Diploma in Applied Cryptography and Anti-rollback
Online postgraduate diploma of 800 hours in applied cryptography and anti-rollback. 8 modules covering cryptographic primitives, embedded cryptography, key management and PKI, firmware signing, anti-rollback protection, implementation attacks and post-quantum cryptography with FIPS 140-3, FIPS 186-5 and NIST SP 800-57, with an assigned technical tutor.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Select cryptographic primitives suited to each security requirement.
Implement efficient cryptography on embedded devices.
Manage keys and certificates throughout their life cycle.
Sign and verify firmware images at boot.
Design anti-rollback mechanisms with secure counters.
Assess implementations against side-channel and fault attacks.
Plan the migration to post-quantum cryptography.
Who it's for
- Cryptographic engineers implementing algorithms in products.
- Secure firmware engineers responsible for bootloaders and updates.
- Product security architects defining key management and signing schemes.
- Hardware security analysts working on side-channel and fault attacks.
- PKI engineers managing device certificates.
- Product security evaluators preparing for FIPS 140-3 or similar evaluations.
- Engineering or science graduates looking to enter the semiconductor sector.
What you'll work with
- FIPS 140-3 (security requirements for cryptographic modules)
- FIPS 186-5 (digital signature standard)
- NIST SP 800-57 Part 1 Rev. 5 (key management recommendations)
- NIST SP 800-90A Rev. 1 (deterministic random bit generators)
- FIPS 203 (ML-KEM) (post-quantum key encapsulation)
- FIPS 204 (ML-DSA) (post-quantum digital signatures)
- NIST SP 800-208 (stateful hash-based signatures, LMS and XMSS)
- IETF RFC 9019 (firmware update architecture for IoT, SUIT)
- OpenSSL
- Mbed TLS
- wolfSSL
- MCUboot
- ChipWhisperer
8 modules
1.1AES encryption and GCM, CTR and CBC modes1.2SHA-2 and SHA-3 hash functions1.3MAC codes: HMAC and CMAC1.4Elliptic curves: ECDSA and Ed255191.5RSA with PSS and OAEP padding1.6ECDH and X25519 key exchange1.7Key derivation with HKDF1.8Random number generators and entropy1.9Security levels and key sizes1.10Lab: signing and verification with Mbed TLS
2.1Mbed TLS, wolfSSL and OpenSSL libraries2.2Hardware cryptographic accelerators2.3Performance and memory footprint2.4Key storage in flash and OTP2.5PSA Crypto APIs2.6Constant-time implementation2.7Module validation according to FIPS 140-32.8Common implementation errors2.9Testing with NIST vectors2.10Practical exercise: hardware-accelerated AES-GCM
3.1Life cycle according to NIST SP 800-573.2Key hierarchies and KEKs3.3Public key infrastructure for devices3.4X.509 certificates and chains3.5Key rotation and revocation3.6HSMs and cloud signing3.7Key ceremonies3.8Key separation by function3.9Protection of firmware signing keys3.10Workshop: manufacturing PKI with OpenSSL
4.1Signed image formats4.2MCUboot and its image format4.3ECDSA P-256 and Ed25519 signatures at boot4.4SUIT manifests according to RFC 90194.5Firmware image encryption4.6Incremental and block-based verification4.7Hash-based signatures: LMS and XMSS4.8Chaining trust between stages4.9Integration into the build pipeline4.10Lab: signed boot with MCUboot
5.1Version downgrade attacks5.2Hardware monotonic counters5.3Security version number (SVN)5.4OTP fuses and their exhaustion5.5TPM counters and eMMC RPMB5.6Anti-rollback in MCUboot and TF-A5.7Management of minimum allowed versions5.8Recovery without opening gaps5.9Compatibility with A/B updates5.10Practical exercise: anti-rollback with a security counter
6.1Simple and differential power analysis6.2Timing attacks6.3Fault injection by glitching6.4Countermeasures: masking and hiding6.5Redundant checks at boot6.6Assessment with ChipWhisperer6.7Attacks on random number generators6.8Cache leakage in processors6.9Certification against physical attacks6.10Workshop: DPA attack on AES in the lab
7.1The quantum threat and Shor's algorithm7.2ML-KEM according to FIPS 2037.3ML-DSA according to FIPS 2047.4SLH-DSA according to FIPS 2057.5Impact on embedded memory and performance7.6Hybrid transition schemes7.7Cryptographic agility in firmware7.8Cryptographic inventory of products7.9Migration planning7.10Case study: post-quantum migration of a bootloader
8.1Requirements and threat model8.2Selection of algorithms and libraries8.3Key management scheme8.4Firmware signing and encryption8.5Product anti-rollback mechanism8.6Testing and validation vectors8.7Assessment against physical attacks8.8Cryptographic agility plan8.9Report and presentation8.10Final project: final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: you progress at your own pace within the intake, so it can be combined with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is OpenSSL, Mbed TLS, wolfSSL, MCUboot and ChipWhisperer, in free, academic or evaluation versions. Testing is studied on real procedures: signing and verification of firmware images, side-channel analysis in the lab and validation with NIST test vectors. Assessment is continuous by module plus the final project.
Standards covered: FIPS 140-3, FIPS 186-5, NIST SP 800-57 Part 1 Rev. 5, NIST SP 800-90A Rev. 1, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), NIST SP 800-208, IETF RFC 9019.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer able to run the programme software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours over 6–8 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with OpenSSL, Mbed TLS, wolfSSL, MCUboot and ChipWhisperer, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.
Prior technical training or professional experience in the sector (no university degree required), a computer able to run the software and English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Postgraduate Diploma in User Antennas and Pointing
Online 800 h Postgraduate Diploma in User Antennas and Pointing. 8 modules covering ITU-R S.580, ITU-R S.465 and TICRA GRASP. Assigned tutor and open enrolment.
Postgraduate Diploma in Continuous Modelling and Simulation
Online 800-hour postgraduate diploma in Continuous Modelling and Simulation. 8 modules with Modelica Language Specification 3.6, FMI 3.0 (Modelica Association) and MATLAB/Simulink. Assigned tutor and open…
Postgraduate Diploma in Safe Architectures and HAZOP/LOPA
800-hour online Postgraduate Diploma in Safe Architectures and HAZOP/LOPA. 8 modules covering IEC 61882, IEC 61511-1 and Sphera PHA-Pro. Assigned tutor and enrolment open.
More in Electronics, Embedded Systems & Telecom
All Electronics, Embedded Systems & Telecom programmes → · How to apply · Fees & financing · Scholarships