Postgraduate Diploma in Key Management and Cryptography in Devices
Online 800-hour Postgraduate Diploma in Key Management and Cryptography in Devices. 8 modules covering NIST SP 800-57 Part 1, FIPS 140-3 and OpenSSL. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Apply cryptographic primitives suited to constrained devices.
Manage the complete key lifecycle.
Select security hardware according to the level of risk.
Design PKI infrastructures for device fleets.
Implement secure protocols such as TLS 1.3 and OSCORE.
Analyse countermeasures against physical attacks.
Plan the transition to post-quantum cryptography.
Who it's for
- Embedded security engineer who wants to specialise in Key Management and Cryptography in Devices.
- Applied cryptographer who wants to specialise in Key Management and Cryptography in Devices.
- PKI architect who wants to specialise in Key Management and Cryptography in Devices.
- Secure firmware engineer who wants to specialise in Key Management and Cryptography in Devices.
- Hardware security evaluator who wants to specialise in Key Management and Cryptography in Devices.
- Cybersecurity compliance consultant who wants to specialise in Key Management and Cryptography in Devices.
- Graduates in engineering or science looking to enter the consumer electronics sector.
What you'll work with
- NIST SP 800-57 Part 1
- FIPS 140-3
- IEC 62443-4-2
- NIST SP 800-90A
- ISO/IEC 11889
- IETF RFC 8446
- FIPS 203
- ETSI EN 303 645
8 modules · 800 h
1.1AES symmetric encryption and modes of operation1.2Authenticated encryption GCM and CCM1.3SHA-2 and SHA-3 hash functions1.4HMAC and CMAC authentication codes1.5Elliptic curve cryptography1.6ECDSA and EdDSA signatures1.7ECDH key exchange1.8NIST SP 800-90A random number generators1.9Resource constraints in microcontrollers1.10Practical: authenticated encryption with Mbed TLS
2.1NIST SP 800-57 recommendations2.2Generation and entropy sources2.3Key derivation with HKDF2.4Key storage and protection2.5Key distribution and transport2.6Rotation and expiry2.7Revocation and destruction2.8Key hierarchies in products2.9Inventory and custody2.10Case study: key policy for a product
3.1Secure elements and their certification3.2TPM 2.0 according to ISO/IEC 118893.3TrustZone trusted execution environments3.4Physically unclonable functions (PUF)3.5OTP fuses and protected storage3.6Cryptographic accelerators in SoCs3.7HSM modules in manufacturing3.8FIPS 140-3 and Common Criteria certification3.9Hardware selection based on risk3.10Laboratory: operations with tpm2-tools
4.1X.509 certificates and extensions4.2Private certification authorities4.3IEEE 802.1AR device identity4.4Enrolment with EST and SCEP4.5Manufacturing and operational certificates4.6OCSP validation and revocation lists4.7PKI management at fleet scale4.8PKI in offline environments4.9Auditing certification authorities4.10Workshop: certificate chain for a fleet
5.1TLS 1.3 and its negotiation5.2DTLS for UDP transport5.3Lightweight suites and PSK5.4OSCORE for CoAP5.5Security in MQTT5.6Secure boot and firmware signing5.7Secure software updates5.8Remote attestation5.9Secure channels on internal buses5.10Practical: mutual TLS 1.3 on a microcontroller
6.1Power consumption side-channel attacks6.2Timing analysis and constants6.3Voltage and clock fault injection6.4Key extraction through debugging6.5Software countermeasures6.6Hardware countermeasures6.7Resistance evaluation in the laboratory6.8Ethics and the legal framework of evaluation6.9Security evaluation standards6.10Case study: constant-time code review
7.1Quantum threat to current cryptography7.2FIPS 203, 204 and 205 standards7.3Impact on memory and performance7.4Hybrid transition schemes7.5Cryptographic agility7.6IEC 62443-4-2 requirements on cryptography7.7ETSI EN 303 645 requirements7.8Cyber Resilience Act7.9Cryptography export control7.10Laboratory: testing ML-KEM on a device
8.1Product and threat model8.2Cryptographic requirements8.3Selection of security hardware8.4Key hierarchy design8.5PKI design and provisioning8.6Secure channel prototype8.7Cryptographic agility plan8.8Compliance assessment8.9Report and presentation8.10Final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetable: students progress at their own pace within the enrolment period, which makes it possible to combine the programme with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is OpenSSL, Mbed TLS, wolfSSL, tpm2-tools, ChipWhisperer, in free, academic or evaluation versions. Tests are studied using real validation procedures for mutual TLS channels on a microcontroller, an academic evaluation of a side channel, and a certificate provisioning test. Assessment is continuous per module, plus the final integrating project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Apply cryptographic primitives suited to constrained devices.
Manage the complete key lifecycle.
Select security hardware according to the level of risk.
Design PKI infrastructures for device fleets.
Implement secure protocols such as TLS 1.3 and OSCORE.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. A university degree is not required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient command of Spanish to follow technical standards documentation.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme consists of 800 hours in total, spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
The programme works with OpenSSL, Mbed TLS, wolfSSL, tpm2-tools, ChipWhisperer. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
An SEIUM own diploma upon passing the continuous assessment and the integrating project. It is in-house training, not an official Ministry qualification.
Yes. Modules passed in a course or postgraduate diploma in the same area can be credited towards the advanced programme. Check the credit transfer policy when you enrol.
Related programmes
Diploma in Advanced Magnetism and Rapid Switching
Online postgraduate diploma of 800 hours in advanced magnetics and fast switching. 8 modules covering applied electromagnetism, advanced inductor and high-frequency transformer design, fast-switching devices, layout…
Diploma in Materials, Losses and BH Curves
Online postgraduate diploma of 800 hours in magnetic materials, losses and BH curves. 8 modules covering the physics of magnetic materials, soft material families, BH curves…
Postgraduate Diploma in Cloud-Edge Architectures for IoT
Online Postgraduate Diploma of 800 hours in Cloud-Edge Architectures for IoT. 8 modules covering ISO/IEC 30141, OASIS MQTT 5.0 and Kubernetes K3s. Assigned tutor and open…
More in Electronics, Embedded Systems & Telecom
All Electronics, Embedded Systems & Telecom programmes → · How to apply · Fees & financing · Scholarships