Research
We ask questions the industry assumes are already answered. Does post-quantum cryptography fit inside a 3 ms substation deadline? Can a learned traffic policy beat the best legal plan it would replace? We publish the answer either way — negative results included — and every figure here traces back to raw data anyone can rerun.
lines of research
published
accepted
in preparation
§1Published
Conformance Co-Simulation for Reinforcement-Learning Traffic Signal Control
Blackcycle Lab
Will a certified traffic controller actually execute what a learned policy commands?
Answer —Depends on the architecture — always, when adjustments are bounded onto a deployed plan; almost never, when phases are commanded directly.
Reinforcement learning for traffic signal control is evaluated almost entirely against simulators that will execute any command the policy emits. Real controllers will not: they are devices certified against functional-safety requirements, with their own minimum-green timers, clearance logic and phase-incompatibility matrices, and they reject what violates them. We report an instrument that closes that gap: a co-simulation running a trained policy in lockstep against a byte-exact implementation of a municipal signal-controller protocol, counting per command what the controller accepts, delays, absorbs or reinterprets. Its most useful property is that it finds defects — in four days it exposed five real implementation gaps in a controller implementation that already passed its own test suite, and one gap on the learning side that had invalidated an earlier comparison.
bounded adjustments onto a deployed plan — every command executed
phases commanded outright — orders the controller actually accepted
@misc{blackcyclelab2026conformance,
title = {Conformance Co-Simulation for Reinforcement-Learning Traffic Signal Control},
author = {{Blackcycle Lab}},
year = {2026},
month = aug,
howpublished = {Zenodo},
doi = {10.5281/zenodo.22016686},
url = {https://doi.org/10.5281/zenodo.22016686}
}§2Accepted
Harvest-Now-Decrypt-Later Risk Cohorts Across ETSI CCMS Certificate Validity Periods: A Quantitative Roadmap for Post-Quantum Migration of EU V2X PKI
Blackcycle Lab
Are today’s V2X certificates already inside the harvest-now-decrypt-later risk window?
Answer —Yes — two of six certificate types already are, years before any quantum computer exists.
X = time to migrate. Y = how long the data must stay secret. Z = years until a quantum computer can break it. If migration plus retention outlasts the clock, you’re already at risk.
The EU Cooperative Intelligent Transport Systems (C-ITS) Certificate Management System (CCMS) issues certificates whose validity ranges from 168 h authorization tickets to five-year root certificate authorities. In a signature-centric V2X public-key infrastructure, the harvest-now-decrypt-later analogue is not ciphertext decryption but future private-key recovery for long-lived trust anchors: a compromised root key can enable unauthorized subordinate-certificate issuance and, where audit evidence is insufficient, backdated forgery claims. We apply Mosca’s X + Y > Z risk inequality to six CCMS certificate cohorts under three quantum-arrival scenarios and find that root and trust-list-manager cohorts already fall inside the optimistic risk window. We then benchmark ten signature variants and three ML-KEM variants on a homogeneous OpenSSL 3.5 / liboqs stack across an Intel i7, a Cortex-A78AE automotive platform and a Raspberry Pi 4 Cortex-A72. An ECDSA+ML-DSA-44 composite-signature path on an operator-isolated shadow CCMS enrolment endpoint shows modest compute overhead but large envelope growth, motivating a backend-first migration roadmap and illustrative planning milestones for ETSI WG5.
Faster signing
Post-quantum signatures sign faster than today’s method, on ordinary laptop-class hardware.
Bigger keys and signatures
The real migration cost isn’t speed — it’s size. Public keys and signatures both grow roughly 40-fold.
Certificate types already at risk
Root and trust-list certificates fall inside the risk window today, before any quantum computer exists.
@article{blackcyclelab2026hndl,
title = {Harvest-Now-Decrypt-Later Risk Cohorts Across ETSI CCMS Certificate Validity Periods:
A Quantitative Roadmap for Post-Quantum Migration of EU V2X PKI},
author = {{Blackcycle Lab}},
journal = {IEEE Access},
year = {2026},
note = {Accepted, DOI pending}
}§3In preparation
Does a protocol-conformant learned policy beat the best legal fixed-timing plan it would replace?
Open — measurement in progress
Multi-Agent Reinforcement Learning for Traffic Signal Control: Protocol-Conformant Deployment and the Limits of a Learned Residual Layer
A companion study on a real Barcelona corridor: what a protocol-conformant learned policy is worth over the best legal fixed-timing plan it would replace, and under which conditions.
Target — IEEE Transactions on Intelligent Transportation Systems
Can a post-quantum signature fit inside a substation protection message’s 3 ms trip deadline?
Open — measurement in progress
Signing the Trip, or Sharing the Key? — Post-Quantum Authentication Across the IEC 61850 GOOSE Protection Hardware Spectrum
Benchmarks NIST-selected post-quantum signature schemes against the transfer-time deadline of substation protection messages, on a homogeneous stack from x86 down to Cortex-M protection silicon.
the signature has to fit inside the trip, not just be secure
Target — Scientific Reports
Does signing time-sync messages with a post-quantum signature measurably perturb clock accuracy?
Open — measurement in progress
Does the Signature Move the Clock? Mapping FIPS Post-Quantum Authentication on the gPTP Message Path
Measures whether post-quantum signatures on time-synchronization (gPTP / IEEE 802.1AS) messages perturb clock accuracy, on live two-node hardware testbeds.
four budgets a signature has to clear at once — size, cadence, per-hop residence, sync accuracy
Target — peer-reviewed journal
Code, benchmarks and reproduction data
Measurement harnesses and reproducible artefacts are released alongside each paper as they clear peer review.
← Back to blackcycle.ai