The Endorsement Key Dilemma: Overcoming eFuse Exhaustion and Remote Attestation Failure in Post-Quantum HSMs

Enterprise security engineering teams have mobilized massive resources to migrate transport layers and application data to post-quantum standards like ML-KEM and ML-DSA. Yet within data centers and sovereign cloud enclaves, an unadvertised physical crisis is quietly brewing inside the physical silicon root of trust. While operational cryptographic operations - such as TLS termination and database field encryption - can dynamically reallocate high-level system memory to accommodate bloated lattice keys, the underlying Hardware Security Modules (HSMs) are bound by immutable physical constraints at their silicon foundation: One-Time Programmable (OTP) eFuses.

For decades, hardware manufacturers provisioned secure microcontrollers and cryptographic co-processors with minuscule eFuse arrays - typically between 2,048 and 4,096 bits. This microscopic silicon footprint was more than adequate to physically blow the microscopic polysilicon links for a 384-bit ECDSA or 512-byte RSA Hardware Endorsement Key (HEK). However, establishing verifiable, quantum-resistant Zero Trust remote attestation requires burning Module-Lattice-Based Digital Signature Algorithm (ML-DSA) public keys and identity proofs directly into physical hardware. At up to 20,736 bits for an ML-DSA-87 public key, the geometry of post-quantum parameters instantly exhausts legacy eFuse arrays, threatening to invalidate enterprise hardware attestation pipelines globally.

⚡ Executive Briefing & Core Takeaways - The Physical Silicon Bottleneck: Enterprise Zero Trust architectures rely on HSM Hardware Endorsement Keys (HEKs) to authenticate physical module provenance. Migrating HEKs to FIPS 204 (ML-DSA) triggers an immediate 5x to 10x bit-density deficit against legacy 4 Kb OTP eFuse allocations. - The Attestation Downgrade Vulnerability: Retaining legacy classical endorsement roots while executing post-quantum workloads inside the HSM exposes cluster orchestrators to quantum identity forgery, enabling adversaries to spoof physical enclave boundaries. - The Next-Gen Silicon Path: Mitigating eFuse exhaustion demands transitioning from monolithic raw key burning to Hierarchical Asymmetric Root Seeds (HARS), compact Hash-Based attestation anchors (SLH-DSA), and DICE-derived Compound Device Identifiers (CDI).

The Zero Trust Identity Chain Meets Silicon Reality

In a rigorous Zero Trust infrastructure, a cryptographic workload never trusts an HSM simply because it answers on an internal PCIe bus or a high-bandwidth network interface. Trust is explicitly negotiated through cryptographic Remote Attestation.

Before a cloud orchestrator dispatches multi-tenant keys or sensitive operational certificates to an HSM partition, the host demands a cryptographically signed attestation report. The module proves three properties:

1. Its physical identity originates from a certified, tamper-resistant silicon fabrication batch.
2. Its microcode and firmware measurements match an immutable cryptographic manifest.
3. The cryptographic core has not booted into an unauthorized debugging or fault-injected state.

+-------------------------------------------------------------------+
|               ZERO TRUST ATTESTATION PIPELINE                     |
+-------------------------------------------------------------------+
                                                                     
 [ Physical Silicon Layer ]                                          
      │                                                              
      ├──> OTP eFuse Array (Static Physical Root)                   
      │     └── Contains: Hardware Endorsement Public Key (HEK)      
      │                                                              
      ▼                                                              
 [ DICE / Hardware Identity Engine ]                                
      │                                                              
      ├──> Derives: Compound Device Identifier (CDI)                 
      │                                                              
      ▼                                                              
 [ Firmware Attestation Logic ]                                      
      │                                                              
      ├──> Signs: Hardware Manifest + Running Firmware PCRs         
      │                                                              
      ▼                                                              
 [ Cloud / Cluster Orchestrator ]                                    
      │                                                              
      └──> Cryptographic Verification: Validates Physical Provenance 
           Before Dispatching Sensitive Workloads                    

This trust chain anchors to the Hardware Endorsement Key (HEK), burned permanently into the module's OTP eFuse bank during wafer sort or final packaging. When using classical elliptic curve cryptography (such as NIST P-384), the public key requires exactly 768 bits of storage, easily coexisting with serial numbers, revision flags, and cryptographic configuration bits inside a standard 4,096-bit eFuse macro.

Under post-quantum mandates, classical endorsement signatures can be forged by a sufficiently advanced quantum computer using Shor's algorithm. If an adversary compromises the endorsement chain, they can synthesize arbitrary attestation reports, effectively masquerading commodity virtualized infrastructure or compromised hardware as hardened FIPS 140-3 Level 4 HSMs.

The Geometry of eFuse Exhaustion

The mathematical mechanics of lattice-based cryptography introduce an irreconcilable sizing problem for legacy semiconductor floorplans. Unlike elliptic curves, where points exist over compact prime fields, ML-DSA operates over high-degree polynomial rings:

$\mathcal{R}_q = \mathbb{Z}_q[X] / (X^{256} + 1)$

The resulting public keys represent vectors of polynomials with coefficients modulo $q = 8380417$. Even at the lowest security parameter (ML-DSA-44), the serialized public key expands to 1,312 bytes (10,496 bits). At NIST Security Level 5 (ML-DSA-87), the public key reaches 2,592 bytes (20,736 bits).

+-----------------------------------------------------------------------+
|          SILICON eFUSE CAPACITY VS. PUBLIC KEY STORAGE                |
+-----------------------------------------------------------------------+
                                                                         
 Legacy 4-Kb eFuse Macro:                                                
 [████████████████████] (4,096 Bits Max Capacity)                        
                                                                         
 ECDSA P-384:                                                            
 [████] (768 Bits) ──> Consumes ~18.7% of Array                          
                                                                         
 ML-DSA-44:                                                              
 [████████████████████████████████████████████████████] (10,496 Bits)    
 ──> EXCEEDS ALLOCATION BY 2.56x                                         
                                                                         
 ML-DSA-87:                                                              
 [████████████████████████████████████████████████████████████████████]  
 (20,736 Bits) ──> EXCEEDS ALLOCATION BY 5.06x                           

Attempting to scale physical eFuse arrays directly creates harsh microelectronic trade-offs: - Die Area Penalties: eFuses are notoriously area-inefficient compared to standard SRAM or Flash cells. They require dedicated high-voltage programming charge pumps, robust blow-current transistors, and guard-rings to isolate thermal blowout during programming. Scaling from 4 Kb to 32 Kb consumes disproportionate silicon area on high-security ASIC dies. - Reliability and Blow Failure Rates: Programming an eFuse is a physical electromigration event. As the total fuse count increases into tens of thousands of bits, the probability of an incomplete or high-resistance link failure during programming rises exponentially, drastically reducing wafer yield during factory provisioning.

Architectural Comparison: Hardware Roots of Trust

To prevent attestation collapse during the post-quantum transition, hardware architects must evaluate alternative cryptographic endorsement structures against stringent physical limits:

The Seed-Derived Enclave Architecture

Rather than burning massive, raw lattice polynomial arrays into oversized physical eFuse blocks, next-generation HSM designs are embracing a Hierarchical Asymmetric Root Seed (HARS) model anchored in Device Identifier Composition Engine (DICE) principles.

Instead of burning an instantiated public key:

1. The manufacturing fixture blows an ultra-compact, high-entropy 256-bit or 512-bit physical secret seed ($S_{root}$) into the existing 4 Kb eFuse array.
2. During cold hardware initialization, an on-chip, write-locked Cryptographic Key Derivation Function (CKDF) - implemented purely in hardwired logic - expands $S_{root}$ with an immutable manufacturing identity string.
3. The derived material forms the private seed for an on-chip ML-DSA key generator, which synthesizes the module's Endorsement Keypair inside internal volatile registers during boot.

       +---------------------------------------------+
       |   4 Kb Physical OTP eFuse (Silicon Root)    |
       |        [ 512-bit Root Seed (S_root) ]       |
       +---------------------------------------------+
                              │
                              ▼
       +---------------------------------------------+
       |   Hardwired Hardware Security Core (CKDF)   |
       |    Mixes: S_root + Silicon ID + HW Version  |
       +---------------------------------------------+
                              │
                              ▼
       +---------------------------------------------+
       |  Internal SRAM Registers (Write-Protected)  |
       |    ML-DSA-65 Keypair Deterministically Gen  |
       |  Public Key: 1,952 B  |  Private Key: Resides|
       |                       |  Behind Memory Gate |
       +---------------------------------------------+
                              │
                              ▼
       +---------------------------------------------+
       |   Out-of-Band Attestation Report to Cloud   |
       +---------------------------------------------+

Because the generation is deterministic, the public key remains perfectly invariant across system resets, thermal events, and power cycles. Crucially, it never requires more than 512 bits of permanent eFuse real estate. The resulting Endorsement Key achieves full NIST Level 3 post-quantum survivability while preserving legacy silicon manufacturing constraints.

Architectural Verdict

Zero Trust architectures are fundamentally only as resilient as the hardware that measures and attests them. Enterprise security leaders must look beyond high-level application migration and scrutinize the silicon endorsement mechanisms powering their physical and cloud-hosted HSM fleets.

1. Audit Attestation Topologies: Demand verification from HSM vendors on whether their hardware attestation chains utilize native post-quantum signatures or remain anchored to classical ECDSA/RSA endorsement keys.
2. Reject Monolithic eFuse Key Storage: Mandate that next-generation silicon designs utilize deterministic root seed derivations (HARS/DICE architectures) rather than expanded, volatile OTP arrays that compromise yield and reliability.
3. Plan for Attestation Payload Bloat: Prepare orchestration networks and Zero Trust policy engines for larger attestation tokens. While seed derivation solves the silicon storage bottleneck, the resulting network-level attestation certificates will still bear the multi-kilobyte overhead of lattice signatures.

Without addressing the endorsement root, enterprise post-quantum strategies risk constructing an advanced lattice fortress directly atop a fragile classical foundation.