Ohio University's Das, Agendia, Adjei and Oun Cut Post-Quantum Attestation Cost for OpenPLC Controllers 90-Fold With Checkpointed ML-DSA Signing, arXiv 2611.07476, 5 November 2026: TRL 4

Rishabh Das, Gerald Agendia, Jibriel Adjei and Ahmed Oun of Ohio University posted AMORT-V1 to arXiv on 5 November 2026, a post-quantum attestation protocol for programmable logic controllers that moves ML-DSA signing and the durable write from every report to a periodic checkpoint over a Merkle tree, with a device-held disclosure chain for transferable device-origin proof. On a seven-node Raspberry Pi 5 testbed with five physical OpenPLC provers the controller's cost per report falls 90 times without a durable log and 878 times with one, origin verification costs 2.95 microseconds, and 210,000 control-scan cycles miss no 10 millisecond deadline. This post reads the paper as defensive roots of trust in hardware capability in the post-quantum cryptography pillar, explains why a laboratory testbed with real controller software sits at TRL 4, sets it beside FIPS 204, the CISA, NSA and NIST quantum-readiness factsheet and the TPM 2.0 library specification, and lists the full-image measurement bottleneck, the threat-model edge and the vendor-controller port a program office should wait for.