Skip to content

Technology

A lock small enough for every device.

Billions of small connected machines now do real work, from water meters to factory sensors. The smallest are too small for the security that protects the rest of the internet. SLiM is a lock built to fit them, and built in by the manufacturers who make them.

See how it worksInvestor relations
ANY NETWORKSomeone listeningWHAT THEY SEEJ$!B#M% Q#G%WK2.31 barJ$!B#M%2.31 barJ$!B#M%2.31 barJ$!B#M%fakeYour deviceYour server1 Locked here2 Unreadable on the way3 Checked here
An illustration of the idea, not real traffic.

01The problem

The usual security doesn’t fit.

Phones and computers make secure connections with a system called TLS. A small device has about 100 KB of room for all its code, and TLS can take a fifth of that room, or all of it.

With the usual lock (TLS)

20 to 100 KB

A fifth of the device’s code space, up to all of it

With SLiM

About 10.5 KB

About a tenth of the device’s code space

It is like asking a wristwatch to run a laptop’s software.

That can leave device makers choosing between protecting the device and building the product. Standard encryption on its own, called AES, does fit on these chips. But AES on its own only scrambles. A device also needs its keys delivered safely and a way to spot fakes. TLS provides that, and TLS is what does not fit. SLiM brings all three in about 10 KB.

Drawn for a typical small device, using the definitions of the IETF, the body that sets internet engineering standards (RFC 7228). TLS: the published size range of an embedded TLS library (wolfSSL). SLiM: AgilePQ’s 2021 measurements, about 2 KB for the basic version and 10.5 KB with everything included.

02How it works

Key it. Lock it. Check it.

SLiM protects every message a device sends, in three simple moves.

  1. 1In advance

    Key it.

    Every device is given its own secret key in advance, like a house key cut for one door. A key server hands the keys out.

    Why it matters: Each device has a different key, so a key copied from one is no use on the others.

  2. 2Every message

    Lock it.

    Each message is scrambled on the device before it leaves. The lock changes with every message, so no two are locked the same way.

    Why it matters: Anyone listening on the network sees only nonsense.

  3. 3On arrival

    Check it.

    Each message carries a check, built to catch a message that was changed or faked on the way. The server throws out any message that fails it.

    Why it matters: Fake or altered data is meant to be stopped before the systems that act on it can use it.

03Different by design

Not AES. Not TLS. No handshake.

Most encryption on the internet starts with two machines negotiating a secret in the open. SLiM does not negotiate. The keys are already there.

TLSAES on its ownSLiM
How keys are set upA public-key handshake across the networkNot covered: keys must reach the device some other wayDelivered in advance by a key server. Nothing is negotiated on the network
CertificatesYesNot coveredNone
Keys per deviceAgreed per sessionUp to the designerEach device its own, from the production line, plus fresh session keys
Lock changesPer sessionDepends on the modeWith every packet
Tamper checkYesOnly in authenticated modes, such as GCM or CCMOn every packet, in 2 to 10 bytes
Data to start a session2,728 to 3,478 bytes (TLS 1.2, as AgilePQ measured it)Not covered376 bytes
Code size20 to 100 kBSmallAbout 2 KB; about 10.5 KB with everything
Public-key step for a quantum computerYes, the handshakeNone in the cipherNone

TLS and AES columns describe the standards in general. SLiM figures are AgilePQ’s own measurements and documents.

Nothing to intercept

No key is agreed on the network, so there is no exchange to attack, downgrade or record for a future quantum computer.

One device, one key

Each device carries its own key from the production line, so a key copied from one device opens no other.

No repeat, no replay

The lock changes with every packet. The same reading never looks the same twice, and a recorded packet cannot simply be sent again.

These are properties of SLiM’s design. Like any cipher, SLiM earns trust through outside review. An early version of the design was reviewed on paper in 2016, and no feasible attack was found; no independent review of today’s SLiM has been published.

04Try it

Be the hacker. See what happens.

Type a message. Watch it get locked before it leaves the device. Then try to change it on the way.

  1. Type anything. It stands for a reading a device sends, such as a tank level.
  2. Look at row 3. That is all anyone listening would get.
  3. Press “Let a hacker change it”. The check at the other end catches it.
Message 0001
1 · The messagewhat the device wants to say
2 · Its keysecret, and new for every message
3 · What travelsscrambled: anyone listening sees only this
4 · The check

Unlocked on arrival: “Tank 4: 2.31 bar”

An illustration made in your browser. It shows the idea, not SLiM’s algorithm, and it protects nothing.

05What it saves

Small, fast and light on energy.

AgilePQ tested SLiM on real chips against AES, today’s standard encryption, and against TLS, the usual way to set up a secure connection. AES-256 is AES at its stronger setting.

Speed

Twice as fast as software AES, in AgilePQ’s tests.

Time to lock the same message on a small, slow chip. Shorter is better.

Worked out from AgilePQ’s 2021 speed tests on a 16 MHz chip, with AES running as software. Many chips also have AES built into their hardware; these tests did not compare against that.

Energy

A third to half the energy.

Energy SLiM used for the same work, if AES used 100.

Against AES-128

Against AES-256

AgilePQ’s 2019 tests on two different boards, so each bar is its own comparison.

Data

7 to 9 times less data to connect.

Data sent back and forth to start one secure connection. Each square is 100 bytes.

AgilePQ’s 2021 tests, against TLS 1.2 using certificates, as websites do. TLS also has a lighter mode with shared keys, which these tests did not measure.
  • Room for the product. SLiM with everything included takes about a tenth of a small device’s code space.
  • Less energy per message. Energy not spent on locking is left for the device’s real work.
  • Less data to send. On cellular and satellite links, every byte sent costs money and battery.

06Built for what is next

No public-key handshake for a quantum computer to break.

Most internet security starts with a handshake: two machines agree on a secret out in the open, using math called RSA or elliptic curves. A large enough quantum computer is expected to break that math, and attackers can record traffic today to unlock later.

Most of the internet today

Public-key handshake: the target
The handshake is what a quantum computer would attack. Break it, and recorded messages open.

SLiM

J$!B#MNo public-key handshakeKeys given out in advance
Keys are given out in advance by a key server. There is no public-key handshake on the network to attack.

The old handshakes are being retired

In a draft plan, NIST, the US standards agency, proposes phasing out RSA and elliptic-curve methods.

No public-key handshake

SLiM is symmetric: both ends already share their keys, so there is no public-key exchange to break.

NIST is keeping AES

NIST does not expect to replace AES and its other symmetric standards for the quantum transition. SLiM is symmetric too, but it is not one of those standards, and that statement does not cover it.

No practical cipher, AES or SLiM, can be proven unbreakable. A cipher earns trust when experts can study its design in the open and still cannot break it.

07How it fits

Built in by the manufacturer. On chips devices already use.

SLiM is software, licensed to device manufacturers. They build it into their firmware, key each device on the production line, and run the key server that receives the data. Everything in between carries the locked messages and needs no change.

Key serverHands out keys. Messages never pass through it.
  1. The deviceSLiM is built into its firmware, on the chip it already uses. Messages are locked here.
  2. Any networkCellular, LoRaWAN, satellite, Wi-Fi, Bluetooth. It carries the messages but cannot read them.
  3. The customer’s serverSLiM unlocks and checks every message here.
  4. Their apps and cloudWork as they do today, with their usual security.

Tested on common chips

AgilePQ has run SLiM on chips from Silicon Labs, Texas Instruments, Nordic, Espressif and Dialog.

Over the networks in use

From Bluetooth and Wi-Fi to cellular and satellite links.

On a SIM card, too

AgilePQ has built a prototype that puts SLiM on the SIM card of a cellular device.

08The opportunity

Billions of machines. A lock that fits them.

Connected devices keep multiplying. The smallest of them, the sensors, meters, valves and trackers in the field, are the ones the usual security leaves out.

2025, estimate

21.1 billion

2030, forecast

39 billion

Connected IoT devices worldwide, not counting phones, computers or tablets. One dot is one billion. No published count says how many are too small for TLS.

Big enough for TLS

  • Servers
  • Laptops
  • Phones
  • Routers

Too small to run TLS easily

  • Meters
  • Sensors
  • Valves
  • Trackers

Where SLiM fits

Which machines can run TLS easily, based on the IETF’s definitions for small devices (RFC 7228). The examples are AgilePQ’s.
01Device manufacturersBuild SLiM in once. Every device you ship carries it, into every market you sell to.02GovernmentSecrets with a long shelf life, sent from devices that stay in the field for years.03Network operatorsA fraction of a TLS handshake on links where every byte costs airtime.04Utilities and critical infrastructureMeters, pumps and sensors that outlive the cryptography they shipped with.

09Fair questions

Why not just use what exists?

The questions a careful investor or buyer asks first, answered plainly.

Why not just use AES?

AES is the government standard, and it fits on these chips. But AES on its own only scrambles. A device also needs its keys delivered safely, a fresh lock for each message and a check that spots fakes. SLiM is all of that in about 10 KB, and in AgilePQ’s tests it ran twice as fast as AES in software.

What about Ascon, NIST’s new standard for small devices?

In 2025 NIST approved Ascon for exactly these devices. Ascon locks and checks messages; it does not hand out keys. SLiM’s full system adds a key server that gives every device its own key, so breaking into one device exposes only that device, and it confirms a device is genuine before any data is sent. Where a buyer requires an approved algorithm, Ascon or AES is the answer, and SLiM alone is not. AgilePQ has not published a speed or size comparison of SLiM against Ascon.

What about the IETF’s lightweight handshake?

In 2024 the IETF published EDHOC, a compact handshake for small devices of 101 to 242 bytes, smaller than SLiM’s 376-byte session start. It is still a public-key exchange on the network, the kind a large quantum computer is expected to break, and each device needs a public key or certificate. SLiM has no public-key step at all.

Has anyone outside AgilePQ reviewed it?

An early version of the design was reviewed on paper in 2016 by two university computer scientists, engaged by its developer. They found no feasible attack on its low-power version and noted that no review can prove a cipher secure. No independent review of today’s SLiM has been published yet.

Does it need new hardware?

No. SLiM is software, built into the device’s firmware on chips it already uses, and run on the receiving server.

Who measured these numbers?

AgilePQ did, between 2019 and 2021, on the boards named in the notes. They are the company’s own measurements, not an outside lab’s.

10The record

Built, tested, patented.

SLiM is not an idea on paper. It was announced in 2018, picked as a finalist in a 2019 prototype program run by the Defense Department’s IT agency, measured on real chips, and AgilePQ holds two US patents on its encryption methods.

  1. 2016

    Design reviewed

    An early version of the design reviewed on paper by university computer scientists.

  2. 2018

    Announced

    AgilePQ announced SLiM for the smallest connected devices.

  3. 2019

    DISA finalist

    A finalist in a prototype program run by DISA, the Defense Department’s IT agency.

  4. 2020

    Centri acquired

    AgilePQ acquired Centri, an IoT security company, and its patents.

  5. 2021

    First patent

    US 11,018,854, data conversion systems and methods, assigned to Agile⁠PQ.

  6. 2024

    Second patent

    US 11,924,329, encryption of standalone data packages, assigned to Agile⁠PQ.

What SLiM is not

SLiM is not a government-approved standard.

SLiM is not one of NIST’s approved algorithms, and no AgilePQ product holds a certificate from NIST’s official testing program for encryption products. Where a contract or rule requires approved algorithms, SLiM alone does not meet it.

Where SLiM stands on the rules

For engineers

The engineering detail, on request.

The architecture, the measurements with platform and year, and the packet layout, for the engineers who will judge SLiM. Tell AgilePQ who you are and the page opens.

AgilePQ keeps a record of who asks. Privacy policy.

11Next step

See it for yourself.

Ask AgilePQ for a demonstration, or talk to us about investing.

Ask for a demoInvestor relations

12Sources

Sources and notes29 sources · 16 from AgilePQ’s own records
  1. 1RFC 7228: Class 1 devices “cannot easily talk to other Internet nodes employing a full protocol stack such as using HTTP, Transport Layer Security (TLS), and related security protocols”.IETF RFC 7228, section 3.Sourced
  2. 2AgilePQ licenses SLiM to device manufacturers, who build it into their products and take it into the markets they sell to.AgilePQ management (October 2026).AgilePQ record
  3. 3SLiM is symmetric end to end. A key server gives each device its own keys and issues session keys; the encryption changes with every packet. SLiM uses no RSA or elliptic-curve key exchange.AgilePQ, SLiM Overview v2.4 (April 2021) and SLiM Technical Overview v2.4.9 (January 2024).AgilePQ record
  4. 4RFC 7228 sets Class 0 at much less than 10 KiB of RAM and 100 KiB of code, Class 1 at about 10 KiB and 100 KiB, and Class 2 at about 50 KiB and 250 KiB.IETF RFC 7228, Terminology for Constrained-Node Networks, section 3, Table 1 (May 2014).Sourced
  5. 5wolfSSL describes its embedded TLS library as having a “minimum footprint size of 20-100 kB, depending on build options and operating environment” and “runtime memory usage between 1-36 kB”.wolfSSL product page (vendor’s own figures), accessed October 2026.Sourced
  6. 6AgilePQ measured a compiled size of 2,134 bytes for the standalone SLiM library and 10,522 bytes for the full protocol on the same Arm Cortex-M0 build.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  7. 7On a 16 MHz Arm Cortex-M0 without hardware acceleration AgilePQ measured SLiM at 39,552 B/s against 19,891 B/s for AES-128-CTR, 14,431 B/s for AES-256-CTR and 9,914 B/s for AES-256-CBC: two to four times faster than the software AES in those tests. Speeds of software AES libraries differ from one implementation to another, so the ratio holds for the AES AgilePQ tested.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  8. 8SLiM does not pad data to 16- or 32-byte blocks; per-packet overhead is 2 to 10 bytes depending on mode, including an integrity check. AgilePQ: SLiM “adds a 10-byte header per packet (which includes an integrity check)”.AgilePQ engineering documentation (2021); AgilePQ, SLiM byte savings (23 April 2021).AgilePQ record
  9. 9AgilePQ: “The most common way is to have the device manufacturer provision the device.” Devices are “programmed directly by the manufacturer with a unique device voucher”, which “can be replaced in the field at any time in the future if a device’s keys become compromised.” Devices can also be provisioned in the field by a provisioning server on first power-up.AgilePQ, Cryptography Review (October 2018).AgilePQ record
  10. 10AgilePQ: “Keys are changed with each packet transmitted”; “Encrypted messages are different always, even if the plaintext remains the same”; “Replay of messages is prevented.” Session keys are discarded when the device or server disconnects.AgilePQ, Cryptography Review (October 2018).AgilePQ record
  11. 11AgilePQ measured 376 bytes to set up a SLiM session (44 sent, 332 received), against 2,728 bytes (self-signed certificate) and 3,478 bytes (google.com) for an OpenSSL TLS 1.2 handshake, on a Raspberry Pi 3.AgilePQ engineering benchmarks (April and July 2021).AgilePQ record
  12. 12AgilePQ: with its key server, SLiM gives each device a unique key, so compromising one device compromises only that device, and authenticates a device before any data is sent.AgilePQ, SLiM Technical Overview v2.4.9 (January 2024); AgilePQ engineering note comparing SLiM and Ascon use cases.AgilePQ record
  13. 13In 2016 two university computer scientists, engaged by the developer of the design SLiM grew from, reviewed an early version of that design on paper. They found no feasible attack on its low-power version, and wrote that no review can establish a cipher’s security outright. No independent review of today’s SLiM has been published.Design review, second round (August 2016), in AgilePQ’s records.AgilePQ record
  14. 14AgilePQ measured 68% less energy than AES-128 on an RFduino and 50% less than AES-256 on a Raspberry Pi.AgilePQ testing (2019).AgilePQ record
  15. 15CISA, NSA and NIST: “cyber actors could target our nation’s most sensitive information now and leverage future quantum computing technology”, a threat “particularly devastating to sensitive information with long-term secrecy requirements”.NSA press release on the joint Quantum-Readiness fact sheet (21 August 2023).Sourced
  16. 16NIST’s draft transition plan marks RSA and elliptic-curve algorithms at 112-bit strength “Deprecated after 2030” and quantum-vulnerable public-key algorithms “Disallowed after 2035”. It is still an initial public draft.NIST IR 8547 ipd, Transition to Post-Quantum Cryptography Standards (12 November 2024).Sourced
  17. 17NIST on AES and other symmetric standards: “NIST does not expect to need to transition away from these standards as part of the PQC migration.”NIST IR 8547 ipd (12 November 2024).Sourced
  18. 18Kerckhoffs’s principle: a cipher must not depend on secrecy of the design; it should stay secure if everything except the key falls into an adversary’s hands.A. Kerckhoffs, La cryptographie militaire, Journal des sciences militaires (1883).Sourced
  19. 19AgilePQ has run SLiM as a C library on microcontrollers and modules including Silicon Labs EFR32/EFM32, TI MSP430, CC1310, CC2640 and CC3220, Nordic, Espressif ESP32, Dialog DA14585, Raspberry Pi and Cisco 809/819, over BLE, Wi-Fi, LoRaWAN, Sigfox, NB-IoT, LTE-M, 2G–4G and satellite links.AgilePQ test platform list (2021).AgilePQ record
  20. 20AgilePQ has built a proof of concept delivering SLiM as a Java Card SIM applet.AgilePQ research documentation (2020).AgilePQ record
  21. 21IoT Analytics: connected IoT devices “expected to grow 14% year-over-year to 21.1 billion by the end of 2025” and “estimated to reach 39 billion in 2030”.IoT Analytics, Number of connected IoT devices (28 October 2025).Sourced
  22. 22NIST SP 800-232 standardizes the Ascon family (Ascon-AEAD128, Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128) for constrained devices, “a viable alternative when the Advanced Encryption Standard (AES) may not perform optimally”.NIST SP 800-232, final (13 August 2025).Sourced
  23. 23IETF RFC 9528 (March 2024): EDHOC is “a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys”; its example messages total 101 to 242 bytes. Diffie-Hellman over elliptic curves is a public-key method.IETF RFC 9528, Ephemeral Diffie-Hellman Over COSE (EDHOC).Sourced
  24. 24AgilePQ announced SLiM, data-in-transit security for constrained IoT endpoints, on 27 September 2018.AgilePQ press release, GlobeNewswire.Sourced
  25. 25AgilePQ was a finalist in the US Defense Information Systems Agency’s Phase II evaluation of quantum-resistant cryptography prototypes (2019).AgilePQ records (DISA Phase II oral presentation, 12 September 2019).AgilePQ record
  26. 26AgilePQ announced its acquisition of Centri, an IoT security company, on 11 March 2020.AgilePQ press release (11 March 2020, agilepq.com archive).AgilePQ record
  27. 27US patents 11,018,854 (Data conversion systems and methods, granted 25 May 2021) and 11,924,329 (Encryption of standalone data packages, granted 5 March 2024) are assigned to AgilePQ.Google Patents assignment records (accessed 14 October 2026).AgilePQ record
  28. 28NIST’s list of security functions approved for validated modules names, under “Block Cipher”, the “Advanced Encryption Standard (AES)”; “three-key Triple-DES is only approved for decryption, unwrapping or CMAC verification for legacy use”. Its change log for 2 September 2025 reads “Added: SP 800-232 (Ascon)”. SLiM is not on the list.NIST CMVP, SP 800-140C: Approved Security Functions, section 6.2 and change log (page updated 21 August 2026).Sourced
  29. 29A search of NIST’s validated-modules list for the vendor “AgilePQ” returns “No certificates match the search criteria” on the active, historical and revoked lists.NIST CMVP, Validated Modules search (searched 14 October 2026).Sourced