With classical cryptographic algorithms under threat from the development of quantum computing, the transition to quantum-resistant replacements is critical to network security worldwide. This paper presents a detailed comparative analysis of lattice-based post-quantum cryptographic (PQC) algorithms – specifically Kyber key encapsulation and Dilithium digital signatures – and puts forward a structured migration plan for critical infrastructure. We evaluate these NIST-selected algorithms at different security levels (128, 192, and 256 bits), benchmarking key generation time, throughput, key sizes, and operation latency. Our integration demonstrates transparent incorporation of these algorithms into TLS 1.3 and SSH protocols with 100% handshake success rates. Performance results indicate Kyber achieves 3-4× higher throughput (800-1150 ops/sec) and significantly smaller key sizes than Dilithium, with both offering similar security levels against quantum attacks. Furthermore, we provide an overall migration plan analysis, estimating an average implementation duration of 10.4 months per system type and total migration costs of approximately $724,122, in which databases require the largest amount of adjustment. Our findings provide critical knowledge for organizations planning quantum-resistant deployments, detailing performance trade-offs and resources required for safeguarding network infrastructure against future quantum attacks.
With classical cryptographic algorithms under threat from the development of quantum computing, the transition to quantum-resistant replacements is critical to network security worldwide. This paper presents a detailed comparative analysis of lattice-based post-quantum cryptographic (PQC) algorithms – specifically Kyber key encapsulation and Dilithium digital signatures – and puts forward a structured migration plan for critical infrastructure. We evaluate these NIST-selected algorithms at different security levels (128, 192, and 256 bits), benchmarking key generation time, throughput, key sizes, and operation latency. Our integration demonstrates transparent incorporation of these algorithms into TLS 1.3 and SSH protocols with 100% handshake success rates. Performance results indicate Kyber achieves 3-4× higher throughput (800-1150 ops/sec) and significantly smaller key sizes than Dilithium, with both offering similar security levels against quantum attacks. Furthermore, we provide an overall migration plan analysis, estimating an average implementation duration of 10.4 months per system type and total migration costs of approximately $724,122, in which databases require the largest amount of adjustment. Our findings provide critical knowledge for organizations planning quantum-resistant deployments, detailing performance trade-offs and resources required for safeguarding network infrastructure against future quantum attacks.
A sufficiently capable quantum computer would break the public-key cryptography that secures the modern internet, and data captured today can be stored until that machine arrives. This harvest-now-decrypt-later threat has pushed standards bodies to act well ahead of the hardware. In 2024 NIST published the first finished post-quantum standards: ML-KEM, derived from CRYSTALS-Kyber, for key establishment, and ML-DSA, derived from CRYSTALS-Dilithium, for digital signatures. This paper examines how these algorithms move into the two protocols that carry most secured traffic, TLS 1.3 and IPsec. We describe the hybrid handshake that runs a classical and a post-quantum key-encapsulation mechanism side by side, we measure the cost of the larger keys and signatures these schemes carry, and we discuss the practical friction points such as oversized certificate chains and fragmented handshake records. Benchmarks reported in the literature show that a hybrid X25519 plus Kyber-768 handshake adds only a small latency penalty on a healthy network, while Dilithium signatures inflate the certificate path enough to matter on constrained links. We close with a staged migration plan built around crypto-agility.
As quantum computing advances, modern cryptographic standards face an existential threat, necessitating a transition to post-quantum cryptography (PQC). The National Institute of Standards and Technology (NIST) has selected CRYSTALS-Kyber and CRYSTALS-Dilithium as standardized PQC algorithms for secure key exchange and digital signatures, respectively. This study conducts a comprehensive performance analysis of these algorithms by benchmarking execution times across cryptographic operations such as key generation, encapsulation, decapsulation, signing, and verification. Additionally, the impact of AVX2 optimizations is evaluated to assess hardware acceleration benefits. Our findings demonstrate that Kyber and Dilithium achieve efficient execution times, outperforming classical cryptographic schemes such as RSA and ECDSA at equivalent security levels. Beyond technical performance, the real-world deployment of PQC introduces challenges in telecommunications networks, where large-scale infrastructure upgrades, interoperability with legacy systems, and regulatory constraints must be addressed. This paper examines the feasibility of PQC adoption in telecom environments, highlighting key transition challenges, security risks, and implementation strategies. Through industry case studies, we illustrate how telecom operators are integrating PQC into 5G authentication, subscriber identity protection, and secure communications. Our analysis provides insights into the computational trade-offs, deployment considerations, and standardization efforts shaping the future of quantum-safe cryptographic infrastructure.
Quantum computing challenges the mathematical problems anchoring the security of the classical public key algorithms. For quantum-resistant public key algorithms, the National Institute of Standards and Technology (NIST) has undergone a multi-year standardization process and selected the post-quantum cryptography (PQC) public key digital signatures of Dilithium, Falcon, and SPHINCS+. Finding common ground to compare these algorithms can be difficult because of their design differences, including the fundamental math problems (lattice-based vs. hash-based). We use a visualization model to show the key/signature size vs. security trade-offs for all PQC algorithms. Our performance analyses compare the algorithms’ computational loads in the execution time. Building on the individual algorithms’ analyses, we analyze the communication costs and implementation overheads when integrated with Public Key Infrastructure (PKI) and with Transport Layer Security (TLS) and Transmission Control Protocol (TCP)/Internet Protocol (IP). Our results show that the lattice-based algorithms of Dilithium and Falcon induce lower computational overheads than the hash-based algorithms of SPHINCS+. In addition, the lattice-based PQC can outperform the classical algorithm with comparable security strength; for example, Dilithium 2 and Falcon 512 outperform RSA 4096 in the TLS handshake time duration.
The emergence of large-scale quantum computing presents an imminent threat to contemporary public-key cryptosystems, with quantum algorithms such as Shor’s algorithm capable of efficiently breaking RSA and elliptic curve cryptography (ECC). This vulnerability has catalyzed accelerated standardization efforts for post-quantum cryptography (PQC) by the U.S. National Institute of Standards and Technology (NIST) and global security stakeholders. While theoretical security analysis of these quantum-resistant algorithms has advanced considerably, comprehensive real-world performance benchmarks spanning diverse computing environments—from high-performance cloud infrastructure to severely resource-constrained IoT devices—remain insufficient for informed deployment planning. This paper presents the most extensive cross-platform empirical evaluation to date of NIST-selected PQC algorithms, including CRYSTALS-Kyber and NTRU for key encapsulation mechanisms (KEMs), alongside BIKE as a code-based alternative, and CRYSTALS-Dilithium and Falcon for digital signatures. Our systematic benchmarking framework measures computational latency, memory utilization, key sizes, and protocol overhead across multiple security levels (NIST Levels 1, 3, and 5) in three distinct hardware environments and various network conditions. Results demonstrate that contemporary server architectures can implement these algorithms with negligible performance impact (<5% additional latency), making immediate adoption feasible for cloud services. In contrast, resource-constrained devices experience more significant overhead, with computational demands varying by up to 12× between algorithms at equivalent security levels, highlighting the importance of algorithm selection for edge deployments. Beyond standalone algorithm performance, we analyze integration challenges within existing security protocols, revealing that naive implementation of PQC in TLS 1.3 can increase handshake size by up to 7× compared to classical approaches. To address this, we propose and evaluate three optimization strategies that reduce bandwidth requirements by 40–60% without compromising security guarantees. Our investigation further encompasses memory-constrained implementation techniques, side-channel resistance measures, and hybrid classical-quantum approaches for transitional deployments. Based on these comprehensive findings, we present a risk-based migration framework and algorithm selection guidelines tailored to specific use cases, including financial transactions, secure firmware updates, vehicle-to-infrastructure communications, and IoT fleet management. This practical roadmap enables organizations to strategically prioritize systems for quantum-resistant upgrades based on data sensitivity, resource constraints, and technical feasibility. Our results conclusively demonstrate that PQC is deployment-ready for most applications, provided that implementations are carefully optimized for the specific performance characteristics and security requirements of target environments. We also identify several remaining research challenges for the community, including further optimization for ultra-constrained devices, standardization of hybrid schemes, and hardware acceleration opportunities.
The development of quantum computing technology is progressing very quickly, which poses a great threat to classical cryptographic algorithms like RSA and ECC, as they are based on mathematical problems that can be easily solved using quantum computing technology. To overcome the threat of quantum computing technology, the need for PQC algorithms like CRYSTALS Kyber, CRYSTALS Dilithium, Falcon, and SPHINCS+, which are standardized or recommended by NIST, has become essential in the era of cybersecurity. The feasibility of these algorithms in real time applications is the main focus of this thesis. A mixed approach is adopted for this purpose. Benchmark experiments were performed using the Open Quantum Safe library and PQC enabled OpenSSL for key generation, encryption, decryption, signature generation, signature verification, and TLS handshakes. Simulated environment and cloud environment were used for this purpose. Moreover, case studies were also conducted for cloud computing, financial sector, and IoT applications. Additionally, threat modeling is also performed for assessing the migration risks, i.e., “harvest now decrypt later.” The results indicate that the lattice-based methods, like Kyber and Dilithium, offer a robust trade off in terms of performance and security, albeit with increased key and signature sizes compared to classical methods. Hash based methods, like SPHINCS+, offer robust security, albeit with significant performance and size overheads, indicating that they are best used in specific circumstances. Hybrid approaches, using classical as well as quantum methods, were indicated as viable in the transition from classical to quantum methods, especially in circumstances that require backward compatibility. The paper concludes that NIST standardized PQC algorithms are technically viable for contemporary applications, especially in cloud computing and high-performance computing. However, for large-scale implementation, proper engineering and monitoring of developments in crypt analysis need to be performed. Future research should be directed towards implementation optimization, migration frameworks, and further studies in real-world implementations, especially for resource-constrained IoT and legacy system applications.
Currently available cryptographic algorithms such as the RSA, Diffie-Hellman and the ECC are used in securing most Internet communications across the Internet. Theoretical quantum algorithms (and the Shor algorithm in particular) were demonstrated to be able to efficiently break that type of classical cryptography as soon as large-scale quantum computers are developed. To handle this new emerging security problem, PQC has been proposed as a class of cryptographic algorithms that is resistant to both quantum and classical attackers. It is a research paper offering and experimentally implementing a hybrid PQC-TLS protocol in a heterogeneous network architecture which includes edge computing devices and cloud computing and IoT devices. The suggested architecture integrates both lattice-based CRYSTALS-Kyber key encapsulation scheme and CRYSTALS-Dilithium digital signature scheme in the TLS 1.3 handshake without being interoperable with the older ECC-based key exchange schemes. Five measures of performance that included handshake latency, CPU consumption, memory consumption, bandwidth overhead and energy consumption were analyzed in detail through experimentation. The experiments were conducted using in Iot, edge and cloud nodes under controlled conditions that were repeated a number of times to give reliability in the statistics. The results indicate that the integration of PQC has moderate overhead (mean increase in latency about 1517) and decent computational and energy requirements. Another method of resisting popular attacks on networks like as the man in the middle, replay, and downgrade attacks, is security validation. The findings indicate that quantum resilient secure communication migration to a heterogeneous distributed infrastructure can be practically and scalably provided using hybrid PQC-TLS protocols. Statistical analysis including standard deviation and 95% confidence intervals was performed to validate the reliability of the results.