Strategies for Spreading Key Exploitable Results
Isabel Marco Martínez (PONSIP)
10/03/2025
In the rapidly evolving technological landscape, the translation of research outcomes into tangible industrial benefits is a critical driver of innovation and economic growth. Central to this process is the identification and dissemination of Key Exploitable Results (KERs), which represent research or development outcomes with significant potential for industrial application and commercialization.
The QUBIP project is committed to produce the KERs presented in Table 1.
Table 1: List of Key Exploitable Results for QUBIP
| ID | KER | Description |
| KER1 | Post-Quantum (PQ) Secure Element with Crypto API | The Secure Element (SE) is an tamper resistant element containing the modules to perform cryptographic operations (e.g., key generation, key storage, signature, and other PQ algorithms) at hardware level with classical and Post-Quantum Cryptography (PQC). The SE is complemented by the Crypto API working as a software reference for hardware developing. |
| KER2 | PQ MCU-based IoT | A PQ IoT device with external SE. The MCU is connected to the SE through the i2c protocol, protected by SCP-03. The communication with the remote endpoints makes use of PQ/T hybrid TLS implemented over MbedTLS. |
| KER3 | PQ MPU-based IoT | A PQ IoT device implemented in a System-on-Chip (SoC), where the SE is hosted on the Programmable Logic (PL), and the embedded Operating System uses the Processing System (PS). The SE is connected to the PS using AXI interfaces and can be used by the operating system by means of a dedicated custom kernel module. The communication with the remote endpoints makes use of PQ/T hybrid TLS implemented over OpenSSL. |
| KER4 | PQ-mbedtls | An improve version of the MbedTLS library offering PQ and PQ/T hybrid TLS implementation for IoT devices. |
| KER5 | aurora & openssl_provider_forge | The first Rust crate implements a shallow Provider for OpenSSL 3.2+, focused on easily integrating external KEM and Signature implementations conforming to the NIST PQC API. The focus is primarily on PT/Q Hybrid (or Composite) schemes. The second Rust crate is a support crate to aid developers in creating OpenSSL Providers in Rust. It is leveraged by aurora as its foundation, but it is versatile enough to be used for other Providers. |
| KER6 | qryptotoken (PQ PKCS#11 Loadable Module) |
This Rust crate implements a PKCS#11-compatible shallow loadable module, specifically tailored to be interoperable with Mozilla Firefox’s vendored fork of NSS, with the goal of easily supporting external PQC implementations for KEM and Signatures, as long as they conform to the NIST PQC API. The goal is initially to allow for alternative implementations for the algorithms selected by the Firefox maintainers, and eventually to provide enough flexibility to allow injecting also alternative selections of algorithms. The focus is primarily on PT/Q Hybrid (or Composite) schemes. |
| KER7 | CCIPS (KER7a) & PQ Remote Attestation of IPsec endpoints (KER7b) |
First (KER7a), CCIPS product implement a solution for establishing IPsec tunnels without relying on the traditional or PQC (IKEv2). Instead, it leverages a centralized key management system to distribute encryption keys, eliminating the need for asymmetric algorithms in the data plane. This approach can also support external cryptographic PQC methods or Quantum Key Distribution (QKD) to generate equivalent keys as IKE. Second (KER7b), PQ Remote attestation provides a solution for PQC based integrity verification over existing classical HW modules (TPMv2) based on wrapping classical attestation quotes over PQC algorithms and its application into IPsec. |
| KER8 | PQC/QKD Hybridization Module | An interface between the QKD module and the agent that hybridizes quantum-distributed key, PQ key and classical key, such that the resulting hybrid key remains secure provided that at least one of the component keys remains secure. The hybridization module obtains the component key through PQ/classical algorithms and standardized interfaces such as ETSI GS QKD 004, it performs the hybridization, and it delivers the hybrid cryptographic material to the agent through ETSI GS QKD 004. |
| KER9 | PQ Container | A Fedora OS-based container that provides a setup suitable for PQ experiments. |
| KER10 | PQ Firefox/NSS | Upstream Firefox and NSS have some design limits that hinder broader cryptographic agility when compared to the QUBIP solution for OpenSSL-based stacks. This KER explores least-invasive code changes in Firefox and its vendored fork of NSS, to increase the overall cryptographic agility, specifically in the context of PQ/T Hybrid (or Composite) mechanisms. |
| KER11 | PQ and PQ/T hybrid VC | An Self-Sovereign Identity (SSI) framework for issuing, holding/presenting and verifying PQ and PQ/T hybrid Verifiable Credentials (VCs) with W3C standard data model. The framework supports did:web, did:jwk, and the new did:compositejwk methods until the release of a first PQ Verifiable Data Registry (VDR). |
| KER12 | PQ Anonymous Credentials | PQ Zero-Knowledge (ZP) algorithm implementation for issuing, holding/presenting and verifying PQ ZK Verifiable Credentials (VCs) with selective disclosure of identity attributes. The proofs are encoded in JSON Web Proof (JWP) format. |
| KER13 | Identity Wallet | Identity Wallet, developed as an extension of Mozilla Firefox browser, to handle Traditional, PQ, PQ/T hybrid, and ZK Verifiable Credentials (VCs). |
| KER14 | PQ fTPM | PQ fTPM running as a Trusted Application (TA) in OP-TEE. |
| KER15 | PQ Remote Attestation Framework | Keylime Verifier enhanced with PQ algorithms to support the verification of the signature on the PQ quote provided by the Attester (i.e., the Keylime agent). In MPU-based IoT device the quote is provided by the PQ fTPM, while in CCIPS the quote is generated and signed (with ECDSA) by the physical TPM and then wrapped with a PQ signature before being sent to the Verifier. |
| KER16 | PQC Transition Process | A set of practical guidelines for EU agencies and industries to manage the transition to PQC. A summary of a reference and replicable transition to PQC process. |
However, despite their potential, many KERs fail to transition from the research phase to practical implementation. This raises an important question: how can researchers and institutions effectively disseminate KERs and attract industrial interest to ensure their successful adoption and commercialization?
The first step in this process is to clearly define what constitutes a KER. In the context of research and development, not all outcomes hold the same commercial potential, understanding that KERs are those results that have demonstrated clear applicability to real-world industrial challenges. These may include technological innovations, novel methodologies, or findings that address critical industry needs.
However, identifying KERs is only the initial phase. The subsequent challenge lies in effectively communicating their value to industrial stakeholders. Researchers and developers must present KERs in a manner that highlights their practical benefits while avoiding overly technical language that may alienate potential industry partners. Executive summaries and technical reports are essential tools in this regard, emphasizing how the results can address specific industry challenges.
Visual aids and case studies further enhance the communication of KERs. Case studies, in particular, are invaluable for demonstrating the real-world application of research outcomes. By showcasing how a KER has been successfully implemented in an industrial setting, researchers can help stakeholders visualize the potential benefits for their own operations. Prototypes also play a crucial role, as they provide tangible evidence of the innovation’s feasibility and effectiveness, making it easier for industry leaders to commit to its adoption.
Once the KERs have been effectively packaged, the next step is dissemination through appropriate channels. Academic and industry-specific journals remain a traditional yet effective means of reaching a broad audience. While academic journals provide peer validation, industry journals often target a more specialized readership, including engineers, manufacturers, and executives. Conferences and workshops also offer valuable platforms for presenting KERs directly to industry professionals. These events facilitate direct engagement, enabling researchers to connect with potential collaborators, investors, and early adopters.
In the digital age, online platforms and social media have emerged as powerful tools for disseminating research outcomes. Webinars, blogs, and industry-specific forums provide dynamic platforms for promoting KERs, while professional networks such as LinkedIn and research platforms like ResearchGate enable researchers to reach a global audience. Establishing a digital presence for KERs not only increases visibility but also fosters ongoing dialogue with industry stakeholders, which is essential for refining and scaling innovations.
Collaboration with the industrial sector is perhaps the most critical factor in ensuring the successful commercialization of KERs. Strategic partnerships, such as licensing agreements or joint ventures, provide pathways for integrating KERs into industrial operations. Licensing allows companies to utilize new technologies in exchange for royalties, while joint ventures enable shared risk and reward in product development. Innovation hubs and incubators also play a pivotal role by providing resources, mentorship, and funding to bring KERs closer to market readiness. Pilot projects and industry partnerships further enhance the potential for KERs adoption. By collaborating with key industry players, researchers can test and refine their innovations in real-world settings, gaining valuable insights and building credibility. These partnerships not only increase the likelihood of successful commercialization but also contribute to the development of a robust innovation ecosystem.
However, the process does not end with dissemination and collaboration. Continuous monitoring and evaluation are essential to assess the impact of KERs and refine dissemination strategies. Researchers must gather feedback from industry stakeholders to determine whether the KERs have been adopted, whether they have addressed specific industry challenges, and whether they have generated economic or operational benefits. If uptake is limited, this may indicate a need for improved communication, further refinement of the KERs, or the identification of more suitable industry partners.
Particularly, as part of its mission to facilitate the transition to post-quantum security, the QUBIP project is dedicated to developing and promoting KERs that will drive innovation in the quantum-secure technologies of the future. These results span a wide range of solutions, from quantum-secure elements and cryptographic protocols to software and IoT devices, all designed to enable a smooth transition to Post-Quantum Cryptography (PQC), see in Table 1. In addition to the development of these KERs, QUBIP has actively engaged in dissemination and exploitation efforts, including collaboration with the Horizon Results Booster to enhance the project’s commercialization potential. Through strategic guidance, market analysis, and the identification of industry opportunities, QUBIP is working to ensure that these KERs are not only disseminated within the scientific and industrial communities but also positioned for real-world adoption and use, providing significant competitive advantages to early adopters in various sectors.
