Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Performance Analysis and Deployment Considerations of Post-Quantum Cryptography for Consumer Electronics

T0 review · 3 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A cross-platform benchmark of post-quantum algorithms finds that the standardized lattice schemes ML-KEM and ML-DSA offer the best speed-versus-size balance for consumer electronics, with Falcon-512 as the compact option for low-power…

desk verdict A useful confirmatory benchmark on desktop and Linux-capable ARM, but the recommendation table overreaches when it applies Pi 4 results to MCU-class devices. read the letter →

arxiv 2505.02239 v2 pith:X7FADSYT submitted 2025-05-04 cs.CR cs.PF

Daniel Commey , Benjamin Appiah , Griffith S. Klogo , Winful Bagyl-Bac , James D. Gadze , Yousef Alsenani , Garth V. Crosby This is my paper · ORCID
classification cs.CRcs.PF
keywords post-quantumcryptographyconsumerelectronicscryptographicperformancebenchmarkingkeyencapsulationmechanismsdigitalsignaturesML-KEMML-DSAresource-constraineddevices
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish which post-quantum cryptographic algorithms are actually viable for consumer electronics, where processing power, memory, and bandwidth are limited. It reports cross-platform measurements of key encapsulation mechanisms and digital signatures on a high-end Apple M4 system, an Intel x86 desktop, and a Raspberry Pi 4, and compares the results with RSA and ECC baselines. The central finding is that standardized lattice schemes—ML-KEM for key exchange and ML-DSA for signatures—offer the best balance of speed and moderate key/signature sizes across these platforms, making them the most practical near-term choices for most consumer devices. The paper then turns that data into concrete per-device-class recommendations, such as Falcon-512 for low-power wearables and ML-KEM-768/1024 for phones and laptops.

What carries the argument

The carrier of the argument is the cross-platform benchmark itself: a Python harness wrapping a portable C implementation of the PQC algorithms, with classical RSA and ECC baselines supplied by the platform's OpenSSL-backed cryptography stack, each operation repeated roughly 1000 times after warm-up and reported as mean timings. On top of the raw timings, the paper builds a resource trade-off analysis that plots total operation time against communication/storage size (public key plus ciphertext or signature) on the Raspberry Pi, which is what turns isolated timings into a deployment argument. A naming-consolidation step maps the historical Kyber and Dilithium parameter sets onto the official ML-KEM and ML-DSA standard names so that the graphs compare final standardized specifications rather than submission variants.

What would settle it

Measure ML-KEM-512, ML-DSA-44, and Falcon-512 on a Cortex-M-class microcontroller with realistic RAM and energy budgets: if key generation or signing exceeds the latency or memory available on such a chip, or if verification of a 1 kB update takes longer than the device's duty cycle allows, the paper's recommendations for the most constrained device class would not transfer.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that lattice-based standards are the sweet spot for consumer electronics: ML-KEM key generation, encapsulation, and decapsulation complete in under 0.02 ms on the reference macOS platform, and even on the Raspberry Pi the schemes slow down by roughly 30–50× but remain usable, while their public keys and ciphertexts stay in the 0.8–1.6 kB range. ML-DSA similarly offers signing around 0.3 ms and verification around 0.2 ms at security level 3 on the desktop class, with signatures between 2.4 and 4.6 kB. By contrast, Classic McEliece public keys run to 1 MB or more, and SPHINCS+ signatures run to tens of kilobytes, with signing hundreds of milliseconds or slower. From these measurements the paper concludes that manufacturers should prioritize ML-KEM and ML-DSA for most product classes, treat Falcon as the compact-signature option, and reserve SPHINCS+ for firmware verification where signing happens offline.

Load-bearing premise

The load-bearing premise is that the Raspberry Pi 4 is a fair proxy for resource-constrained consumer electronics, so slowdowns measured on it can be extrapolated to wearables and microcontrollers; the paper itself lists true microcontroller benchmarking as future work.

Editorial extensions

If this is right

  • Manufacturers of smart-home hubs, gateways, and similar mid-range devices can adopt ML-KEM-512/768 with ML-DSA-44/65 without redesigning their networks around large keys or slow handshakes.
  • Low-power wearables and microcontroller-class devices should start with ML-KEM-512 and Falcon-512, which carry the smallest latency and size overhead among the robust post-quantum options, with hybrid classical ECDH easing backward compatibility.
  • SPHINCS+ is best reserved for secure-boot and firmware-verification paths, where the slow signing is done once offline and the large signature is outweighed by fast verification and hash-based security assurance.
  • Classic McEliece and FrodoKEM present integration hurdles for typical consumer gear because of megabyte-scale public keys or large ciphertexts, respectively, absent dedicated hardware support.
  • Moving from security level 1 to level 3 or 5 costs a moderate time penalty for lattice schemes but a larger size penalty, so long-lived devices should weigh security margin against bandwidth and storage.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural testable extension is to run the same suite on ARM Cortex-M-class microcontrollers; if ML-KEM-512 or Falcon-512 exceeds the memory or energy budget there, the recommendations for the most constrained device class would need scaling down to lighter or hardware-accelerated variants.
  • The paper's slowdown ratios suggest that energy consumption on constrained devices will track execution time roughly linearly, but direct battery measurements are the only way to confirm which algorithms actually extend or shorten device life.
  • Because lattice verification times grow with message size in the data, designs that frequently verify large payloads on-device may want to pre-hash messages or use hash-based signatures even when lattice signatures look faster on small messages.
  • The cross-platform ratio data also hints that architecture choice matters as much as algorithm choice: on the x86 platform, FrodoKEM and NTRU-Prime fared better relative to the ARM-based macOS, so a manufacturer targeting one CPU family could pick differently than one shipping both.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper benchmarks a broad set of post-quantum KEMs and signature schemes—ML-KEM, ML-DSA, Falcon, SPHINCS+, Classic McEliece, BIKE, HQC, FrodoKEM, MAYO, and CROSS/RSDP—against classical RSA, ECDH/ECDSA, and Ed25519 on three platforms: an Apple M4 Mac mini, an Intel i7-11700 Ubuntu desktop, and a Raspberry Pi 4. It reports execution times, communication/storage artifact sizes, message-size scaling behavior, and derives deployment recommendations in Table IX for several consumer-electronics device classes. The central claim is that NIST-standardized lattice schemes, particularly ML-KEM and ML-DSA, offer the best practical balance of computational efficiency and moderate communication/storage overhead for many consumer electronics applications, while Classic McEliece and SPHINCS+ have size/bandwidth drawbacks.

Significance. If taken at face value, the paper is a useful broad benchmark study for practitioners: it covers both KEMs and signatures, includes multiple NIST security levels, reports per-operation means and standard deviations, uses warm-up and 1000 iterations for most measurements, and makes the benchmark source code available. The qualitative finding that lattice schemes dominate on the time/size trade-off is consistent with the reported data and with the wider PQC literature. The most novel contribution, however, is the device-class-specific deployment guidance, and that guidance is only partially supported: the only 'constrained' platform is a Raspberry Pi 4, and the paper explicitly does not measure RAM footprint. The central claim for desktops and moderately capable embedded Linux devices is well supported, but the recommendations for the most resource-constrained class overreach the evidence.

major comments (3)
  1. [Section IV-A and Table IX] The Raspberry Pi 4 is described as a proxy for 'resource-constrained CE devices' in Section IV-A, and Table IX extends recommendations to 'Low-power / highly constrained (wearables, smart locks, BLE gadgets, MCUs)'. A Cortex-A72 at 1.5 GHz with 4 GB LPDDR4 RAM running Linux is not representative of Cortex-M-class MCUs, which typically have tens to hundreds of kilobytes of SRAM, no MMU, no NEON, and no operating-system-level caching. The paper presents no measurements on such hardware, and Section VII item 1 explicitly lists microcontroller benchmarking as future work. Consequently, the recommendation of Falcon-512 and ML-KEM-512 for the most constrained device class is unsupported by the empirical results, even though those choices are plausible for the Pi-like 'moderately constrained' class.
  2. [Section IV-E and Section VII item 7] The abstract and Section I list memory footprint as an evaluated metric, but Section IV-E states that reliable cross-platform RAM measurement was not achieved and that only 'memory footprint indicators' are used, i.e., public-key/ciphertext/signature sizes. For low-memory devices, stack and heap consumption during operations are decisive; this is especially relevant to Falcon-512, whose reference implementation has substantial RAM requirements that may exceed typical MCU SRAM. The deployment recommendations for low-power devices therefore rest on incomplete evidence. Either add stack/heap measurements on a relevant constrained platform or explicitly narrow the memory-related claims and Table IX accordingly.
  3. [Section V-A and Tables II, XII, XIII] The aggregate slowdown figures in Table II, such as '45-50x slower on the Raspberry Pi', average over very heterogeneous algorithms (e.g., FrodoKEM slowdowns exceeding 100x, ML-KEM slowdowns near 50x, McEliece decapsulation near 19x). While the per-algorithm tables in the appendix mitigate the risk, the main text uses these averages as headline numbers without noting that they are dominated by the slowest families. The authors should either report family-specific aggregates in Section V-A or explicitly caution that these averages are not representative of any single algorithm.
minor comments (5)
  1. [Section IV-C] The consolidation logic maps historical Kyber/Dilithium entries to ML-KEM/ML-DSA names and keeps only the 'official standard' entry. Since the benchmark uses liboqs 0.8.0, the authors should clarify whether those official entries are final FIPS 203/204 implementations or aliases for round-3 Kyber/Dilithium parameter sets, because this affects the exactness of the claim that NIST-standardized algorithm performance was measured.
  2. [Section II, reference [17]] The text cites the 'SUPERCOP project [17]', but reference [17] is an ePrint report on analyzing reference post-quantum software, not the SUPERCOP benchmarking suite. The citation should be corrected or replaced.
  3. [Section IV-B and Table X] For very fast operations such as ML-KEM key generation (around 0.01 ms on macOS), Python wrapper overhead may be non-negligible relative to the measured operation. The paper would benefit from reporting the measured overhead of an empty Python call and providing medians or confidence intervals for these sub-millisecond operations.
  4. [Section V-G and Figure 10] The observation that message-size scaling affects lattice verification more than SPHINCS+ verification is presented as an algorithm-family property, but much of the increase is attributable to the cost of hashing the larger message, which affects all schemes. Clarifying this would prevent readers from over-interpreting the lattice-specific scaling behavior.
  5. [Table VI] Table VI contains over thirty columns and is very difficult to read. Splitting it into separate KEM and signature tables, or transposing it so that operations are rows and algorithms are columns, would substantially improve usability.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is an empirical benchmarking study whose claims rest on direct measurements, not on fitted parameters or self-referential derivations.

full rationale

The paper's central claims are that ML-KEM and ML-DSA provide a strong balance of efficiency and overhead for consumer electronics, that Classic McEliece has large keys, and that SPHINCS+ has large signatures. Every one of these claims is supported by direct wall-clock measurements of external implementations (liboqs 0.8.0 via oqs-python, and OpenSSL 3.3.1 for classical baselines) on fixed NIST algorithm specifications. There is no model, no fitted parameter, no derived equation, and no prediction loop: execution times and sizes are measured, not inferred from any input quantity that is itself defined in terms of the conclusions. The deployment recommendations in Table IX are post-hoc readings of those measurements rather than outputs of a derivation that presupposes the conclusion. The acknowledged limitation that Raspberry Pi 4 measurements may not extrapolate to Cortex-M-class microcontrollers (Section IV-A and Section VII future work item 1) is an external-validity concern about the proxy platform, not a circularity: the paper never defines suitability 'in terms of' Pi 4 performance, and it explicitly flags microcontroller benchmarking as future work rather than claiming to have measured MCU-class devices. No self-citation is load-bearing: the cited prior works are external benchmarks and NIST standards, and the paper's own contribution is independent measured data. Therefore no circular step exists, and the appropriate score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper contributes no new mathematical derivation; it depends on external implementations, on the representativeness of its three test platforms, and on the proxy assumption that timing captures energy impact. These are domain assumptions rather than fitted parameters or invented entities.

assumptions (3)
  • domain assumption liboqs 0.8.0 and the oqs-python wrapper correctly implement the evaluated PQC algorithms, and the Python timing harness accurately measures operation times.
    All performance numbers in Section V and the appendix are produced by this infrastructure (Section IV-B).
  • domain assumption The Raspberry Pi 4 represents the resource-constrained tier of consumer electronics for the purpose of deriving deployment recommendations.
    Section IV-A introduces the Pi 4 as a proxy for smart home hubs and constrained devices; Table IX generalizes these results to wearables and MCUs.
  • domain assumption Wall-clock execution time is an adequate proxy for battery-life and energy impact.
    Section V-C translates slowdowns into latency and energy consequences without direct power measurement; energy is listed as future work in Section VII.3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Performance Analysis and Deployment Considerations of Post-Quantum Cryptography for Consumer Electronics." pith.science (2026). https://pith.science/paper/X7FADSYT

@misc{pith2026250502239,
  author       = {Pith},
  title        = {Pith review of: Performance Analysis and Deployment Considerations of Post-Quantum Cryptography for Consumer Electronics},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X7FADSYT}},
  note         = {Machine review of arXiv:2505.02239}
}
read the original abstract

Quantum computing threatens the security foundations of consumer electronics (CE). Preparing the diverse CE ecosystem, particularly resource-constrained devices, for the post-quantum era requires quantitative understanding of quantum-resistant cryptography (PQC) performance. This paper presents a comprehensive cross-platform performance analysis of leading PQC Key Encapsulation Mechanisms (KEMs) and digital signatures (NIST standards/candidates) compared against classical RSA/ECC. We evaluated execution time, communication costs (key/signature sizes), and memory footprint indicators on high-performance (macOS/M4, Ubuntu/x86) and constrained platforms (Raspberry Pi 4/ARM). Our quantitative results reveal lattice-based schemes, notably NIST standards ML-KEM (Kyber) and ML-DSA (Dilithium), provide a strong balance of computational efficiency and moderate communication/storage overhead, making them highly suitable for many CE applications. In contrast, code-based Classic McEliece imposes significant key size challenges, while hash-based SPHINCS+ offers high security assurance but demands large signature sizes impacting bandwidth and storage. Based on empirical data across platforms and security levels, we provide specific deployment recommendations tailored to different CE scenarios (e.g., wearables, smart home hubs, mobile devices), offering guidance for manufacturers navigating the PQC transition.

Figures

Figures reproduced from arXiv: 2505.02239 by the authors.

Figure 1
Figure 1. Conceptual overview of the post-quantum cryptog [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. Signature Performance Across Platforms ( [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 2
Figure 2. KEM Performance Across Platforms (Execution Time, [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figures from the paper (8 more)
Figure 5
Figure 5. Figure 5: Signature Resource Requirements (Time vs. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: KEM Communication Overhead (Public Key vs. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 8
Figure 8. Figure 8: KEM Performance vs. NIST Security Level (MA [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 9
Figure 9. Figure 9: Signature Performance vs. NIST Security Level [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 10
Figure 10. Figure 10: Impact of message size on signature performance [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: KEM Family Comparison (MACOS). Top: Operation [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 13
Figure 13. Figure 13: KEM performance ratios relative to the macOS reference platform (log scale). Ratios [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: Signature performance ratios relative to the macOS reference platform for a [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Post-Quantum Cryptography and Quantum-Safe Security: A Comprehensive Survey

    cs.CR 2025-10 conditional novelty 3.0 of 10

    A practical reference that maps post-quantum cryptography from mathematical foundations to deployment, including a taxonomy of six algorithm families, NIST status, and performance data.

Reference graph

Works this paper leans on

64 extracted references · 60 canonical work pages · cited by 1 Pith paper

  1. [1]

    Cryptographic algorithm benchmarking in mobile devices,

    V . Keränen, “Cryptographic algorithm benchmarking in mobile devices,” Master’s thesis, V . Keränen, 2014. [Online]. Available: https://oulurepo.oulu.fi/handle/10024/39404

    work page 2014

  2. [2]

    Health care applications: a solution based on the internet of things,

    N. Bui and M. Zorzi, “Health care applications: a solution based on the internet of things,” in Proceedings of the 4th International Symposium on Applied Sciences in Biomedical and Communication Technologies . Barcelona Spain: ACM, Oct. 2011, pp. 1–5

    work page 2011

  3. [3]

    Stallings, Cryptography & Network Security GE

    W. Stallings, Cryptography & Network Security GE. Pearson Australia Pty Limited, 2017

    work page 2017

  4. [4]

    Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,

    P. W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” SIAM review, vol. 41, no. 2, pp. 303–332, 1999

    1999

  5. [5]

    Quantum threat timeline report 2020,

    M. Mosca and M. Piani, “Quantum threat timeline report 2020,” Global Risk Insitute: https://globalriskinstitute. org/publications/quantum-threat-timeline-report-2020, 2021. [On- line]. Available: https://quantum-safe.ca/wp-content/uploads/2023/01/ 2022-quantum-threat-timeline-report-dec.pdf

    work page 2020

  6. [6]

    Grumbling and M

    E. Grumbling and M. Horowitz, Eds., Quantum Computing: Progress and Prospects . Washington, D.C.: National Academies Press, Mar

    work page

  7. [7]

    Post-quantum cryptography,

    D. Bernstein and T. Lange, “Post-quantum cryptography,” NATURE, vol. 549, no. 7671, pp. 188–194, Sep. 2017

    work page 2017

  8. [8]

    Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process,

    G. Alagic, D. Apon, D. Cooper, Q. Dang, T. Dang, J. Kelsey, J. Lichtinger, C. Miller, D. Moody, R. Peralta, R. Perlner, A. Robinson, D. Smith-Tone, and Y .-K. Liu, “Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process,” National Institute of Standards and Technology, Tech. Rep. NIST Internal or Interagency Report ...

    work page 2022

Show all 64 references
  1. [9]

    Module-lattice- based digital signature standard,

    National Institute of Standards and Technology (US), “Module-lattice- based digital signature standard,” National Institute of Standards and Technology (U.S.), Washington, D.C., Tech. Rep. NIST FIPS 204, Aug

  2. [10]

    Stateless hash-based digital signature standard,

    ——, “Stateless hash-based digital signature standard,” National Institute of Standards and Technology (U.S.), Washington, D.C., Tech. Rep. NIST FIPS 205, Aug. 2024. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.205.pdf

    2024

  3. [11]

    Benchmarking Post-quantum Cryptography in TLS,

    C. Paquin, D. Stebila, and G. Tamvada, “Benchmarking Post-quantum Cryptography in TLS,” in Post-Quantum Cryptography, J. Ding and J.-P. Tillich, Eds. Cham: Springer International Publishing, 2020, vol. 12100, pp. 72–91

    2020

  4. [12]

    Post-quantum authentication in TLS 1.3: a performance study,

    D. Sikeridis, P. Kampanakis, and M. Devetsikiotis, “Post-quantum authentication in TLS 1.3: a performance study,” Cryptology ePrint Archive, 2020. [Online]. Available: https://eprint.iacr.org/2020/071

    2020

  5. [13]

    Nist post-quantum cryptography-a hardware evaluation study,

    K. Basu, D. Soni, M. Nabeel, and R. Karri, “Nist post-quantum cryptography-a hardware evaluation study,” Cryptology ePrint Archive ,

  6. [14]

    Performance characterization of post-quantum digital certificates,

    M. Raavi, P. Chandramouli, S. Wuthier, X. Zhou, and S.-Y . Chang, “Performance characterization of post-quantum digital certificates,” in 2021 International Conference on Computer Communications and Networks (ICCCN) . IEEE, 2021, pp. 1–9. [Online]. Available: https://ieeexplor...

    2021

  7. [15]

    A Comparative study of post-quantum cryptosystems for Internet-of-Things applications,

    J.-A. Septien-Hernandez, M. Arellano-Vazquez, M. A. Contreras-Cruz, and J.-P. Ramirez-Paredes, “A Comparative study of post-quantum cryptosystems for Internet-of-Things applications,” Sensors, vol. 22, no. 2, p. 489, 2022. [Online]. Available: https://www.mdpi.com/ 1424-8220/22/2/489

    2022

  8. [16]

    Available: https://eprint.iacr.org/2019/047

    [Online]. Available: https://eprint.iacr.org/2019/047

    2019

  9. [17]

    Analyzing the complexity of reference post-quantum software: the case of lattice-based KEMs,

    D. J. Bernstein, “Analyzing the complexity of reference post-quantum software: the case of lattice-based KEMs,” Cryptology ePrint Archive ,

  10. [18]

    A comparative study of post-quantum cryptographic algorithm implementations for secure and efficient energy systems monitoring,

    G. B. Satrya, Y . M. Agus, and A. B. Mnaouer, “A comparative study of post-quantum cryptographic algorithm implementations for secure and efficient energy systems monitoring,” Electronics, vol. 12, no. 18, p. 3824,

  11. [19]

    Securing the future internet of things with post-quantum cryptography,

    A. Kumar, C. Ottaviani, S. S. Gill, and R. Buyya, “Securing the future internet of things with post-quantum cryptography,” SECURITY AND PRIVACY, vol. 5, no. 2, p. e200, Mar. 2022, _eprint: 2206.10473

    2022 arXiv

  12. [20]

    A Comparative Study on Post-Quantum Cryptographic Digital Signature Algorithms: Network Performance, Key Robustness, and Energy Consumption

    A. S. Lakhan, “A Comparative Study on Post-Quantum Cryptographic Digital Signature Algorithms: Network Performance, Key Robustness, and Energy Consumption.” PhD Thesis, Carleton University, 2023. [Online]. Available: https://repository.library.carleton.ca/concern/etds/3197xn336

    2023

  13. [21]

    VPQC: A domain-specific vector processor for post-quantum cryptography based on RISC-V architecture,

    G. Xin, J. Han, T. Yin, Y . Zhou, J. Yang, X. Cheng, and X. Zeng, “VPQC: A domain-specific vector processor for post-quantum cryptography based on RISC-V architecture,” IEEE transactions on circuits and systems I: regular papers , vol. 67, no. 8, pp. 2672–2684, 2020. [Online]....

    2020

  14. [22]

    RISQ-V: Tightly coupled RISC-V accelerators for post-quantum cryptography,

    T. Fritzmann, G. Sigl, and J. Sepúlveda, “RISQ-V: Tightly coupled RISC-V accelerators for post-quantum cryptography,” IACR Transactions on Cryptographic Hardware and Embedded Systems , pp. 239–280, 2020. [Online]. Available: https://tches.iacr.org/index.php/TCHES/article/view/ 8683

    2020

  15. [23]

    Available: https://www.mdpi.com/2079-9292/12/18/3824

    [Online]. Available: https://www.mdpi.com/2079-9292/12/18/3824

  16. [24]

    Performance Evaluation for a Post-Quantum Public-Key Cryptosystem,

    T. Prantl, D. Prantl, L. Beierlieb, L. Iffländer, A. Dmitrienko, S. Kounev, and C. Krupitzer, “Performance Evaluation for a Post-Quantum Public-Key Cryptosystem,” in 2021 IEEE International Performance, Computing, and Communications Conference (IPCCC) . IEEE, 2021, pp. 1–7. [O...

    2021

  17. [25]

    A fast quantum mechanical algorithm for database search,

    L. Grover, “A fast quantum mechanical algorithm for database search,” in Proceedings of the twenty-eighth annual ACM symposium on Theory of computing - STOC ’96 . ACM Press, 1996, pp. 212–219

    1996

  18. [26]

    Information Security in the Quantum Era. Threats to modern cryptography: Grover’s algorithm,

    M.-Z. Mina and E. Simion, “Information Security in the Quantum Era. Threats to modern cryptography: Grover’s algorithm,” Cryptology ePrint Archive, 2021. [Online]. Available: https://eprint.iacr.org/2021/1662

    2021

  19. [27]

    On lattices, learning with errors, random linear codes, and cryptography,

    O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” Journal of the ACM , vol. 56, no. 6, pp. 1–40, Sep. 2009

    2009

  20. [28]

    A tale of two sieves,

    C. Pomerance, “A tale of two sieves,” Notices of the American Mathematical Society , vol. 43, no. 12, pp. 1473–1485, 1996

    1996

  21. [29]

    M. A. Nielsen and I. L. Chuang, Quantum computation and quantum information. Cambridge university press, 2010

    2010

  22. [30]

    Crystals-dilithium: A lattice-based digital signature scheme,

    L. Ducas, E. Kiltz, T. Lepoint, V . Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehlé, “Crystals-dilithium: A lattice-based digital signature scheme,” IACR Transactions on Cryptographic Hardware and Embedded Systems , pp. 238–268, 2018. [Online]. Available: https://tches.iacr...

    2018

  23. [31]

    Falcon: Fast-Fourier lattice-based compact signatures over NTRU,

    P.-A. Fouque, J. Hoffstein, P. Kirchner, V . Lyubashevsky, T. Pornin, T. Prest, T. Ricosset, G. Seiler, W. Whyte, and Z. Zhang, “Falcon: Fast-Fourier lattice-based compact signatures over NTRU,” Submission to the NIST’s post-quantum cryptography standardization process, vol. 3...

    2018

  24. [32]

    NTRU Prime

    D. J. Bernstein, C. Chuengsatiansup, T. Lange, and C. Van Vredendaal, “NTRU Prime.” IACR Cryptol. ePrint Arch., vol. 2016, p. 461, 2016. [Online]. Available: http://hyperelliptic.org/tanja/vortraege/caen-ntruprime.pdf

    2016

  25. [33]

    A Toolkit for Ring- LWE Cryptography,

    V . Lyubashevsky, C. Peikert, and O. Regev, “A Toolkit for Ring- LWE Cryptography,” in Advances in Cryptology – EUROCRYPT 2013 , D. Hutchison, T. Kanade, J. Kittler, T. Johansson, J. M. Kleinberg, F. Mattern, J. C. Mitchell, M. Naor, O. Nierstrasz, C. Pandu Rangan, B. Steffen,...

    2013

  26. [34]

    CRYSTALS-Kyber: a CCA-secure module-lattice-based KEM,

    J. Bos, L. Ducas, E. Kiltz, T. Lepoint, V . Lyubashevsky, J. M. Schanck, P. Schwabe, G. Seiler, and D. Stehlé, “CRYSTALS-Kyber: a CCA-secure module-lattice-based KEM,” in 2018 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 2018, pp. 353–367. [Online]. Availa...

    2018

  27. [35]

    Post-quantum cryptography based on codes: State of the art and open challenges,

    M. Baldi, P. Santini, and G. Cancellieri, “Post-quantum cryptography based on codes: State of the art and open challenges,” in 2017 AEIT International Annual Conference . IEEE, 2017, pp. 1–6. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/8240549/

    2017

  28. [36]

    BIKE: bit flipping key encapsulation,

    N. Aragon, P. Barreto, S. Bettaieb, L. Bidoux, O. Blazy, J.-C. Deneuville, P. Gaborit, S. Ghosh, S. Gueron, and T. Güneysu, “BIKE: bit flipping key encapsulation,” 2022. [Online]. Available: https://inria.hal.science/hal-04278509/document

    2022

  29. [37]

    Hamming quasi-cyclic (HQC),

    C. A. Melchor, N. Aragon, S. Bettaieb, L. Bidoux, O. Blazy, J.-C. Deneuville, P. Gaborit, E. Persichetti, G. Zémor, and I. C. Bourges, “Hamming quasi-cyclic (HQC),” NIST PQC Round , vol. 2, no. 4, p. 13,

  30. [38]

    On the inherent intractability of certain coding problems (corresp.),

    E. Berlekamp, R. McEliece, and H. Van Tilborg, “On the inherent intractability of certain coding problems (corresp.),” IEEE Transactions 14 on Information theory , vol. 24, no. 3, pp. 384–386, 2003. [Online]. Available: https://ieeexplore.ieee.org/abstract/document/1055873/

    2003

  31. [39]

    A public-key cryptosystem based on algebraic,

    R. J. McEliece, “A public-key cryptosystem based on algebraic,” Coding Thv , vol. 4244, no. 1978, pp. 114–116, 1978. [Online]. Available: https://ntrs.nasa.gov/api/citations/19780016269/downloads/ 19780016269.pdf#page=123

    1978

  32. [40]

    XMSS: extended hash-based signatures. RFC 8391,

    A. T. Hülsing, D. Butin, S.-L. Gazdag, J. Rijneveld, and A. Mohaisen, “XMSS: extended hash-based signatures. RFC 8391,” Request for Comments, 2018

    2018

  33. [41]

    The SPHINCS + Signature framework,

    D. J. Bernstein, A. Hülsing, S. Kölbl, R. Niederhagen, J. Rijneveld, and P. Schwabe, “The SPHINCS + Signature framework,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. London United Kingdom: ACM, Nov. 2019, pp. 2129–2146

    2019

  34. [42]

    SPHINCS+ C: Compressing SPHINCS+ with (almost) no cost,

    M. Kudinov, A. Hülsing, E. Ronen, and E. Yogev, “SPHINCS+ C: Compressing SPHINCS+ with (almost) no cost,” Cryptology ePrint Archive, 2022. [Online]. Available: https://eprint.iacr.org/2022/778

    2022

  35. [43]

    M. R. Garey and D. S. Johnson, Computers and intractability . wh freeman New York, 2002, vol. 29. [Online]. Available: https: //bohr.wlu.ca/hfan/cp412/references/ChapterOne.pdf

    2002

  36. [44]

    Constructing digital signatures from a one way function,

    L. Lamport, “Constructing digital signatures from a one way function,”

  37. [45]

    Breaking Rainbow Takes a Weekend on a Laptop,

    W. Beullens, “Breaking Rainbow Takes a Weekend on a Laptop,” in Advances in Cryptology – CRYPTO 2022 , Y . Dodis and T. Shrimpton, Eds. Cham: Springer Nature Switzerland, 2022, vol. 13508, pp. 464–479

    2022

  38. [46]

    On the Security of the Winternitz One-Time Signature Scheme,

    J. Buchmann, E. Dahmen, A. Hülsing, S. Ereth, and M. Rückert, “On the Security of the Winternitz One-Time Signature Scheme,” in Progress in Cryptology – AFRICACRYPT 2011 , A. Nitaj and D. Pointcheval, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011, vol. 6737, pp. 363–378

    2011

  39. [47]

    SIKE: Supersingular isogeny key encapsulation,

    D. Jao, R. Azarderakhsh, M. Campagna, C. Costello, L. De Feo, B. Hess, A. Jalili, B. Koziel, B. LaMacchia, and P. Longa, “SIKE: Supersingular isogeny key encapsulation,” 2017. [Online]. Available: https://hal.science/hal-02171951/

    2017

  40. [48]

    An Efficient Key Recovery Attack on SIDH,

    W. Castryck and T. Decru, “An Efficient Key Recovery Attack on SIDH,” in Advances in Cryptology – EUROCRYPT 2023 , C. Hazay and M. Stam, Eds. Cham: Springer Nature Switzerland, 2023, vol. 14008, pp. 423–447

    2023

  41. [49]

    Code based Cryptography: Classic McEliece,

    H. Singh, “Code based Cryptography: Classic McEliece,” May 2020, arXiv: 1907.12754

    2020 arXiv

  42. [50]

    A New Variant of the Matsumoto-Imai Cryptosystem through Perturbation,

    J. Ding, “A New Variant of the Matsumoto-Imai Cryptosystem through Perturbation,” in Public Key Cryptography – PKC 2004 , G. Goos, J. Hartmanis, J. Van Leeuwen, F. Bao, R. Deng, and J. Zhou, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2004, vol. 2947, pp. 305–318

    2004

  43. [51]

    J. Ding, J. E. Gower, and D. S. Schmidt, Multivariate public key cryptosystems. Springer Science & Business Media, 2006, vol. 25

    2006

  44. [52]

    Post-quantum Key Exchange for the Internet and the Open Quantum Safe Project,

    D. Stebila and M. Mosca, “Post-quantum Key Exchange for the Internet and the Open Quantum Safe Project,” in Selected Areas in Cryptography – SAC 2016 , R. Avanzi and H. Heys, Eds. Cham: Springer International Publishing, 2017, vol. 10532, pp. 14–37

    2016

  45. [53]

    MAYO: Practical Post-quantum Signatures from Oil-and-Vinegar Maps,

    ——, “MAYO: Practical Post-quantum Signatures from Oil-and-Vinegar Maps,” in Selected Areas in Cryptography , R. AlTawy and A. Hülsing, Eds. Cham: Springer International Publishing, 2022, vol. 13203, pp. 355–376

    2022

  46. [54]

    Energy efficiency analysis of post-quantum cryptographic algorithms,

    C. A. Roma, C.-E. A. Tai, and M. A. Hasan, “Energy efficiency analysis of post-quantum cryptographic algorithms,” IEEE Access , vol. 9, pp. 71 295–71 317, 2021. [Online]. Available: https://ieeexplore.ieee.org/ abstract/document/9424003/

    2021

  47. [55]

    Transitioning organizations to post-quantum cryptography,

    D. Joseph, R. Misoczki, M. Manzano, J. Tricot, F. D. Pinuaga, O. Lacombe, S. Leichenauer, J. Hidary, P. Venables, and R. Hansen, “Transitioning organizations to post-quantum cryptography,” Nature, vol. 605, no. 7909, pp. 237–243, 2022. [Online]. Available: https://idp.nature.c...

  48. [58]

    Hori- zontal Side-Channel Vulnerabilities of Post-Quantum Key Exchange and Encapsulation Protocols,

    F. Aydin, A. Aysu, M. Tiwari, A. Gerstlauer, and M. Orshansky, “Hori- zontal Side-Channel Vulnerabilities of Post-Quantum Key Exchange and Encapsulation Protocols,” ACM Transactions on Embedded Computing Systems, vol. 20, no. 6, pp. 1–22, Nov. 2021

    2021

  49. [60]

    Accelerating post-quantum cryptography using an energy-efficient TLS crypto- processor,

    U. Banerjee, S. Das, and A. P. Chandrakasan, “Accelerating post-quantum cryptography using an energy-efficient TLS crypto- processor,” in 2020 IEEE International Symposium on Circuits and Systems (ISCAS) . IEEE, 2020, pp. 1–5. [Online]. Available: https://ieeexplore.ieee.org/a...

    2020

  50. [63]

    Figure 13a compares the Ubuntu desktop performance to macOS, while Figure 13b compares the resource-constrained Raspberry Pi to macOS

    KEM Performance Ratios: Figures 13a and 13b visually represent the distribution of these performance ratios using box plots for KEM operations (Key Generation, Encapsulation, Decapsulation). Figure 13a compares the Ubuntu desktop performance to macOS, while Figure 13b compares...

  51. [64]

    These plots use the 100 kB message size results as a representative example to show the platform impact on signing and verification for a moderately sized payload

    Signature Performance Ratios: Similarly, Figures 14a and 14b illustrate the performance ratios for signature operations (Key Generation, Signing, Verification) relative to macOS. These plots use the 100 kB message size results as a representative example to show the platform i...

  52. [1979]

    Available: https://www.microsoft.com/en-us/research/ publication/constructing-digital-signatures-one-way-function/

    [Online]. Available: https://www.microsoft.com/en-us/research/ publication/constructing-digital-signatures-one-way-function/

  53. [2018]

    Available: https://pqc-hqc.org/doc/hqc-specification_ 2023-04-30.pdf

    [Online]. Available: https://pqc-hqc.org/doc/hqc-specification_ 2023-04-30.pdf

    2023

  54. [2019]

    Available: https://www.nap.edu/catalog/25196

    [Online]. Available: https://www.nap.edu/catalog/25196

  55. [2023]

    Available: https://eprint.iacr.org/2023/1924

    [Online]. Available: https://eprint.iacr.org/2023/1924

    2023

  56. [2024]

    Available: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST

    [Online]. Available: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST. FIPS.204.pdf

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.