The Performance of Post-Quantum TLS 1.3

Markus Sosnowski, Florian Wiedner, Eric Hauser, Lion Steger, Dimitrios Schoinianakis, Sebastian Gallenmüller, Georg Carle

Published Nov 28, 2023• 49 citations

Publisher

Abstract

Quantum Computers (QCs) differ radically from traditional computers and can efficiently solve mathematical problems fundamental to our current cryptographic algorithms. Although existing QCs need to accommodate more qubits to break cryptographic algorithms, the concern of ''Store-Now-Decrypt-Later'' (i.e., adversaries store encrypted data today and decrypt them once powerful QCs become available) highlights the necessity to adopt quantum-safe approaches as soon as possible. In this work, we investigate the performance impact of Post-Quantum Cryptography (PQC) on TLS 1.3. Different signature algorithms and key agreements (as proposed by the National Institute of Standards and Technology (NIST)) are examined through black- and white-box measurements to get precise handshake latencies and computational costs per participating library. We emulated loss, bandwidth, and delay to analyze constrained environments. Our results reveal that HQC and Kyber are on par with our current state-of-the-art, while Dilithium and Falcon are even faster. We observed no performance drawback from using hybrid algorithms; moreover, on higher NIST security levels, PQC outperformed any algorithm in use today. Hence, we conclude that post-quantum TLS is suitable for adoption in today's systems.

DOI: 10.1145/3624354.3630585

Related papers

Security and Performance Analyses of Post-Quantum Digital Signature Algorithms and Their TLS and PKI Integrations

Manohar Raavi, Qaiser Khan, Simeon Wuthier +3 more

Quantum computing challenges the mathematical problems anchoring the security of the classical public key algorithms. For quantum-resistant public key algorithms, the National Institute of Standards and Technology (NIST) has undergone a multi-year standardization process and selected the post-quantum cryptography (PQC) public key digital signatures of Dilithium, Falcon, and SPHINCS+. Finding common ground to compare these algorithms can be difficult because of their design differences, including the fundamental math problems (lattice-based vs. hash-based). We use a visualization model to show the key/signature size vs. security trade-offs for all PQC algorithms. Our performance analyses compare the algorithms’ computational loads in the execution time. Building on the individual algorithms’ analyses, we analyze the communication costs and implementation overheads when integrated with Public Key Infrastructure (PKI) and with Transport Layer Security (TLS) and Transmission Control Protocol (TCP)/Internet Protocol (IP). Our results show that the lattice-based algorithms of Dilithium and Falcon induce lower computational overheads than the hash-based algorithms of SPHINCS+. In addition, the lattice-based PQC can outperform the classical algorithm with comparable security strength; for example, Dilithium 2 and Falcon 512 outperform RSA 4096 in the TLS handshake time duration.

CryptographyJun 4, 202514 citations

Performance Evaluation of TLS 1.3 Handshake on Resource-Constrained Devices Using NIST's Third Round Post-Quantum Key Encapsulation Mechanisms and Digital Signatures

Sultan Saribas, Samet Tonyalı

Towards the end of the 20. century, quantum computing came into sight by the main effect of Shor's Algorithm. While this algorithm offers a solution for the factorization problem, which makes it exponentially faster, it alongside becomes a critical threat for the encryption schemes since mostly their security mechanisms rely on the difficulty of integer factorization or discrete log problems. Despite it is not known when advanced quantum computers will show up, yet, once it is developed, most existing cryptography will be rendered useless, which means all existing information security will be vulnerable. Owing to this risky situation, The National Institute of Standards and Technology (NIST) launched post-quantum cryptography (PQC) standardization process for the development of PQC schemes. In this paper, we have chosen three key encapsulation mechanisms and two digital signature algorithms with different parameter sets from the round three submissions. We measured their TLS 1.3 handshake performance using two resource-constrained devices and compared it to that of classical encryption and digital signature schemes. Experiment results showed that post-quantum algorithms come with an extra message overhead while their handshake delay values are promising.

International Conference on Computer Science and Engineering (UBMK)Sep 14, 202211 citations

Constrained Device Performance Benchmarking with the Implementation of Post-Quantum Cryptography

Gregory Fitzgibbon, Carlo Ottaviani

Advances in quantum computers may pose a significant threat to existing public-key encryption methods, which are crucial to the current infrastructure of cyber security. Both RSA and ECDSA, the two most widely used security algorithms today, may be (in principle) solved by the Shor algorithm in polynomial time due to its ability to efficiently solve the discrete logarithm problem, potentially making present infrastructures insecure against a quantum attack. The National Institute of Standards and Technology (NIST) reacted with the post-quantum cryptography (PQC) standardization process to develop and optimize a series of post-quantum algorithms (PQAs) based on difficult mathematical problems that are not susceptible to being solved by Shor’s algorithm. Whilst high-powered computers can run these PQAs efficiently, further work is needed to investigate and benchmark the performance of these algorithms on lower-powered (constrained) devices and the ease with which they may be integrated into existing protocols such as TLS. This paper provides quantitative benchmark and handshake performance data for the most recently selected PQAs from NIST, tested on a Raspberry Pi 4 device to simulate today’s IoT (Internet of Things) devices, and provides quantitative comparisons with previous benchmarking data on a range of constrained systems. CRYSTALS-Kyber and CRYSTALS-Dilithium are shown to be the most efficient PQAs in the key encapsulation and signature algorithms, respectively, with Falcon providing the optimal TLS handshake size.

CryptographyMay 23, 202459 citations

Post-Quantum Cryptography Migration: Kyber And Dilithium in TLS 1.3

V Sakhtipriyanka

A sufficiently capable quantum computer would break the public-key cryptography that secures the modern internet, and data captured today can be stored until that machine arrives. This harvest-now-decrypt-later threat has pushed standards bodies to act well ahead of the hardware. In 2024 NIST published the first finished post-quantum standards: ML-KEM, derived from CRYSTALS-Kyber, for key establishment, and ML-DSA, derived from CRYSTALS-Dilithium, for digital signatures. This paper examines how these algorithms move into the two protocols that carry most secured traffic, TLS 1.3 and IPsec. We describe the hybrid handshake that runs a classical and a post-quantum key-encapsulation mechanism side by side, we measure the cost of the larger keys and signatures these schemes carry, and we discuss the practical friction points such as oversized certificate chains and fragmented handshake records. Benchmarks reported in the literature show that a hybrid X25519 plus Kyber-768 handshake adds only a small latency penalty on a healthy network, while Dilithium signatures inflate the certificate path enough to matter on constrained links. We close with a staged migration plan built around crypto-agility.

Jun 13, 20260 citations

Benchmarking TLS 1.3 with PQC on Realistic Network Conditions

Méndez Veiga, Iyán

We benchmark the TLS 1.3 handshake using post-quantum cryptographic algorithms, including both key encapsulation mechanisms and digital signature schemes, and compare them against traditional, non-quantum-safe counterparts. Our evaluation covers all FIPS-approved post-quantum standards (ML-KEM, ML-DSA, and SLH-DSA), as well as a selection of digital signature schemes from second-round candidates of the NIST PQC competition that are available in the liboqs library from the Open Quantum Safe project. To assess real-world performance, we simulate various network conditions (rate, delay, and losses) and analyze the impact of post-quantum cryptography on TLS connection latency.

Dec 3, 20250 citations

Post-Quantum Key Exchange in TLS 1.3: Further Analysis on Performance of New Cryptographic Standards

Konstantina Souvatzidaki, Konstantinos Limniotis

The emergence of quantum computing presents a significant threat to classical cryptographic primitives, particularly those employed in securing internet communications via widely used protocols such as Transport Layer Security (TLS). As conventional key exchange mechanisms will become increasingly vulnerable in the post-quantum era, the integration of post-quantum cryptographic (PQC) algorithms into existing security protocols is of utmost importance. This study investigates the impact of incorporating PQC key encapsulation mechanisms—specifically, the recent standards CRYSTALS-Kyber and HQC, in conjunction with the candidate standard BIKE—into the TLS 1.3 handshake. A comprehensive experimental evaluation was conducted to measure handshake latency under emulated network conditions with varying packet loss probabilities. The findings offer useful insights into the performance trade-offs introduced by PQC integration and further highlight the necessity of a timely transition to post-quantum cryptographic standards.

CryptographyNov 21, 202514 citations