Post-Quantum Authentication for Internet of Medical Things Devices: Sutradhar and Venkatesh's Lattice-Signature Prototype of 3 October 2026 and the Gap to NIST FIPS 204
Post-quantum signatures for medical device reports
Quentir Medicine Monitor
Evidence-based insights for quantum medicine.
A heart-rate reading from a wearable patch or a bedside monitor only helps a clinician if it really came from that patient's device and arrived unchanged. Hospitals already depend on digital signatures for that assurance, and most of those signatures rest on mathematics that a large quantum computer is expected to break.
Two computer scientists in India have posted a prototype that addresses this problem for the Internet of Medical Things, the growing population of connected wearables, bedside monitors and telemedicine devices. Kartick Sutradhar of the Indian Institute of Information Technology Sri City and Ranjitha Venkatesh of GITAM University Bengaluru describe a scheme for post-quantum authentication of medical device reports in arXiv preprint 2610.04661, posted on 3 October 2026. Its most practical feature is batch verification: a hospital gateway checks the signatures of many incoming reports in one vectorized step instead of one by one.
For a chief information security officer, a biomedical engineering lead or a procurement team writing device requirements, the paper gives a clear picture of what a quantum-resistant telemetry chain has to do, and it shows how much work remains between a laboratory prototype and a device a hospital could buy.
The design has three parts. First, each patient device packages its readings, such as heart rate, blood oxygen saturation (SpO2) and temperature, into a medical report in canonical JSON, a fixed text layout that always produces the same bytes for the same content. The report carries a timestamp, and the device signs it with a private key using what the authors call an ISIS-like lattice construction, a signature built on a hard problem over mathematical lattices.
Second, a hospital gateway receives the reports, looks up each patient's public key and checks every signature. Because the timestamp is inside the signed content, a captured report cannot simply be sent again later without detection, provided the gateway enforces a time window or rejects duplicates, which the authors list as an implementation requirement.