Skip to content

Solutions

Four markets. One weak link.

Governments, network operators and utilities buy for different reasons. Their data crosses the same kind of link, from a device too small for TLS. AgilePQ licenses encryption that fits that device to the manufacturers who build it, so it ships into every market they sell to.

See the four marketsTalk to AgilePQ
SLiMGOVERNMENTDEVICESNETWORKSUTILITIES

01The common thread

Too small for TLS. Trusted with everything.

The IETF says Class 1 devices, with about 10 KiB of RAM, “cannot easily” run TLS. A typical embedded TLS library needs 1 to 36 kB of RAM and 20 to 100 kB of flash.

RAMAREAS TO SCALETLS library: 1–36 kBClass 1 deviceabout 10 KiB1 kBSLiM1.5 KBup to 36 kBFlashAREAS TO SCALETLS library: 20–100 kB, up to all of itClass 1 deviceabout 100 KiB20 kBSLiM10.5 KBDevice memoryRFC 7228, Class 1TLS librarywolfSSL’s own figuresSLiM, full protocolAgilePQ’s measurementsRAMAREAS TO SCALETLS library: 1–36 kBClass 1 deviceabout 10 KiB1 kBSLiM1.5 KBup to 36 kBFlashAREAS TO SCALETLS library: 20–100 kBClass 1 deviceabout 100 KiB20 kBSLiM10.5 KBThe TLS library can need all of the flash.Device memoryRFC 7228, Class 1TLS librarywolfSSL’s own figuresSLiM, full protocolAgilePQ’s measurements
Areas drawn to scale. Device sizes from RFC 7228. TLS library range from wolfSSL’s own figures. SLiM from AgilePQ’s 2021 measurements on a 16 MHz Arm Cortex-M0.

What crosses those links is the same in every market: readings, commands and the keys that protect them. The protocol that secures the web does not fit the device that sends them.

Secure the smallest device, and every market built on it inherits the protection.

02The markets

Different buyers. The same exposure.

What is at stake in each market. The manufacturer builds SLiM in once, and each of these markets receives it in the devices it buys.

01

Device manufacturers

Build SLiM in once. Every device you ship carries it, into every market you sell to.

From December 2027 the EU requires connected products to protect the data they transmit, “such as by encrypting” it. The board may have 10 KiB of RAM.

€15million
or 2.5% of worldwide turnover, whichever is higher: the top fine for breaching the Cyber Resilience Act’s essential requirements

02

Government

Secrets with a long shelf life, sent from devices that stay in the field for years.

Classified data can need protecting for 25 years. Recorded in transit today, it can be read once a large enough quantum computer exists.

25years
how long U.S. classified information can stay classified when its sensitivity requires it

03

Network operators

A fraction of a TLS handshake on links where every byte costs airtime.

On low-power links, security is paid for in airtime. AgilePQ measured a SLiM session setup at 376 bytes, against 2,728 to 3,478 for a TLS 1.2 handshake.

4.5billion
cellular IoT connections at the end of 2025, forecast to reach 7.8 billion in 2031

04

Utilities and critical infrastructure

Meters, pumps and sensors that outlive the cryptography they shipped with.

Meters, pumps and sensors run for years. In 2026 US agencies reported attackers disabling the safety logic of industrial controllers.

~1.3billion
smart electricity meters forecast in Asia-Pacific by 2030, up from 857.6 million in 2024

03One integration

Built in by the manufacturer. Carried into every market.

SLiM is not AES and not TLS. It is symmetric end to end: each device is keyed on the production line, a key server issues fresh session keys, and nothing is negotiated on the network. Every packet travels encrypted, with an integrity check, so a packet changed on the way fails. Nothing in between, such as a modem, router or cell tower, needs SLiM or can read the data.

< 2KB RAM
about 800 bytes for the library, 1,500 for the full protocol
0handshakes
no public-key negotiation on the network: keys are delivered, not negotiated
376bytes
to set up a session, against 2,728–3,478 for TLS 1.2
2–10bytes
of overhead per packet, the integrity check included

Measurements are AgilePQ’s own (2021), on the platforms named in the notes. Speed and energy tests, with their scope, are on the technology page.

What a device maker getsHow SLiM worksTalk to AgilePQ

04Sources

Sources and notes16 sources · 7 from AgilePQ’s own records
  1. 1U.S. classified information is marked for declassification after 10 years, or up to 25 years when its sensitivity requires it.Executive Order 13526, section 1.5(b).Sourced
  2. 2CISA, NSA and NIST: “cyber actors could target our nation’s most sensitive information now and leverage future quantum computing technology”, a threat “particularly devastating to sensitive information with long-term secrecy requirements”.NSA press release on the joint Quantum-Readiness fact sheet (21 August 2023).Sourced
  3. 3EU Cyber Resilience Act: applies from 11 December 2027, with reporting of actively exploited vulnerabilities from 11 September 2026. Products must “protect the confidentiality of stored, transmitted or otherwise processed data … such as by encrypting relevant data at rest or in transit by state of the art mechanisms”. Fines reach EUR 15 000 000 or 2.5% of worldwide annual turnover, whichever is higher.Regulation (EU) 2024/2847, Article 71(2), Annex I Part I (2)(e), Article 64(2).Sourced
  4. 4RFC 7228 sets Class 0 at much less than 10 KiB of RAM and 100 KiB of code, Class 1 at about 10 KiB and 100 KiB, and Class 2 at about 50 KiB and 250 KiB.IETF RFC 7228, Terminology for Constrained-Node Networks, section 3, Table 1 (May 2014).Sourced
  5. 5AgilePQ measured 376 bytes to set up a SLiM session (44 sent, 332 received), against 2,728 bytes (self-signed certificate) and 3,478 bytes (google.com) for an OpenSSL TLS 1.2 handshake, on a Raspberry Pi 3.AgilePQ engineering benchmarks (April and July 2021).AgilePQ record
  6. 6Ericsson: “Total cellular IoT connections reached around 4.5 billion at the end of 2025”, forecast to reach 7.8 billion in 2031.Ericsson Mobility Report, IoT connections outlook (June 2026).Sourced
  7. 7FBI, CISA and partners: attackers manipulated “data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays”; in an update, “the changes disabled critical shutdown and alarm logic … allowing systems to enter unsafe conditions without notifying operators”.Joint advisory AA26-097A (7 April 2026) and its update (22 July 2026).Sourced
  8. 8Berg Insight forecasts smart electricity meters in Asia-Pacific to grow “from 857.6 million in 2024 to nearly 1.3 billion in 2030”.Berg Insight, Smart Metering in Asia-Pacific, product sheet (October 2025).Sourced
  9. 9RFC 7228: Class 1 devices “cannot easily talk to other Internet nodes employing a full protocol stack such as using HTTP, Transport Layer Security (TLS), and related security protocols”.IETF RFC 7228, section 3.Sourced
  10. 10AgilePQ licenses SLiM to device manufacturers, who build it into their products and take it into the markets they sell to.AgilePQ management (October 2026).AgilePQ record
  11. 11wolfSSL describes its embedded TLS library as having a “minimum footprint size of 20-100 kB, depending on build options and operating environment” and “runtime memory usage between 1-36 kB”.wolfSSL product page (vendor’s own figures), accessed October 2026.Sourced
  12. 12AgilePQ measured about 800 bytes of RAM for the standalone SLiM library and about 1,500 bytes for the full protocol, on a 16 MHz Arm Cortex-M0 compiled at -O3.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  13. 13AgilePQ measured a compiled size of 2,134 bytes for the standalone SLiM library and 10,522 bytes for the full protocol on the same Arm Cortex-M0 build.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  14. 14SLiM is symmetric end to end. A key server gives each device its own keys and issues session keys; the encryption changes with every packet. SLiM uses no RSA or elliptic-curve key exchange.AgilePQ, SLiM Overview v2.4 (April 2021) and SLiM Technical Overview v2.4.9 (January 2024).AgilePQ record
  15. 15AgilePQ: “The most common way is to have the device manufacturer provision the device.” Devices are “programmed directly by the manufacturer with a unique device voucher”, which “can be replaced in the field at any time in the future if a device’s keys become compromised.” Devices can also be provisioned in the field by a provisioning server on first power-up.AgilePQ, Cryptography Review (October 2018).AgilePQ record
  16. 16SLiM does not pad data to 16- or 32-byte blocks; per-packet overhead is 2 to 10 bytes depending on mode, including an integrity check. AgilePQ: SLiM “adds a 10-byte header per packet (which includes an integrity check)”.AgilePQ engineering documentation (2021); AgilePQ, SLiM byte savings (23 April 2021).AgilePQ record