With the introduction of post-quantum cryptography (PQC) algorithms, there are ongoing efforts to not only standardize the proposed solutions but also consider integrating them into existing network applications and evaluating their performance. This evaluation is especially critical for security-sensitive applications such as satellite communications, where network limitations such as high packet loss and propagation delay pose unique challenges. In this paper, we consider the integration of PQC with one of the widely used security protocols, namely IPSec, by focusing on its key exchange protocol IKEv2. Specifically, we evaluate how PQ key exchange and digital signatures impact the latency compared to existing classical crypto solutions. We demonstrate through simulation how such integration triggers fragmentation that needs to be handled by IKEv2 and quantify the performance overhead due to packet loss or delaying of such fragments when used under satellite networking applications. The results indicate that while higher packet losses pose significant overheads that may hinder the adoption of PQ-based IPSec solutions, this may be subsidized when propagation delays are much higher in satellite networks.
With the introduction of post-quantum cryptography (PQC) algorithms, there are ongoing efforts to not only standardize the proposed solutions but also consider integrating them into existing network applications and evaluating their performance. This evaluation is especially critical for security-sensitive applications such as satellite communications, where network limitations such as high packet loss and propagation delay pose unique challenges. In this paper, we consider the integration of PQC with one of the widely used security protocols, namely IPSec, by focusing on its key exchange protocol IKEv2. Specifically, we evaluate how PQ key exchange and digital signatures impact the latency compared to existing classical crypto solutions. We demonstrate through simulation how such integration triggers fragmentation that needs to be handled by IKEv2 and quantify the performance overhead due to packet loss or delaying of such fragments when used under satellite networking applications. The results indicate that while higher packet losses pose significant overheads that may hinder the adoption of PQ-based IPSec solutions, this may be subsidized when propagation delays are much higher in satellite networks.
Satellite networks must establish secure channels that remain safe against large-scale quantum adversaries. Achieving post-quantum security requires post-quantum key exchange. However, most post-quantum cryptographic schemes have larger public key, ciphertext, and signature sizes than classical ones. Over satellite links with high propagation delay and non-negligible loss, larger messages are more likely to exceed the path MTU, causing fragmentation or retransmissions that degrade handshake performance. We empirically compare the handshake performance of two virtual private network protocols: WireGuard and IPsec modified with post-quantum key exchange algorithms under a simulated satellite network. Our experiments quantify the impact of message size on handshake latency and reliability, and provide practical guidance for designing quantum-secure key exchange for satellite systems.
The threat of quantum computers breaking classical cryptographic is accelerating the adoption of quantum- resistant cryptographic algorithms. Several government agencies have set a tight time-line for upgradation of all system to support post quantum cryptographs. We study post-quantum migration of IPSec protocols and their impact on network performance. The large key lengths in Post-Quantum Cryptography (PQC) cannot fit in a single IP packet leading to IP fragmentation. This can cause failure of security associations and degrade performance of IKEv2 under poor network conditions. To tackle this problem, we study a new key- sharing mechanism for IKEv2 and evaluate its performance. Unlike current hybrid key-sharing approaches, which send the classical and quantum keys sequentially over UDP or TCP (as in RFC 9370), the new approach concatenates them into a single composite key and transport them over TCP to ensure a reliable handshake. We implement and benchmark the new composite key-sharing handshake mechanism against existing hybrid algorithms that use either UDP or TCP. Extensive experiments under various network conditions demonstrate that the new approach significantly improves handshake time and energy consumption by avoiding the severe retransmission penalties of the Hybrid handshake mechanism. At 1% packet loss, the handshake time of composite key sharing mechanism is better by atleast 20% than hybrid mechanisms, and the improve- ment get better with higher packet loss reaching 30% at 10% packet loss. Energy consumption follows the same pattern achieving reduction of 29% at 10% packet loss
Within 1–2 decades, quantum computers may become powerful enough to break current public-key cryptography, prompting authorities such as the IETF and NIST to push for adopting quantum-resistant cryptography (QRC) in ecosystems like Internet Protocol Security (IPsec). Yet, IPsec struggles to adopt QRC, primarily because Internet Key Exchange Protocol Version 2 (IKEv2), which sets up IPsec sessions, cannot easily tolerate the large public keys and digital signatures of QRC. Many IETF RFCs have been proposed to integrate QRC into IKEv2, but their performance and interplay remain largely untested in practice. In this paper, we measure the performance of these RFCs over constrained links by developing a flexible, reproducible measurement testbed for IPsec with quantum-resistant IKEv2 proposals. Deploying our testbed in lossy wireless links and on the internationally distributed FABRIC testbed for Internet scenarios, we reveal that bottlenecks arise with quantum-resistant IKEv2 under high round-trip times, non-trivial packet loss, or other constraints. Our results, including the revelation of a 400–1000-fold increase in data overhead over high-loss wireless links, expose the shortcomings of today’s RFCs and call for further work in this vital area of post-quantum network security.
The rise of quantum computing poses significant risks to classical cryptographic algorithms, especially those used in digital signatures within Virtual Private Networks (VPNs). This paper proposes a hybrid cryptographic framework for IPsec VPNs that combines traditional digital signatures with post-quantum cryptographic (PQC) techniques to enhance security against both conventional and quantum threats. Our method introduces a dual-signature scheme integrated into the IKEv2 protocol, verified using formal methods via the Tamarin Prover to ensure robustness. We further evaluate performance using a modified StrongSwan implementation under realistic network conditions. Results show that while hybrid signatures introduce modest overhead, they provide a viable and forward-compatible solution for securing VPNs in the post-quantum era.
Post-quantum cryptographic (PQC) algorithms are being developed to guard against quantum-computing attacks, but their behavior in constrained Internet of Things (IoT) environments remains an important topic of discussion. In this work, we study the impact of deploying PQC protocols in IoT networks using the Open Quantum Safe (liboqs) framework. In particular, key encapsulation and digital signature schemes are evaluated in terms of their computational performance, communication costs, and energy consumption. Our results indicate that although PQC operations can be completed in microseconds using general-purpose processors, substantially larger key and ciphertext sizes introduce significant communication overhead. When mapped to common IoT protocols such as Bluetooth Low Energy (BLE), IEEE 802.15.4 (Zigbee), and LoRa, these larger payloads must be divided into multiple packets. In low-payload LoRa networks, for example, ML-KEM handshakes can require up to 62 packets. This level of fragmentation increases latency and energy consumption, thus potentially affecting reliability. Furthermore, when packet delivery probabilities approaching 99% are achieved, handshake success rates can drop to values approaching 50%. These results suggest that communication metrics, rather than computational performance, pose key challenges to PQC deployment in constrained IoT settings.
This thesis investigates the current state of Post-quantum cryptography (PQC) in the industry, with a particular focus on its practical deployment, integration challenges, and performance implications.The study combines a structured analysis of academic literature, standardization efforts, and industry guidance with an experimental evaluation of PQC integration in widely used security protocols. The analysis shows that, while significant progress has been made in the standardization of quantum-resistant algorithms such as ML-KEM, ML-DSA, and SLH-DSA, real-world adoption remains in an early and transitional phase. Organizations primarily focus on evaluation and pilot implementations, as deployment is constrained by interoperability issues, implementation maturity, and the complexity of migrating existing cryptographic infrastructures.To complement the conceptual analysis, experimental measurements were conducted for TLS, SSH, and IPsec to evaluate the performance impact of hybrid post-quantum cryptographic mechanisms. The results indicate that performance overhead is not uniform across components. In particular, post-quantum signature schemes introduce significant computational and network overhead, mainly due to increased key and certificate sizes. In contrast, hybrid key exchange mechanisms show only moderate performance impact across all evaluated protocols.The findings highlight that the primary challenge of PQC adoption lies not in algorithm design but in practical integration and large-scale migration. Hybrid cryptographic approaches emerge as the most viable strategy for enabling a gradual transition, balancing improved security against quantum threats with operational feasibility.Overall, this thesis demonstrates that PQC is transitioning from a theoretical research field to a practical engineering challenge, with significant implications for the future design of secure communication systems.