Filter Search for grants
Call Navigation
Call key data
Security of implementations of Post-Quantum Cryptography algorithms
Funding Program
Horizon Europe: Cluster 3 - Civil security for society
Call number
HORIZON-CL3-2025-02-CS-ECCC-05
deadlines
Opening
12.06.2025
Deadline
12.11.2025 17:00
Funding rate
100%
Call budget
€ 6,000,000.00
Estimated EU contribution per project
between € 2,000,000.00 and € 3,000,000.00
Link to the call
Link to the submission
Call content
short description
The security of the implementations of PQC (Post-Quantum Cryptography) algorithms is vital for maintaining the confidentiality, integrity, authenticity and availability of digital information and communications in the face of implementation attacks, such as, for example, side-channel attacks using information from timing, power consumption, electromagnetic radiation, fault attacks disturbing the secure of operation of the device and their combination. Such attacks, eventually also enhanced by the use of deep learning, constitute significant threats to both (embedded and regular) software and hardware implementations.
Call objectives
In various application areas such as IoT, cloud-based applications, automotive, measures to prevent such attacks currently lead to substantial resource overhead due to the complexity of the algorithms, and the security remains unclear given the limited exploration of different attack surfaces. Countermeasures, to the extent that they are available, may have significant impact on run-time and memory consumption. Resistance in PQC implementations to implementation attacks is an increasingly common concern among customers, especially when exploring the right balance between security and performance.
Evaluating the security of PQC algorithm implementations against side-channel and fault attacks is crucial, given the proven vulnerabilities. Various countermeasures, such as masking, shuffling, randomized clocking, random delay insertion, constant weight encoding, code polymorphism, control-flow integrity and re-computation of critical operations can be employed to mitigate these attacks. Synergies between specific countermeasures and the design of cryptographic systems are available for pre-quantum cryptography but require investigation for post-quantum cryptography.
read more
Expected effects and impacts
Proposals are welcome on developing solutions that protect against such implementation attacks, at reasonable costs and minimizing the loss of performance while maintaining the required security, as well as on the analysis of new attacks or combinations of attacks, also powered by the use of AI, for security-by-design approaches when designing Post Quantum Cryptographic systems. Activities can also lead to the development of testing methodologies and frameworks for automated security evaluations for correctness and resistance to remote side-channel attacks for regular software and for correctness and resistance to a broad range of implementation attacks for embedded software and hardware.
Expected results
Projects’ results are expected to contribute to some or all of the following outcomes:
- Design and implementations of Post-Quantum Cryptography (PQC) algorithms that are resistant to side-channel and fault attacks;
- Optimized countermeasures taking into account a balanced trade-off between security, performance, and costs;
- Recommendations on implementing countermeasures for a broad range of attacks, also identifying the available and necessary hardware;
- Analysis of new attacks or combinations of attacks, also eventually enhanced by AI, applicable to real-world conditions.
- Design of automated security evaluations for PQC implementations.
Eligibility Criteria
Regions / countries for funding
Moldova (Moldova), Albania (Shqipëria), Armenia (Հայաստան), Bosnia and Herzegovina (Bosna i Hercegovina / Босна и Херцеговина), Canada, Faeroes (Føroyar / Færøerne), Georgia (საქართველო), Iceland (Ísland), Israel (ישראל / إِسْرَائِيل), Kosovo (Kosova/Kosovë / Косово), Montenegro (Црна Гора), Morocco (المغرب), New Zealand (Aotearoa), North Macedonia (Северна Македонија), Norway (Norge), Serbia (Srbija/Сpбија), Switzerland (Schweiz/Suisse/Svizzera), Tunisia (تونس /Tūnis), Türkiye, Ukraine (Україна), United Kingdom
eligible entities
EU Body, Education and training institution, Non-Profit Organisation (NPO) / Non-Governmental Organisation (NGO), Other, Private institution, incl. private company (private for profit), Public Body (national, regional and local; incl. EGTCs), Research Institution incl. University, Small and medium-sized enterprise (SME)
Mandatory partnership
Yes
Project Partnership
To be eligible for funding, applicants must be established in one of the following countries:
- the Member States of the European Union, including their outermost regions
- the Overseas Countries and Territories (OCTs) linked to the Member States
- countries associated to Horizon Europe - see list of particpating countries
Only legal entities forming a consortium are eligible to participate in actions provided that the consortium includes, as beneficiaries, three legal entities independent from each other and each established in a different country as follows:
- at least one independent legal entity established in a Member State; and
- at least two other independent legal entities, each established in different Member States or Associated Countries.
Any legal entity, regardless of its place of establishment, including legal entities from non-associated third countries or international organisations (including international European research organisations) is eligible to participate (whether it is eligible for funding or not), provided that the conditions laid down in the Horizon Europe Regulation have been met, along with any other conditions laid down in the specific call topic.
A ‘legal entity’ means any natural or legal person created and recognised as such under national law, EU law or international law, which has legal personality and which may, acting in its own name, exercise rights and be subject to obligations, or an entity without legal personality.
Specific cases:
- Affiliated entities (i.e. entities with a legal or capital link to a beneficiary which participate in the action with similar rights and obligations to the beneficiaries, but which do not sign the grant agreement and therefore do not become beneficiaries themselves) are allowed, if they are eligible for participation and funding.
- Associated partners (i.e. entities which participate in the action without signing the grant agreement, and without the right to charge costs or claim contributions) are allowed, subject to any conditions regarding associated partners set out in the specific call conditions.
- Entities which do not have legal personality under their national law may exceptionally participate, provided that their representatives have the capacity to undertake legal obligations on their behalf, and offer guarantees to protect the EU’s financial interests equivalent to those offered by legal persons.
- Legal entities created under EU law (EU bodies) including decentralised agencies may be part of the consortium, unless provided for otherwise in their basic act.
- International European research organisations are eligible to receive funding. International organisations with headquarters in a Member State or Associated Country are eligible to receive funding for ‘Training and mobility’ actions or when provided for in the specific call/topic conditions. Other international organisations are not eligible to receive funding, unless provided for in the specific call/topic conditions, or if their participation is considered essential for implementing the action by the granting authority.
- Joint Research Centre (JRC)— Where provided for in the specific call conditions, applicants may include in their proposals the possible contribution of the JRC but the JRC will not participate in the preparation and submission of the proposal. Applicants will indicate the contribution that the JRC could bring to the project based on the scope of the topic text. After the evaluation process, the JRC and the consortium selected for funding may come to an agreement on the specific terms of the participation of the JRC. If an agreement is found, the JRC may accede to the grant agreement as beneficiary requesting zero funding or participate as an associated partner, and would accede to the consortium as a member.
- Associations and interest groupings — Entities composed of members (e.g. European research infrastructure consortia (ERICs)) may participate as ‘sole beneficiaries’ or ‘beneficiaries without legal personality’. However, if the action is in practice implemented by the individual members, those members should also participate (either as beneficiaries or as affiliated entities, otherwise their costs will NOT be eligible.
- EU restrictive measures — Entities subject to EU restrictive measures under Article 29 of the Treaty on the European Union (TEU) and Article 215 of the Treaty on the Functioning of the EU (TFEU) as well as Article 75 TFEU, are not eligible to participate in any capacity, including as beneficiaries, affiliated entities, associated partners, third parties giving in-kind contributions, subcontractors or recipients of financial support to third parties (if any).
- Legal entities established in Russia, Belarus, or in non-government controlled territories of Ukraine — Given the illegal invasion of Ukraine by Russia and the involvement of Belarus, there is currently no appropriate context allowing the implementation of the actions foreseen in this programme with legal entities established in Russia, Belarus, or in non-government controlled territories of Ukraine. Therefore, even where such entities are not subject to EU restrictive measures, such legal entities are not eligible to participate in any capacity. This includes participation as beneficiaries, affiliated entities, associated partners, third parties giving in-kind contributions, subcontractors or recipients of financial support to third parties (if any). Exceptions may be granted on a case-by-case basis for justified reasons.
With specific regard to measures addressed to Russia, following the adoption of the Council Regulation (EU) 2024/1745 of 24 June 2024 (amending Council Regulation (EU) No 833/2014 of 31 July 2014) concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine, legal entities established outside Russia but whose proprietary rights are directly or indirectly owned for more than 50% by a legal person, entity or body established in Russia are also not eligible to participate in any capacity. - Measures for the protection of the Union budget against breaches of the principles of the rule of law in Hungary — Following the Council Implementing Decision (EU) 2022/2506, as of 16 December 2022, no legal commitments can be entered into with Hungarian public interest trusts established under the Hungarian Act IX of 2021 or any entity they maintain. Affected entities may continue to apply to calls for proposals and can participate without receiving EU funding, as associated partners, if allowed by the call conditions. However, as long as the Council measures are not lifted, such entities are not eligible to participate in any funded role (beneficiaries, affiliated entities, subcontractors, recipients of financial support to third parties, etc.).In case of multi-beneficiary grant calls, applicants will be invited to remove or replace that entity in any funded role and/or to change its status into associated partner. Tasks and budget may be redistributed accordingly.
other eligibility criteria
In order to achieve the expected outcomes, and safeguard the Union’s strategic assets, interests, autonomy, and security, participation in this topic is limited to legal entities established in Member States and Associated Countries and OECD countries.
In order to guarantee the protection of the strategic interests of the Union and its Member States, entities established in an eligible country listed above, but which are directly or indirectly controlled by a non-eligible country or by a non-eligible country entity, shall not participate in the action.
Additional information
Topics
Relevance for EU Macro-Region
EUSAIR - EU Strategy for the Adriatic and Ionian Region, EUSALP - EU Strategy for the Alpine Space, EUSBSR - EU Strategy for the Baltic Sea Region, EUSDR - EU Strategy for the Danube Region
UN Sustainable Development Goals (UN-SDGs)
Additional Information
Applications must be submitted electronically via the Funders & Tenders Portal electronic submission system (accessible via the topic page in the Search Funding & Tenders section). Paper submissions are NOT possible.
Applications must be submitted using the forms provided inside the electronic submission system (not the templates available on the topic page, which are only for information). The structure and presentation must correspond to the instructions given in the forms.
Applications must be complete and contain all parts and mandatory annexes and supporting documents.
The application form will have two parts:
- Part A (to be filled in directly online) contains administrative information about the applicant organisations (future coordinator and beneficiaries and affiliated entities), the summarised budget for the proposal and call-specific questions;
- Part B (to be downloaded from the Portal submission system, completed and then assembled and re-uploaded as a PDF in the system) contains the technical description of the project.
Annexes and supporting documents will be directly available in the submission system and must be uploaded as PDF files (or other formats allowed by the system).
The limit for a full application (Part B) is 50 pages.
Eligible costs will take the form of a lump sum as defined in the Decision of 7 July 2021 authorising the use of lump sum contributions under the Horizon Europe Programme – the Framework Programme for Research and Innovation (2021-2027) – and in actions under the Research and Training Programme of the European Atomic Energy Community (2021-2025). It is mandatory to submit a detailed budget table using the template available in the Submission system.
Some activities resulting from this topic may involve using classified background and/or producing of security sensitive results (EUCI and SEN). Please refer to the related provisions in section B Security — EU classified and sensitive information of the General Annexes.
Call documents
Horizon Europe Work Programme 2025 Cluster 3 - Civil Security for SocietyHorizon Europe Work Programme 2025 Cluster 3 - Civil Security for Society(974kB)
Contact
Website
European Cybersecurity Competence Centre and Network (ECCC) - National Coordination Centres
applicants@eccc.europa.eu
Website
To see more information about this call, you can register for free here
or log in with an existing account.
Log in
Register now