Skip to content

Solutions · Device manufacturers

Build it in once. Ship it into every market.

AgilePQ licenses SLiM to device manufacturers. It fits boards that “cannot easily” run TLS: about 1,500 bytes of RAM for the full protocol, in AgilePQ’s measurements. Build it into the firmware, key each device on the production line, and every product you ship carries it.

Schedule a demoSee how it works
9F 3AC1 075E D2RADIOSENSORPOWERRAM · 10 KiBFLASH · 100 KiBSLiMMCUCLASS 1RFC 7228 · CLASS 1 · ~10 KiB RAMU2J1U1

01The model

One integration. Every product, every market.

SLiM goes into a product line once. Every unit that ships carries it, whether it is sold to a utility, a network operator, a government supplier or a factory.

  1. Add the library

    A C library, about 2 KB compiled, on microcontrollers and radios you already use.

  2. Key every device

    On the production line, each unit gets its own key voucher. It can be replaced in the field if a key is ever compromised.

  3. Run the key server

    The SLiM key server checks each device before any data moves and issues fresh session keys.

  4. Ship anywhere

    Cellular, LoRaWAN, Wi-Fi, BLE or satellite: the protection travels with the device into each market.

No handshake to carry

No certificates and no public-key negotiation on the device. Keys are delivered in advance, not agreed on the network.

One device, one key

A key copied from one unit opens no other, so one compromised device stays one device.

A new lock every packet

The same reading never looks the same twice on the wire, and a recorded packet cannot simply be replayed.

SLiM is AgilePQ’s own design, not AES or a NIST-approved algorithm. Where a market’s rules name specific algorithms, those rules apply to the whole product; the next section and the standards page set out where SLiM stands.

02The rules

The rules are written. The EU’s applies in December 2027.

The UK and the EU already apply security rules to connected products. The Cyber Resilience Act applies in full on 11 December 2027, with fines up to €15 million or 2.5% of worldwide turnover.

  1. 29 Apr 2024

    In force

    UK PSTI

    Security requirements for connectable products come into force.

  2. 1 Aug 2025

    In force

    EU Radio Equipment Directive

    Cybersecurity requirements apply to radio equipment, with harmonized standards EN 18031-1, -2 and -3.

  3. 11 Sep 2026

    Applies now

    EU Cyber Resilience Act

    Manufacturers must report actively exploited vulnerabilities.

  4. 11 Dec 2027

    Ahead

    EU Cyber Resilience Act

    Applies in full. Products must protect transmitted data, “such as by encrypting relevant data at rest or in transit by state of the art mechanisms”.

€15million
or 2.5% of worldwide annual turnover, whichever is higher: the Cyber Resilience Act’s top fine for breaching its essential requirements

In the US, NIST’s IoT device baseline includes “the ability to use demonstrably secure cryptographic modules for standardized cryptographic algorithms”.

The pressure is no longer only regulatory. Anthropic warns that small AI models may be months away from copying themselves onto IoT devices, and puts the first remedy with the maker: “Manufacturers can shrink the pool of targets, with regulation acting to coordinate.”

Conformity with these rules is assessed for the whole product. SLiM is one component of a design; AgilePQ does not claim that using it makes a product compliant with the CRA, the RED or the PSTI regulations.

03The memory gap

TLS was not written for a 10 KiB device.

An embedded TLS library needs 20 to 100 kB of flash and 1 to 36 kB of RAM, by its vendor’s own figures. A Class 1 device has about 100 KiB of flash and 10 KiB of RAM.

RFC 7228 CLASS 1 DEVICETLS library: up to 36 kB of RAM, about 3.5 times the deviceRAM · about 10 KiBone cell = 128 bytesSLiM, full protocol: about 1,500 bytesAbout 8.5 KiB left for the productTLS library: 20–100 kB of flash,up to all of itFlash · about 100 KiBone cell = 1 KiBSLiM, full protocol: 10,522 bytesAbout 89.7 KiB left for the productRFC 7228 CLASS 1 DEVICETLS: up to 36 kB of RAMRAM · about 10 KiBone cell = 128 bytesSLiM: about 1,500 bytesAbout 8.5 KiB leftTLS: 20–100 kB of flashFlash · about 100 KiBone cell = 1 KiBSLiM: 10,522 bytesAbout 89.7 KiB left
A Class 1 device: about 10 KiB of RAM and 100 KiB of flash.An embedded TLS library can need several times the RAM and all of the flash.SLiM’s full protocol takes 12 of the 80 RAM cells and about 10 of the 100 flash cells.

Device limits from RFC 7228. TLS library range from wolfSSL’s own figures. SLiM from AgilePQ’s 2021 measurements on a 16 MHz Arm Cortex-M0.

When the library does not fit, the choice is a bigger chip or less security. SLiM is built for the chip already on the board.

04Measured

Less memory. Less time. Less energy.

AgilePQ benchmarked SLiM on a 16 MHz Arm Cortex-M0 without hardware acceleration, against software AES on the same chip.

Throughput, bytes per second, 16 MHz Arm Cortex-M0
  1. SLiM39,552 B/s
  2. AES-128-CTR19,891 B/s
  3. AES-256-CTR14,431 B/s
  4. AES-256-CBC9,914 B/s

Software AES, no hardware acceleration. AgilePQ’s measurements, July 2021.

Device
RFC 7228 Class 1
RAM
~10 KiB (RFC 7228)
SLiM
~1.5 KB
Left for the application
~8.5 KiB
800bytes
of RAM for the SLiM library; about 1,500 for the full protocol
2,134bytes
compiled library; 10,522 bytes for the full protocol
2–4× faster
than the software AES-128 and AES-256 AgilePQ tested on the same core, without hardware acceleration
68% less energy
than AES-128 in AgilePQ’s tests on an RFduino; 50% less than AES-256 on a Raspberry Pi

Benchmarks are AgilePQ’s own engineering measurements (2019–2021), on the platforms named in the notes. Speed is compared with the software AES AgilePQ tested. Chips with AES built into hardware, and other AES libraries, were not part of these tests.

05Integration

A C library for the chips you already use.

AgilePQ has run SLiM as a C library on microcontrollers and modules from several vendors, over the radios connected products ship with.

Your applicationreadings, commandsSLiM · C libraryencrypts and checks each packetNetwork stackBLE · LoRaWAN · NB-IoT · LTE-M · Wi-FiMicrocontrollerthe one already on the board
An illustration of where an encryption library sits in device firmware.

Microcontrollers and modules AgilePQ has run SLiM on

  • Silicon Labs EFR32 / EFM32
  • TI MSP430
  • TI CC1310
  • TI CC2640
  • TI CC3220
  • Nordic
  • Espressif ESP32
  • Dialog DA14585
  • Raspberry Pi
  • Cisco 809 / 819

Links

  • BLE
  • Wi-Fi
  • LoRaWAN
  • Sigfox
  • NB-IoT
  • LTE-M
  • 2G–4G
  • Satellite
39billion
connected IoT devices forecast for 2030, up from an expected 21.1 billion at the end of 2025

06Next step

Send AgilePQ the board.

Microcontroller, RAM, flash, radio, power budget and the markets you ship into. That is enough to scope an integration and a licence.

Schedule a demoTalk to sales

The other markets

02GovernmentSecrets with a long shelf life, sent from devices that stay in the field for years.03Network operatorsA fraction of a TLS handshake on links where every byte costs airtime.04Utilities and critical infrastructureMeters, pumps and sensors that outlive the cryptography they shipped with.

All four markets · How SLiM works

07Sources

Sources and notes20 sources · 10 from AgilePQ’s own records
  1. 1AgilePQ licenses SLiM to device manufacturers, who build it into their products and take it into the markets they sell to.AgilePQ management (October 2026).AgilePQ record
  2. 2RFC 7228: Class 1 devices “cannot easily talk to other Internet nodes employing a full protocol stack such as using HTTP, Transport Layer Security (TLS), and related security protocols”.IETF RFC 7228, section 3.Sourced
  3. 3AgilePQ measured about 800 bytes of RAM for the standalone SLiM library and about 1,500 bytes for the full protocol, on a 16 MHz Arm Cortex-M0 compiled at -O3.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  4. 4AgilePQ: “The most common way is to have the device manufacturer provision the device.” Devices are “programmed directly by the manufacturer with a unique device voucher”, which “can be replaced in the field at any time in the future if a device’s keys become compromised.” Devices can also be provisioned in the field by a provisioning server on first power-up.AgilePQ, Cryptography Review (October 2018).AgilePQ record
  5. 5AgilePQ measured a compiled size of 2,134 bytes for the standalone SLiM library and 10,522 bytes for the full protocol on the same Arm Cortex-M0 build.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  6. 6AgilePQ has run SLiM as a C library on microcontrollers and modules including Silicon Labs EFR32/EFM32, TI MSP430, CC1310, CC2640 and CC3220, Nordic, Espressif ESP32, Dialog DA14585, Raspberry Pi and Cisco 809/819, over BLE, Wi-Fi, LoRaWAN, Sigfox, NB-IoT, LTE-M, 2G–4G and satellite links.AgilePQ test platform list (2021).AgilePQ record
  7. 7SLiM is symmetric end to end. A key server gives each device its own keys and issues session keys; the encryption changes with every packet. SLiM uses no RSA or elliptic-curve key exchange.AgilePQ, SLiM Overview v2.4 (April 2021) and SLiM Technical Overview v2.4.9 (January 2024).AgilePQ record
  8. 8AgilePQ: with its key server, SLiM gives each device a unique key, so compromising one device compromises only that device, and authenticates a device before any data is sent.AgilePQ, SLiM Technical Overview v2.4.9 (January 2024); AgilePQ engineering note comparing SLiM and Ascon use cases.AgilePQ record
  9. 9AgilePQ: “Keys are changed with each packet transmitted”; “Encrypted messages are different always, even if the plaintext remains the same”; “Replay of messages is prevented.” Session keys are discarded when the device or server disconnects.AgilePQ, Cryptography Review (October 2018).AgilePQ record
  10. 10The UK’s Product Security and Telecommunications Infrastructure regulations “come into force on 29th April 2024”.The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007.Sourced
  11. 11The EU Radio Equipment Directive cybersecurity requirements (Delegated Regulation (EU) 2022/30) apply from 1 August 2025, with harmonised standards EN 18031-1, -2 and -3.Commission Implementing Decision (EU) 2025/138 (28 January 2025).Sourced
  12. 12EU Cyber Resilience Act: applies from 11 December 2027, with reporting of actively exploited vulnerabilities from 11 September 2026. Products must “protect the confidentiality of stored, transmitted or otherwise processed data … such as by encrypting relevant data at rest or in transit by state of the art mechanisms”. Fines reach EUR 15 000 000 or 2.5% of worldwide annual turnover, whichever is higher.Regulation (EU) 2024/2847, Article 71(2), Annex I Part I (2)(e), Article 64(2).Sourced
  13. 13NIST’s IoT device baseline includes “the ability to use demonstrably secure cryptographic modules for standardized cryptographic algorithms”.NIST IR 8259A, IoT Device Cybersecurity Capability Core Baseline (May 2020).Sourced
  14. 14Anthropic: “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate” on commercial internet-of-things devices. “If small models improve at their historical rate, they’ll match this capability level by the end of this year.” Home and small-business devices may be the first targets “because they’re connected to the internet and, historically, have had minimal security measures in place.”Anthropic, AI models may be capable of self-replicating without access to a datacenter (12 October 2026).Sourced
  15. 15Anthropic: “Manufacturers can shrink the pool of targets, with regulation acting to coordinate.” “Moving to more secure defaults and raising the baseline for compliance will help harden against both AI and scripted botnets.”Anthropic, AI models may be capable of self-replicating without access to a datacenter (12 October 2026).Sourced
  16. 16wolfSSL describes its embedded TLS library as having a “minimum footprint size of 20-100 kB, depending on build options and operating environment” and “runtime memory usage between 1-36 kB”.wolfSSL product page (vendor’s own figures), accessed October 2026.Sourced
  17. 17RFC 7228 sets Class 0 at much less than 10 KiB of RAM and 100 KiB of code, Class 1 at about 10 KiB and 100 KiB, and Class 2 at about 50 KiB and 250 KiB.IETF RFC 7228, Terminology for Constrained-Node Networks, section 3, Table 1 (May 2014).Sourced
  18. 18On a 16 MHz Arm Cortex-M0 without hardware acceleration AgilePQ measured SLiM at 39,552 B/s against 19,891 B/s for AES-128-CTR, 14,431 B/s for AES-256-CTR and 9,914 B/s for AES-256-CBC: two to four times faster than the software AES in those tests. Speeds of software AES libraries differ from one implementation to another, so the ratio holds for the AES AgilePQ tested.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  19. 19AgilePQ measured 68% less energy than AES-128 on an RFduino and 50% less than AES-256 on a Raspberry Pi.AgilePQ testing (2019).AgilePQ record
  20. 20IoT Analytics: connected IoT devices “expected to grow 14% year-over-year to 21.1 billion by the end of 2025” and “estimated to reach 39 billion in 2030”.IoT Analytics, Number of connected IoT devices (28 October 2025).Sourced