What a Post-Quantum Blockchain Cannot Fix at the Grid Edge
A few weeks ago I was reading through a batch of CISA ICS advisories that landed on the same day, and a pattern caught my attention. On June 4, 2026, five advisories went out at once. A buffer overflow in Hitachi Energy MACH HiDraw that can reach arbitrary code execution. Availability faults in the RTU500 line. An OPC-UA server in a B&R PPT30 operating system that an attacker can make simply disappear. A SOAP method in a NAVTOR NavBox that a local attacker can reach without authorization. None of these are exotic. They are the ordinary weather of operational technology.
What struck me was the gap between that weather and the conversation happening one layer up. The same week, I was reading a tutorial paper on blockchain as the coordination layer for embodied AI, the kind of world-model robotics that will soon be generating petabytes of sensor data that somebody, somewhere, has to trust for decades. The paper’s thesis is elegant and increasingly common. I want to test it, because I think the popular version of it is wrong in a specific and fixable way.
The claim everyone is repeating
Here is the received wisdom, stated as plainly as I can. A post-quantum blockchain gives embodied AI a trustworthy data economy. Put consensus and quantum-safe signatures under the data, and you get provenance you can rely on, cross-organizational governance you can audit, and incentive-compatible sharing across parties who do not trust each other. The ledger becomes the trust layer for cyber-physical-social systems.
I have a lot of sympathy for this framing. It is the natural reading of the recent arXiv tutorial that ties embodied AI, quantum threat, and distributed ledgers into one story, and the underlying logic is sound as far as it goes. Long-lived verification really does demand crypto-agility. A robot fleet trained on data captured today will be making safety decisions on that data in 2040, and the signatures protecting that provenance must survive an adversary with a cryptographically relevant quantum computer. That much I will defend without reservation.
The problem is the word “trustworthy.” A blockchain can guarantee that a record has not changed since it was written. It can guarantee who wrote it, if the writer’s key is sound. It cannot guarantee that the record was true at the moment of writing. Those are different properties, and the popular framing quietly collapses them into one. The ledger secures the journey of the data. It says nothing about the birth of the data.
Where the framing breaks
Look back at those CISA advisories. Every one of them describes a device that sits below the ledger, at the point where physical reality becomes a number. The RTU is the thing reading current and voltage off a substation bus. The OPC-UA server is the thing publishing machine state to whatever consumes it. The NavBox is the thing a vessel’s systems talk to. These are the witnesses. They are exactly the components that an embodied AI data economy would treat as ground truth.
If an attacker exploits the buffer overflow in MACH HiDraw and achieves code execution, they do not need to break the blockchain. They feed it. They sit at the witness and emit values that are false but perfectly well formed. The ledger receives them, hashes them, signs them with an immaculate ML-DSA signature, and commits them forever. What you have built is a tamper-evident, quantum-resistant, eternally auditable record of a lie. The cryptography did its job flawlessly. That is the danger.
Read that table as an inventory of trust roots, not as a patch list. Three of the four entries are availability or integrity faults at the precise layer the data economy treats as authoritative. A coordination architecture that secures the ledger and assumes the witness is honest has secured the easy half of the problem. The hard half lives in firmware that ships with memory-safety bugs and reaches end-of-support while the data it produced is still being trusted.
Get Shujaatali Badami’s stories in your inbox
Join Medium for free to get updates from this writer.
This is the part the popular framing skips. It treats provenance as a property of the storage layer. Provenance is actually a property of the capture layer, and the storage layer can only preserve whatever quality the capture layer handed it. Garbage in, signed garbage out, and now the garbage is immutable.
The quantum clock starts at capture
The standard way to reason about migration urgency is Mosca’s inequality. Let me write it in the terms that matter here.
The meaning is simple. If the time your data must stay confidential or verifiable, plus the time it takes you to migrate your systems to post-quantum cryptography, is greater than the time until a quantum adversary arrives, you already have a problem today. The harvest-now-decrypt-later attacker is collecting your traffic now to break it later, and for signatures the analogous worry is forge-later, where a captured public-key relationship is broken after the fact to fabricate provenance.
Embodied AI makes the left side of that inequality enormous. A robot’s training corpus and the safety case built on it are not transient. They have to verify for the operational life of the fleet, which is measured in decades. That pushes the shelf-life term up. Meanwhile the migration term for operational technology is brutal, because the witnesses are constrained devices on long replacement cycles, many of which appear in advisories like the ones above precisely because they are old. When both the shelf-life term and the migration term are large, the inequality is satisfied long before the quantum computer is real. The clock that matters started ticking at the moment of capture, not at the moment of consensus.
So the received wisdom is half right in a way that is worse than being simply wrong. It correctly identifies that the cryptography must be quantum-safe. It incorrectly locates where that cryptography has to live. Putting ML-DSA on the validators while the RTU still signs with a classical key, or worse signs nothing and is trusted by position, leaves the longest-lived and most exposed link in the chain unprotected. The CNSA 2.0 timeline that mandates this migration does not exempt the edge. The edge is where the timeline is hardest to meet.
Push the crypto down, not the consensus up
The fix is not a better ledger. It is crypto-agility pushed down to the witness, so that the device which first turns physics into a number is also the device that signs it with a key the quantum era cannot forge. The honest objection is that these devices are tiny. People assume post-quantum signatures are too heavy for an 8-bit microcontroller, and they say so often enough that it has become its own piece of received wisdom.
It is testable, so I tested it. In related work I benchmarked ML-DSA, the FIPS 204 standard, signing on an ATmega328P with 2 KB of SRAM, and measured 136 ms per signature. That is a constrained part by any definition, the kind of microcontroller that sits in a metering node or a simple sensor. A 136 ms signing operation is entirely workable for a device that reports on the order of seconds. The feasibility claim is not aspirational. The primitive runs where it needs to run.
The dotted path in that diagram is the one the popular framing ignores and the one the CISA advisories keep illuminating. If the witness is compromised at the firmware level, signing at capture does not save you either, because the attacker now holds the signing key. That is the real reason memory safety and crypto-agility are the same project, not two adjacent ones. The signature is only as trustworthy as the integrity of the thing holding the private key, which means secure boot, attestation, and timely patching at the edge are preconditions for the ledger to mean anything.
There are worked examples of this intersection done end to end. In a quantum-resilient blockchain design for IoT energy metering I went through the full path, where the metering node signs with a post-quantum primitive at the point of measurement and the ledger settles those signed readings. The lesson from building it was blunt. The ledger was the straightforward part. Getting trustworthy, attestable, quantum-safe signing onto the constrained node at the moment of capture was the part that actually decided whether the system could be believed.
A sharper version of the claim
So where does the data leave the received wisdom. Not discarded. Sharpened. A post-quantum blockchain does not give embodied AI a trustworthy data economy. A post-quantum blockchain preserves, immutably and verifiably, whatever trust the capture layer was able to establish. Trust is manufactured at the witness or it is not manufactured at all. The ledger is the warehouse, not the inspector.
That reframing changes what you fund and what you measure. If you believe the popular version, you invest in consensus, validator security, and on-chain governance, and you treat the edge as someone else’s procurement problem. If you believe the sharper version, you invest first in memory-safe firmware, secure boot, device attestation, and post-quantum signing at the point of capture, and you treat the ledger as the comparatively easy second half. The ISA/IEC 62443 work on industrial security and the post-quantum signature standards are not two separate conversations. The integrity of the witness and the longevity of the signature are the same requirement seen from two ends.
Which brings me back to those five advisories that arrived on one ordinary day in June. Each one names a device that an embodied AI data economy would happily treat as a source of truth, and each one describes a way to make that device lie or fall silent. No blockchain in the world fixes that from above. The honest version of the claim is the one that starts at the bottom of the stack, at the witness reading current off a bus, and only then works its way up to the ledger that will remember whatever that witness said for the next forty years. Get the bottom right and the rest is engineering. Get it wrong and you have built a perfect, permanent, quantum-proof memory of things that were never true.
