The emergence of quantum computing poses an existential threat to current Internet of Things security infrastructure, which relies predominantly on RSA and elliptic curve cryptography for confidentiality and authentication. Shor's algorithm enables polynomial-time factorization that can break these classical cryptographic primitives, necessitating urgent migration to quantum-resistant alternatives. This paper presents the first comprehensive performance evaluation of six NISTstandardized and candidate post-quantum key encapsulation mechanisms (ML-KEM-512, ML-KEM-768, NTRU-Prime-hrss, BIKE-L1, HQC-128, Classic-McEliece-348864) integrated into the MQTT protocol across 4,608 experimental configurations spanning diverse real-world network conditions. We systematically evaluate connection establishment latency, message delivery reliability, decryption computational overhead, and throughput stability under systematically varied network latency (10-150 ms representing LAN to satellite links), packet loss rates (0-10% spanning excellent to degraded connectivity), payload sizes (128-1024 bytes covering sensor telemetry to multimedia streams), and message transmission rates (1-10 Hz from periodic monitoring to real-time control). Statistical analysis of 622,080 MQTT messages totaling 384 hours of simulation time reveals that NTRU-Prime-hrss achieves optimal performance-security balance with 98.1% delivery ratio and 26.1 ms median handshake latency across all tested conditions, while Classic-McEliece exhibits 278.3 ms handshake overhead rendering it impractical for resourceconstrained deployments despite offering conservative security margins. We demonstrate through generalized linear modeling that transport-layer effects (TCP retransmissions, TLS record framing overhead) dominate post-quantum cryptographic computational costs, accounting for approximately 70% of endto-end latency in high-loss scenarios. Our novel three-gate decision framework provides quantitative deployment criteria for IoT operators balancing security requirements against operational constraints. Complete implementation, experimental dataset, and analysis scripts available at https://github.com/ vssk18/PQSM-RESEARCH.
The emergence of quantum computing poses an existential threat to current Internet of Things security infrastructure, which relies predominantly on RSA and elliptic curve cryptography for confidentiality and authentication. Shor's algorithm enables polynomial-time factorization that can break these classical cryptographic primitives, necessitating urgent migration to quantum-resistant alternatives. This paper presents the first comprehensive performance evaluation of six NISTstandardized and candidate post-quantum key encapsulation mechanisms (ML-KEM-512, ML-KEM-768, NTRU-Prime-hrss, BIKE-L1, HQC-128, Classic-McEliece-348864) integrated into the MQTT protocol across 4,608 experimental configurations spanning diverse real-world network conditions. We systematically evaluate connection establishment latency, message delivery reliability, decryption computational overhead, and throughput stability under systematically varied network latency (10-150 ms representing LAN to satellite links), packet loss rates (0-10% spanning excellent to degraded connectivity), payload sizes (128-1024 bytes covering sensor telemetry to multimedia streams), and message transmission rates (1-10 Hz from periodic monitoring to real-time control). Statistical analysis of 622,080 MQTT messages totaling 384 hours of simulation time reveals that NTRU-Prime-hrss achieves optimal performance-security balance with 98.1% delivery ratio and 26.1 ms median handshake latency across all tested conditions, while Classic-McEliece exhibits 278.3 ms handshake overhead rendering it impractical for resourceconstrained deployments despite offering conservative security margins. We demonstrate through generalized linear modeling that transport-layer effects (TCP retransmissions, TLS record framing overhead) dominate post-quantum cryptographic computational costs, accounting for approximately 70% of endto-end latency in high-loss scenarios. Our novel three-gate decision framework provides quantitative deployment criteria for IoT operators balancing security requirements against operational constraints. Complete implementation, experimental dataset, and analysis scripts available at https://github.com/ vssk18/PQSM-RESEARCH.
The proliferation of Internet of Things (IoT) devices that use the Message Queuing Telemetry Transport (MQTT) protocol poses significant security challenges in the emerging quantum computing era. Current Transport Layer Security (TLS) implementations rely on classical cryptographic algorithms vulnerable to Shor's algorithm. This paper proposes PQ-MQTT, a hybrid post-quantum secure communication protocol that integrates ML-KEM-768 with X25519 for key encapsulation and a lightweight session-key derivation mechanism optimized for resource-constrained IoT publishers. We present a formal security analysis under the Quantum Random Oracle Model (QROM), demonstrating resilience against store-now-decryptlater attacks. Experimental evaluation on the Raspberry Pi 4, ESP32, and Arduino Nano 33 platforms shows that PQ-MQTT achieves handshake latencies of127.3ms,412.7ms, and1,847.2ms, respectively, with 18.2 KB of additional memory overhead. A comparative analysis of pure post-quantum and classical TLS implementations shows energy reductions of23.5%−40.5%relative to pure PQC, achieved through our hybrid optimization approach, while maintaining 94.2 % throughput efficiency.
Post-quantum cryptographic (PQC) algorithms are being developed to guard against quantum-computing attacks, but their behavior in constrained Internet of Things (IoT) environments remains an important topic of discussion. In this work, we study the impact of deploying PQC protocols in IoT networks using the Open Quantum Safe (liboqs) framework. In particular, key encapsulation and digital signature schemes are evaluated in terms of their computational performance, communication costs, and energy consumption. Our results indicate that although PQC operations can be completed in microseconds using general-purpose processors, substantially larger key and ciphertext sizes introduce significant communication overhead. When mapped to common IoT protocols such as Bluetooth Low Energy (BLE), IEEE 802.15.4 (Zigbee), and LoRa, these larger payloads must be divided into multiple packets. In low-payload LoRa networks, for example, ML-KEM handshakes can require up to 62 packets. This level of fragmentation increases latency and energy consumption, thus potentially affecting reliability. Furthermore, when packet delivery probabilities approaching 99% are achieved, handshake success rates can drop to values approaching 50%. These results suggest that communication metrics, rather than computational performance, pose key challenges to PQC deployment in constrained IoT settings.
The imminent threat of quantum computing necessitates the integration of Post-Quantum Cryptography (PQC) to secure critical infrastructure, particularly within mobile Industrial Internet of Things (IIoT) environments. This study validates the feasibility of such an integration through a detailed performance analysis of a PQC-secured communication architecture. A virtualized testbed was developed to simulate a network of Mobile Manufacturing Trucks (MMTs), acting as IIoT clients using Node-RED, transmitting real-time sensor data to a central Security Operations Center (SOC) running a Mosquitto MQTT broker. The security of the data channel is enhanced via an applicationlayer hybrid scheme that augments a standard TLS connection with the NIST-standardized ML-KEM-768 key encapsulation mechanism, orchestrated by distributed C-based cryptographic services. Performance evaluations of this end-to-end system yielded highly positive results. The mean end-to-end responsiveness was measured at 108.80 ms, successfully meeting the sub- 300 ms requirement for real-time industrial applications. Analysis of the latency distribution revealed a realistic network jitter profile, with a small number of outliers, while the majority of transmissions remained well below 150 ms. Furthermore, CPU utilization on all virtual machines remained minimal, confirming the computational efficiency of ML-KEM for resource-constrained edge devices. These findings provide strong quantitative evidence that a hybrid PQC approach is a viable and performant solution for securing mobile IIoT systems, aligning with the principles of the IEC 62443 standard. This work establishes a practical blueprint for deploying quantum-resistant protocols, with future research directed toward hardware-based validation, the integration of PQC digital signatures, and AI-driven anomaly detection.
The emergence of large-scale quantum computing presents an imminent threat to contemporary public-key cryptosystems, with quantum algorithms such as Shor’s algorithm capable of efficiently breaking RSA and elliptic curve cryptography (ECC). This vulnerability has catalyzed accelerated standardization efforts for post-quantum cryptography (PQC) by the U.S. National Institute of Standards and Technology (NIST) and global security stakeholders. While theoretical security analysis of these quantum-resistant algorithms has advanced considerably, comprehensive real-world performance benchmarks spanning diverse computing environments—from high-performance cloud infrastructure to severely resource-constrained IoT devices—remain insufficient for informed deployment planning. This paper presents the most extensive cross-platform empirical evaluation to date of NIST-selected PQC algorithms, including CRYSTALS-Kyber and NTRU for key encapsulation mechanisms (KEMs), alongside BIKE as a code-based alternative, and CRYSTALS-Dilithium and Falcon for digital signatures. Our systematic benchmarking framework measures computational latency, memory utilization, key sizes, and protocol overhead across multiple security levels (NIST Levels 1, 3, and 5) in three distinct hardware environments and various network conditions. Results demonstrate that contemporary server architectures can implement these algorithms with negligible performance impact (<5% additional latency), making immediate adoption feasible for cloud services. In contrast, resource-constrained devices experience more significant overhead, with computational demands varying by up to 12× between algorithms at equivalent security levels, highlighting the importance of algorithm selection for edge deployments. Beyond standalone algorithm performance, we analyze integration challenges within existing security protocols, revealing that naive implementation of PQC in TLS 1.3 can increase handshake size by up to 7× compared to classical approaches. To address this, we propose and evaluate three optimization strategies that reduce bandwidth requirements by 40–60% without compromising security guarantees. Our investigation further encompasses memory-constrained implementation techniques, side-channel resistance measures, and hybrid classical-quantum approaches for transitional deployments. Based on these comprehensive findings, we present a risk-based migration framework and algorithm selection guidelines tailored to specific use cases, including financial transactions, secure firmware updates, vehicle-to-infrastructure communications, and IoT fleet management. This practical roadmap enables organizations to strategically prioritize systems for quantum-resistant upgrades based on data sensitivity, resource constraints, and technical feasibility. Our results conclusively demonstrate that PQC is deployment-ready for most applications, provided that implementations are carefully optimized for the specific performance characteristics and security requirements of target environments. We also identify several remaining research challenges for the community, including further optimization for ultra-constrained devices, standardization of hybrid schemes, and hardware acceleration opportunities.
The rapid advancement of quantum computing poses significant threats to classical cryptographic methods, such as Rivest–Shamir–Adleman (RSA) and Elliptic Curve Cryptography (ECC), which currently secure Internet of Things (IoT) and cloud communications. Post-Quantum Cryptography (PQC), particularly lattice-based schemes, has emerged as a promising alternative. CRYSTALS-Kyber, standardized by the National Institute of Standards and Technology (NIST) as ML-KEM, has shown efficiency and practicality for constrained IoT devices. Most existing research has focused on PQC within the Transport Layer Security (TLS) protocol. Consequently, a critical gap exists in understanding PQC’s performance in lightweight IoT protocols. These are Message Queuing Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP), particularly under adverse network conditions. To address this gap, this paper provides a systematic review of the literature on the network resilience and performance of CRYSTALS-Kyber when integrated into these protocols operating over lossy and high-latency networks. Additional challenges include non-standardized integration, resource limitations, and side-channel vulnerabilities. This review provides a structured synthesis of current knowledge, highlights unresolved trade-offs between security and efficiency, and outlines future research directions, including protocol-level optimization, lightweight signature schemes, and resilience testing of PQC-secured IoT protocols under realistic conditions.
The expansion of Internet of Things (IoT) ecosystems has created a high demand for secure cryptographic solutions, even in a future with quantum computing capabilities. Traditional mappings, such as RSA or Elliptic Curve Cryptography (ECC), are expected to be broken by Shor's algorithm, driving the realization of post-quantum cryptography (PQC). This work presents a simulative and prototypical framework for assessing PQC integration in IoT communication. With the liboqs library and NS-3 network simulator, along with the Python scripting language, we implement both NIST-standardized algorithms, such as Dilithium (for signatures) and Kyber (for key encapsulation), as well as the classical RSA and ECC baselines. IoT networks of 50-500 virtual nodes are simulated based on IEEE 802.15.4/6LoWPAN with RPL routing. Performance attributes, including encryption/decryption time, key length, packet delivery ratio, latency, and energy consumption, are collected and evaluated. Preliminary results indicate that PQC incurs additional handshake and key overhead, but is relatively practical, with an average overhead of15−25msper processed secure transaction. The effort provides a replicable testbed, showcasing what we consider the best and worst PQC has to offer for resource-constrained IoT. Targeted at master's students and researchers, this book provides an applied approach to investigate quantum-resilient security in IoT. It encourages future expansion to hardware-in-the-loop validation on embedded devices.