Benchmarking TLS 1.3 with PQC on Realistic Network Conditions
Abstract
We benchmark the TLS 1.3 handshake using post-quantum cryptographic algorithms, including both key encapsulation mechanisms and digital signature schemes, and compare them against traditional, non-quantum-safe counterparts. Our evaluation covers all FIPS-approved post-quantum standards (ML-KEM, ML-DSA, and SLH-DSA), as well as a selection of digital signature schemes from second-round candidates of the NIST PQC competition that are available in the liboqs library from the Open Quantum Safe project. To assess real-world performance, we simulate various network conditions (rate, delay, and losses) and analyze the impact of post-quantum cryptography on TLS connection latency.
Full text
Benchmarking TLS 1.3 with PQC under Realistic Network Conditions Introduction Post-Quantum Cryptography Transport Layer Security (TLS) [1] is the most widely used protocol for securing communications on the Internet. It underpins HTTPS, securing most web traffic, and is also employed in email, VPNs, messaging, and many other protocols. TLS comprises two main components: the handshake protocol, which authenticates peers, negotiates cryptographic parameters, and establishes shared keys; and the record protocol, which uses these parameters to protect application data. Migrating the handshake protocol to a fully quantum-safe variant based on post-quantum cryptography (PQC) will be complex due to the many ecosystem components involved (e.g., HSMs, CAs, web browsers). Reliable testing and benchmarking will be crucial for ensuring a smooth transition. This work was supported by SNSF Practice-to-Science (Grant No. 199084). TLS 1.3 with PQC PQC aims to develop cryptographic algorithms that remain secure against attacks by classical and quantum computers. The U.S. National Institute of Standards and Technology (NIST) has led an open standardization process to select and standardize such algorithms. PQC includes two main types of primitives: key encapsulation mechanisms (KEMs), used to establish shared keys securely, and digital signature (DS) algorithms, used to provide authentication and integrity. The first standards, including ML-KEM and ML-DSA, were published in 2024 [2]. Both primitives are used by the TLS handshake protocol. Realistic Network Simulation Most major TLS libraries already support post-quantum cryptography. For example, OpenSSL natively supports FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA starting with version 3.5.0 (April 2025). Algorithms that are not yet standardized, as well as older OpenSSL versions, can use PQC through the Open Quantum Safe (OQS) provider [3]. Leading web browsers (Chrome, Firefox, Edge, Safari) already support at least one PQC KEM variant (e.g., the hybrid X25519MLKEM768). Nearly 50% of Cloudflare traffic is already encrypted using PQC KEM [4]. The OQS project maintains a public test site [5] offering all PQC DS options for TLS authentication with self-signed certificates. The first certificate authorities (CAs) supporting PQC certificates are expected within the next two years. Results (m)TLS 1.3 handshake protocol Client Server ClientHello 1 Cipher Suites Supported versions Supported groups Key share Signature algorithms ServerHello Certificate CertificateVerify Finished 2 Selected Cipher Suite Key share Server Certificate Chain Signature over TH (HS, Cert) MAC over TH (HS, Cert, CertVerify) Certificate CertificateVerify Finished Application Data 3 Client Certificate Chain Signature over TH (HS, Cert) MAC over TH (HS, Cert, CertVerify) veth1 ns1 veth2 ns2 netem Rate Delay Losses It is possible to perform realistic network simulations by leveraging Linux network namespaces (ns), virtual ethernet (veth) device pairs, and the netem queueing discipline, which provides network emulation functionality by reproducing real-world network properties (e.g., rate, delay, loss, duplication, packet corruption). [6] Acknowledgements References [1] E. Rescorla (2018). The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446. Internet Engineering Task Force (IETF). DOI: https://doi.org/10.17487/RFC8446 [2] National Institute of Standards and Technology (NIST). FIPS Publications. Computer Security Resource Center (CSRC). [Online, 30.09.2025]. Available: https://csrc.nist.gov/publications/fips [3] Open Quantum Safe. oqs-provider: OpenSSL 3 provider containing post-quantum algorithms. [Online, 30.09.2025]. Available: https://github.com/open-quantum-safe/oqs-provider [4] Cloudflare. Post-quantum encryption adoption — Adoption & Usage Worldwide. Cloudflare Radar. [Online, 30.09.2025]. Available: https://radar.cloudflare.com/adoption-and-usage [5] Open Quantum Safe. Open Quantum Safe interop test server for quantum-safe cryptography. [Online, 01.10.2025]. Available: https://test.openquantumsafe.org/ [6] Paquin, C., Stebila, D., Tamvada, G. (2020). Benchmarking Post-quantum Cryptography in TLS. In: Ding, J., Tillich, JP. (eds) Post-Quantum Cryptography. PQCrypto 2020. Lecture Notes in Computer Science, vol 12100. Springer, Cham. DOI: https://doi.org/10.1007/978-3-030-44223-1_5 Iyán Méndez Veiga1,2 1Lucerne University of Applied Sciences and Arts 2ETH Zürich RSA-2048 X25519 Ed25519 X25519 ML-DSA-44 ML-KEM-768 ML-DSA-65 ML-KEM-768 ML-DSA-87 ML-KEM-768 ML-DSA-44 + RSA 2048 X25519MLKEM768 ML-DSA-44 + Ed25519 X25519MLKEM768 ML-DSA-65 + Ed25519 X25519MLKEM768 0 50 100 150 200 250 300 TLS handshake (ms) 101.7 101.6 101.4 151.4 151.5 152.0 101.8 152.6 101.3 101.6 101.5 151.7 152.1 152.4 102.2 152.8 217.1 101.6 201.4 201.9 267.6 251.7 202.4 268.3 Traditional vs PQ TLS 1.3 with RTT 25 ms (90th percentile) 0% loss 1% loss 2% loss 0 1 2 3 4 5 rsa_2048 ed25519 mayo1 mayo2 mayo3 mayo5 p256_mayo1 p256_mayo2 p384_mayo3 p521_mayo5 0 ms delay, 0% loss 0 10 20 30 40 50 60 70 rsa_2048 ed25519 mayo1 mayo2 mayo3 mayo5 p256_mayo1 p256_mayo2 p384_mayo3 p521_mayo5 x4 packets x6 packets 10 ms delay, 0% loss TLS handshake (ms) pqc.crypto-lab.ch