waiting for a finalized successor specification before planning is not a safe approach; planning cycles for infrastructure (roadside units, V2X gateways) are multi-year. Begin assessing migration readiness against current draft guidance now.

Do not assume that deploying ML-KEM on embedded hardware is straightforward. The latency results from connected-vehicle studies show that even a standardized algorithm may not meet protocol requirements on wireless channels without hardware acceleration or protocol-layer adaptation.

Engage hardware vendors early. SoC suppliers and embedded security module vendors are adding PQC acceleration; specifying PQC capability in hardware procurement today avoids a field-upgrade problem in five years.