The protocol ossification problem: accountability when cryptographic assumptions are burned into hardware that outlives the standards they implement
AI agents running on embedded hardware often inherit cryptographic implementations they cannot change. When those implementations belong to a standard that no longer holds — in the post-quantum transition or beyond — every decision the agent makes carries accountability risk that no software patch can address.
Every embedded device that uses cryptography ships with a set of cryptographic primitives — hash functions, key agreement protocols, signature schemes — implemented somewhere in the stack. For devices where cost, power, and performance constraints matter, those implementations often live in silicon: a hardware security module with fixed capabilities, a co-processor that accelerates specific operations, or a bootloader ROM whose contents are immutable after manufacturing.
Immutability is a security property when the primitives are sound. It becomes a vulnerability when they are not. The protocol ossification problem is what happens when an AI agent is deployed on hardware whose cryptographic surface cannot be changed — and when the standards those primitives implement are no longer adequate.
Why the post-quantum transition makes this acute
Most cryptographic vulnerabilities discovered over the past decade have allowed some path of remediation: new protocol versions, revised key sizes, software patches that deprecate old cipher suites. These remediations work because they operate at the software layer, where changes can be deployed incrementally across the installed base.
The post-quantum transition is categorically different. The algorithms threatened — RSA, ECDSA, ECDH and the full suite of classical asymmetric cryptography — are not made unsafe by a new attack that can be patched around. They are made unsafe by a new computational model. When cryptographically relevant quantum computing arrives, every signature made with ECDSA is retroactively untrustworthy, every key agreement done with ECDH is retroactively exposed. The transition is permanent and one-directional.
Hardware that implements these algorithms in fixed silicon has no migration path. An AI agent whose authorization tokens, attestation chains, and audit log signatures are rooted in hardware-accelerated classical cryptography cannot be made post-quantum safe by a firmware update. The accountability instruments the agent generates — the logs, the attestations, the signed authorization records — will carry those classical signatures for as long as the device runs.
The accountability gap that cannot be patched
The problem is not simply that ossified hardware exposes data in transit. It is that it compromises the evidential integrity of every accountability record the agent has ever produced.
AI agents in consequential domains generate signed records: this agent, authorized by this principal, took this action, at this time. The signature is what makes the record trustworthy to a third party — an auditor, a regulator, a court. If the signature scheme can be broken retroactively, the evidentiary value of the record depends on when it is examined, not on whether it was correctly generated. An agent that acted properly in 2026 may be unable to prove it did so in 2036 if the hardware that signed the record is ossified around classical primitives that are no longer trusted.
This is an accountability gap with no retroactive fix. The record exists. The signature exists. But the signature's trustworthiness is contingent on a computational assumption that may not hold at the time of challenge.
The care setting amplifies the stakes
Devices deployed in physical-world care settings have especially long service lives. A monitoring device installed in a care environment may reasonably be expected to operate for a decade. The decisions it makes — anomaly detection, escalation to human providers, medication adherence records — carry direct consequence for the people it serves.
A care AI agent whose hardware cryptographic layer is ossified around classical primitives generates signed accountability records that will not survive the post-quantum transition. When a decision is challenged years later, and the cryptographic proof of what the agent decided must be produced, the signature on that proof may be rendered suspect by the quantum capability available at the time of challenge. There is no way to go back and re-sign with a stronger algorithm. The audit record is what it is.
What correct architecture looks like
The solution is not to avoid hardware-accelerated cryptography. Hardware security modules, secure enclaves, and hardware-rooted key storage provide real security properties that matter in agentic deployments. The solution is to maintain a minimal and separable hardware cryptographic surface — and to plan for cryptographic agility from the first design decision.
For AI agents whose decisions need to remain verifiable over long time horizons, this means: hardware roots that are algorithm-agnostic where the silicon permits; a software cryptographic layer sitting above the hardware that can be updated; audit log signatures generated using post-quantum algorithms from the outset, even when the underlying hardware cannot enforce PQC at the transport layer; and device-level attestation that includes a clear record of the cryptographic assumptions in use, so that any relying party knows exactly what trust model applies.
Separation matters. The hardware that stores key material need not be the same component that applies the signature scheme to accountability logs. Where the signing algorithm can be moved to a software layer without sacrificing the security of key storage, it should be. That separation is the margin that allows a software-layer upgrade when the hardware cryptographic layer cannot be changed.
The design moment is now
Agents being designed and deployed now will run on hardware that will be in service through the post-quantum transition. The cryptographic primitives chosen in the hardware selection meeting today are the ones that will either survive or fail to survive that transition. The accountability systems built on those choices will be as durable — or as fragile — as the hardware assumptions they rest on.
Asaptic Labs' work at the hardware × post-quantum security crossing treats protocol ossification as a first-order design constraint, not an edge case. Every hardware choice that constrains cryptographic agility is a choice about which accountability records will survive the transition intact — and which will not.
The standard you implement in hardware today is the standard you are committed to for the life of the device. Choose accordingly.
Embedded AI agents often run on hardware whose cryptographic surface cannot be field-updated. In the post-quantum transition, this means the signed accountability records those agents produce may become evidentially untrustworthy before the devices are decommissioned. The design response is a minimal, separable hardware cryptographic surface, a software signing layer above it that can be upgraded, and post-quantum audit log signatures from the outset.
每个运行加密算法的嵌入式设备都预装了一套密码学原语——哈希函数、密钥协商协议、签名方案——实现于协议栈的某处。对于成本、功耗和性能约束严格的设备，这些实现往往驻留于硅片之中：具有固定能力的硬件安全模块、加速特定运算的协处理器，或制造后内容不可更改的引导程序ROM。
在原语健全时，不可更改性是一种安全属性。当原语不再健全时，它就成了漏洞。协议骨化问题，就是当AI智能体部署在密码学表面无法改变的硬件上——而该硬件所实现的标准已不再足够——时所发生的问题。
为何后量子过渡使这一问题变得尖锐
过去十年发现的大多数密码学漏洞都有某种修复路径：新协议版本、修订后的密钥长度、弃用旧密码套件的软件补丁。这些修复之所以有效，是因为它们在软件层运作，变更可以跨已安装设备群增量部署。
后量子过渡在性质上截然不同。受威胁的算法——RSA、ECDSA、ECDH以及所有经典非对称密码学——不是因为某个可以规避的新攻击而变得不安全，而是因为一种新的计算模型。当具有密码学意义的量子计算到来时，每一个用ECDSA生成的签名都将被追溯性地认定为不可信，每一次用ECDH完成的密钥协商都将被追溯性地暴露。这一转变是永久的、单向的。
在固定硅片中实现这些算法的硬件没有迁移路径。一个依托硬件加速经典密码学来生成授权令牌、证明链和审计日志签名的AI智能体，无法通过固件更新变得后量子安全。该智能体生成的问责工具——日志、证明、签名授权记录——将在设备运行期间持续携带那些经典签名。
无法用补丁修复的问责缺口
问题不仅仅是骨化的硬件会暴露传输中的数据，而是它损害了智能体曾经生成的每一条问责记录的证据完整性。
在关键领域运作的AI智能体会生成签名记录：此智能体经此委托人授权，采取了此行动，发生于此时刻。签名使记录对第三方——审计员、监管机构、法院——具有可信度。如果签名方案可以被追溯性破解，记录的证据价值就取决于何时被审查，而非其是否被正确生成。一个在2026年正当行事的智能体，若签名该记录的硬件骨化于已不再受信任的经典原语，可能在2036年无法证明其行为的正当性。
这是一个没有追溯性修复方案的问责缺口。记录存在。签名存在。但签名的可信度取决于一个在质疑时刻可能已不成立的计算假设。
照护场景放大了风险
部署在物理世界照护环境中的设备服务寿命尤其长。安装在照护环境中的监测设备，合理预期可能运行十年。它所做的决策——异常检测、升级到人类照护提供者、用药依从记录——对其服务的人员具有直接影响。
一个硬件密码层骨化于经典原语的照护AI智能体，会生成无法在后量子过渡中存活的签名问责记录。当一项决策在数年后受到质疑，且必须提供智能体当时决策的密码学证明时，该证明上的签名可能因质疑时已存在的量子计算能力而被认定为可疑。无法回去用更强的算法重新签名。审计记录就是它本来的样子。
正确的架构应该是什么样子
解决方案不是避免硬件加速密码学。硬件安全模块、安全飞地和硬件根密钥存储提供了在智能体部署中确实重要的安全属性。解决方案是维护最小化且可分离的硬件密码表面——并从第一个设计决策开始规划密码学敏捷性。
对于其决策需要在长时间内保持可验证的AI智能体，这意味着：在硅片允许的情况下尽可能算法无关的硬件根；硬件之上可更新的软件密码层；从一开始就使用后量子算法生成审计日志签名，即使底层硬件无法在传输层强制执行PQC；以及包含所用密码学假设明确记录的设备级证明，以便任何依赖方都能清楚地了解适用的信任模型。
分离至关重要。存储密钥材料的硬件不必与对问责日志应用签名方案的组件相同。在签名算法可以被移至软件层而不牺牲密钥存储安全性的情况下，就应该这样做。这种分离就是当硬件密码层无法更改时，允许进行软件层升级的余量。
设计时刻就是现在
现在正在设计和部署的智能体将运行在整个后量子过渡期间都将在役的硬件上。今天在硬件选型会议上选择的密码原语，将是那些要么在过渡中存活，要么无法存活的原语。建立在这些选择上的问责系统，将与其所依赖的硬件假设一样耐用——或脆弱。
Asaptic Labs在硬件×后量子安全交叉点的工作，将协议骨化作为一级设计约束，而非边缘情况。每个限制密码学敏捷性的硬件选择，都是关于哪些问责记录将在过渡中完整存活——哪些不会——的决定。
今天在硬件中实现的标准，就是设备整个生命周期内承诺遵循的标准。请审慎选择。
嵌入式AI智能体通常运行在密码学表面无法现场更新的硬件上。在后量子过渡中，这意味着这些智能体生成的签名问责记录，可能在设备退役之前就已失去证据效力。正确的设计应对是：最小化、可分离的硬件密码表面；其上可升级的软件签名层；以及从一开始就采用后量子算法生成审计日志签名。
每個運行加密算法的嵌入式設備都預裝了一套密碼學原語——雜湊函數、密鑰協商協議、簽名方案——實現於協議棧的某處。對於成本、功耗和性能約束嚴格的設備，這些實現往往駐留於矽片之中：具有固定能力的硬件安全模塊、加速特定運算的協處理器，或製造後內容不可更改的引導程序ROM。
在原語健全時，不可更改性是一種安全屬性。當原語不再健全時，它就成了漏洞。協議骨化問題，就是當AI智能體部署在密碼學表面無法改變的硬件上——而該硬件所實現的標準已不再足夠——時所發生的問題。
為何後量子過渡使這一問題變得尖銳
過去十年發現的大多數密碼學漏洞都有某種修復路徑：新協議版本、修訂後的密鑰長度、棄用舊密碼套件的軟件補丁。這些修復之所以有效，是因為它們在軟件層運作，變更可以跨已安裝設備群增量部署。
後量子過渡在性質上截然不同。受威脅的算法——RSA、ECDSA、ECDH以及所有經典非對稱密碼學——不是因為某個可以規避的新攻擊而變得不安全，而是因為一種新的計算模型。當具有密碼學意義的量子計算到來時，每一個用ECDSA生成的簽名都將被追溯性地認定為不可信，每一次用ECDH完成的密鑰協商都將被追溯性地暴露。這一轉變是永久的、單向的。
在固定矽片中實現這些算法的硬件沒有遷移路徑。一個依托硬件加速經典密碼學來生成授權令牌、證明鏈和審計日誌簽名的AI智能體，無法通過固件更新變得後量子安全。該智能體生成的問責工具——日誌、證明、簽名授權記錄——將在設備運行期間持續攜帶那些經典簽名。
無法用補丁修復的問責缺口
問題不僅僅是骨化的硬件會暴露傳輸中的數據，而是它損害了智能體曾經生成的每一條問責記錄的證據完整性。
在關鍵領域運作的AI智能體會生成簽名記錄：此智能體經此委託人授權，採取了此行動，發生於此時刻。簽名使記錄對第三方——審計員、監管機構、法院——具有可信度。如果簽名方案可以被追溯性破解，記錄的證據價值就取決於何時被審查，而非其是否被正確生成。一個在2026年正當行事的智能體，若簽名該記錄的硬件骨化於已不再受信任的經典原語，可能在2036年無法證明其行為的正當性。
這是一個沒有追溯性修復方案的問責缺口。記錄存在。簽名存在。但簽名的可信度取決於一個在質疑時刻可能已不成立的計算假設。
照護場景放大了風險
部署在物理世界照護環境中的設備服務壽命尤其長。安裝在照護環境中的監測設備，合理預期可能運行十年。它所做的決策——異常檢測、升級到人類照護提供者、用藥依從記錄——對其服務的人員具有直接影響。
一個硬件密碼層骨化於經典原語的照護AI智能體，會生成無法在後量子過渡中存活的簽名問責記錄。當一項決策在數年後受到質疑，且必須提供智能體當時決策的密碼學證明時，該證明上的簽名可能因質疑時已存在的量子計算能力而被認定為可疑。無法回去用更強的算法重新簽名。審計記錄就是它本來的樣子。
正確的架構應該是什麼樣子
解決方案不是避免硬件加速密碼學。硬件安全模塊、安全飛地和硬件根密鑰存儲提供了在智能體部署中確實重要的安全屬性。解決方案是維護最小化且可分離的硬件密碼表面——並從第一個設計決策開始規劃密碼學敏捷性。
對於其決策需要在長時間內保持可驗證的AI智能體，這意味著：在矽片允許的情況下盡可能算法無關的硬件根；硬件之上可更新的軟件密碼層；從一開始就使用後量子算法生成審計日誌簽名，即使底層硬件無法在傳輸層強制執行PQC；以及包含所用密碼學假設明確記錄的設備級證明，以便任何依賴方都能清楚地瞭解適用的信任模型。
分離至關重要。存儲密鑰材料的硬件不必與對問責日誌應用簽名方案的組件相同。在簽名算法可以被移至軟件層而不犧牲密鑰存儲安全性的情況下，就應該這樣做。這種分離就是當硬件密碼層無法更改時，允許進行軟件層升級的餘量。
設計時刻就是現在
現在正在設計和部署的智能體將運行在整個後量子過渡期間都將在役的硬件上。今天在硬件選型會議上選擇的密碼原語，將是那些要麼在過渡中存活，要麼無法存活的原語。建立在這些選擇上的問責系統，將與其所依賴的硬件假設一樣耐用——或脆弱。
Asaptic Labs在硬件×後量子安全交叉點的工作，將協議骨化作為一級設計約束，而非邊緣情況。每個限制密碼學敏捷性的硬件選擇，都是關於哪些問責記錄將在過渡中完整存活——哪些不會——的決定。
今天在硬件中實現的標準，就是設備整個生命週期內承諾遵循的標準。請審慎選擇。
嵌入式AI智能體通常運行在密碼學表面無法現場更新的硬件上。在後量子過渡中，這意味著這些智能體生成的簽名問責記錄，可能在設備退役之前就已失去證據效力。正確的設計應對是：最小化、可分離的硬件密碼表面；其上可升級的軟件簽名層；以及從一開始就採用後量子算法生成審計日誌簽名。