Pith. sign in

REVIEW 2 major objections 5 minor 25 references

Lattice-based post-quantum signatures keep TLS energy and latency far lower than hash-based ones on embedded 5G devices, because crypto compute—not the network—dominates cost.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 22:29 UTC pith:BWFHM3KT

load-bearing objection Solid measurement paper that finally puts energy + concurrency numbers on NIST PQC-TLS for Pi-class 5G UEs; lattice signatures clearly win over SLH-DSA, and the relative ordering holds even with the PMIC caveats. the 2 major comments →

arxiv 2607.03988 v1 pith:BWFHM3KT submitted 2026-07-04 cs.CR cs.PF

Energy-Aware System-Level Evaluation of Post-Quantum TLS on Embedded User Equipment over a Disaggregated 5G Network

Sanzida Hoque , Abdullah Aydeger This is my paper
classification cs.CR cs.PF
keywords post-quantum cryptographyTLS5Guser equipmentenergy efficiencylatencyembedded systemsML-KEM
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper sets out to measure how NIST-standardized post-quantum cryptography behaves when it is actually run inside TLS handshakes on small embedded user equipment attached to a disaggregated 5G path. Using Raspberry Pi 5 boards as the UEs and direct on-board power readings, it compares classical and post-quantum key-exchange and signature combinations under increasing numbers of concurrent clients. The central finding is that signature choice, not key exchange, drives most of the cost: hash-based signatures produce up to four times the latency and roughly twice the energy of lattice-based ones, while overall performance remains limited by cryptographic computation and contention rather than network transport. Energy per handshake tracks execution time almost directly. A sympathetic reader cares because mobile networks must adopt quantum-resistant security on battery- and thermally constrained devices; the measurements give concrete, system-level guidance on which primitives remain practical.

Core claim

On embedded UEs over a disaggregated 5G user plane, lattice-based signatures (Falcon/ML-DSA) keep TLS handshake latency and energy close to classical baselines across concurrency, whereas hash-based SLH-DSA incurs up to 4 imes higher latency and 2 imes energy; execution time is the dominant energy driver and cryptographic computation plus concurrency contention dominate over network transport.

What carries the argument

End-to-end PQC-TLS handshake evaluation on Raspberry Pi 5 UEs instrumented with onboard PMIC power telemetry, exercised under controlled concurrency (1–40 clients) across NIST-standardized KEM+signature suites over an emulated UERANSIM/Open5GS 5G data path.

Load-bearing premise

That onboard PMIC readings on Raspberry Pi 5s plus an emulated radio-and-core path without real over-the-air radio are accurate enough proxies for real embedded UE energy and system behavior under concurrent post-quantum TLS load.

What would settle it

Repeat the same concurrency sweep with external shunt-based or dedicated power-analyzer measurements on the same devices (or real commercial UEs) and with over-the-air radio; if lattice-based schemes no longer show materially lower energy and latency than SLH-DSA, or if network effects overtake crypto compute, the central claim fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Lattice-based signatures (Falcon or ML-DSA) paired with ML-KEM are the practical default for PQC-TLS on resource-limited 5G UE platforms.
  • Hash-based signatures require hardware acceleration or offload before they can serve high-concurrency or latency-sensitive 5G sessions.
  • Reducing handshake latency is the most direct route to lowering energy cost; peak-power optimization alone is secondary.
  • System capacity under PQC is set by cryptographic processing throughput, so admission control or load balancing becomes necessary once concurrency exceeds core count.
  • Network-stack improvements alone will not remove the dominant PQC overhead observed here.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Handset and edge-gateway designers will need to budget CPU and thermal headroom specifically for signature verification rather than for KEMs.
  • The same latency–energy coupling is likely to appear in other mobile security protocols (e.g., SUCI, IPsec) once post-quantum primitives are inserted.
  • Hybrid classical+PQC suites may remain attractive only while the lattice-based component stays near classical cost; once hash-based signatures are required, hybrid gains shrink.
  • Future standards profiles for 5G/6G could usefully list recommended PQC algorithm pairs ranked by measured energy-per-handshake rather than by asymptotic security alone.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. This paper presents a system-level experimental evaluation of classical and NIST-standardized post-quantum TLS 1.3 handshakes on Raspberry Pi 5 devices acting as 5G UEs over a disaggregated UERANSIM/Open5GS data path. Using BoringSSL+liboqs, the authors measure client-observed latency, server throughput, per-connection energy (from onboard PMIC averages), CPU, power, temperature, RTT and retransmissions across signature/KEM combinations and concurrency levels C∈{1,4,10,20,40}. The central claims are that signature choice dominates cost (SLH-DSA up to ~4× latency and ~2× energy versus Falcon/ML-DSA), energy is tightly coupled to execution time, and performance is limited by cryptographic computation and concurrency-induced contention rather than network transport.

Significance. If the comparative results hold, the work supplies concrete, system-level guidance for PQC algorithm selection on resource-constrained 5G edge platforms: lattice-based signatures (Falcon/ML-DSA) remain near classical performance under concurrent load while hash-based SLH-DSA saturates early. The combination of an end-to-end 5G user-plane path, multi-UE concurrency stress, and on-device energy/thermal telemetry fills a gap left by isolated crypto benchmarks and protocol-only studies. Strengths include a transparent experimental design, explicit measurement-limitation discussion (§IV-B5), systematic tables (I–III), and the latency–energy correlation (Fig. 2) that makes the lattice-vs-hash ordering robust even under absolute-power uncertainty.

major comments (2)
  1. [§IV-B2, Table I, §IV-B5] §IV-B2 and Table I: Energy per connection is obtained as (average PMIC power × wall-clock duration) / completed handshakes. With 100 ms sampling and stated ±5–10 % absolute error (§IV-B5), short cryptographic bursts can be under-sampled and the same averaging method is applied across handshake durations that differ by >20×. Absolute mJ/conn values and the precise “2× energy” claim therefore inherit a systematic bias risk. Relative ordering remains credible because gaps exceed the stated error and track latency (Fig. 2), but any numeric energy multiplier quoted in the abstract and conclusions should be qualified or supported by a sensitivity check (e.g., higher-rate sampling on a subset of configurations).
  2. [§IV-B1, Table I, §IV-C6] §IV-B1 and Table I: Under saturation (especially HQC+SLH-DSA at C=40) a substantial fraction of handshakes fail to complete; metrics are normalized only by completed handshakes. While the paper correctly flags incomplete execution, the abstract and design-implication claims about “scalability” and “energy cost” do not report completion rates or energy amortized over attempted handshakes. Without those numbers the practical cost of hash-based schemes under overload is understated. Adding completion-rate columns (or a short appendix table) would make the saturation regime fully interpretable.
minor comments (5)
  1. [Abstract, §I] Abstract and §I claim “up to 4x higher latency and 2x energy”; Table I shows latency ratios near 4× at C=40 but energy ratios closer to 1.4–2× depending on KEM. Soften or cite the exact rows used for the factor.
  2. [Fig. 2] Fig. 2 caption and legend are clear, but marker sizes for C=1 vs C=40 overlap in dense clusters; a small offset or separate panels would improve readability.
  3. [Table II] Table II color coding for CPU/power is helpful; temperature is left uncoded even though a plateau near 68–70 °C is discussed. A brief note that all values stay below the 80 °C throttle threshold would suffice.
  4. [§II] Related-work §II correctly positions the contribution relative to prior 5G and embedded PQC studies; a one-sentence contrast with the authors’ own LCN 2025 paper [20] on what is newly measured (energy/thermal/concurrency) would help readers.
  5. [§IV-B5, Table I footnote] Minor typography: “V alidity” (§IV-B5 heading) contains a stray space; “FN-DSA” parenthetical for Falcon is non-standard and can be dropped.

Circularity Check

0 steps flagged

No significant circularity; purely empirical measurement study with independent testbed results.

full rationale

This paper reports direct experimental measurements of TLS handshake latency, throughput, energy, CPU, temperature, retransmissions and RTT for classical and NIST PQC suites on Raspberry Pi 5 UEs over a UERANSIM/Open5GS path. Energy per connection is computed from onboard PMIC average power times wall-clock duration normalized by completed handshakes (Section IV-B2); the observed latency-energy correlation (Fig. 2) and the 2-4x gaps between SLH-DSA and lattice signatures are therefore measured outcomes, not definitional identities or fitted parameters later re-labeled as predictions. Self-citations (e.g., prior work [20]) supply only background context and tooling; the quantitative claims rest on the new Tables I-III data collected under the stated concurrency model. No uniqueness theorems, ansatzes, or self-referential definitions appear. The study is self-contained against its own instrumentation and does not reduce any central claim to its inputs by construction.

Axiom & Free-Parameter Ledger

2 free parameters · 4 axioms · 0 invented entities

Empirical systems paper; almost all load-bearing content is measured rather than postulated. The few background assumptions are standard domain practice (NIST algorithm definitions, TLS 1.3 handshake model, UERANSIM/Open5GS as a faithful enough 5G data-path proxy). No free parameters are fitted to produce the central claims; concurrency levels and sampling interval are experimental design choices, not fitted constants. No new physical or cryptographic entities are invented.

free parameters (2)
  • concurrency set C ∈ {1,4,10,20,40}
    Hand-chosen operating points that define the load regimes; results are reported only at these discrete points.
  • PMIC sampling interval 100 ms
    Hardware telemetry rate that may smooth short crypto bursts; absolute energy inherits the resulting quantization.
axioms (4)
  • domain assumption NIST FIPS 203/204/205 algorithm definitions and security levels (ML-KEM-512, ML-DSA-44, Falcon-512, SLH-DSA-SHA2-128f) are the correct reference implementations for evaluation.
    Invoked throughout §II and §IV; all reported combinations rest on these standardized parameter sets.
  • domain assumption On-board Raspberry Pi 5 PMIC voltage/current estimates are sufficiently accurate for relative energy comparisons (±5-10 % absolute error acknowledged).
    Stated in §IV-B5; energy-per-connection figures are derived directly from these readings.
  • domain assumption UERANSIM + Open5GS emulated path with GTP-U encapsulation captures the relevant 5G user-plane effects for cryptographic-cost evaluation (radio PHY/MAC effects can be ignored).
    Architecture §III and limitations §IV-B5; all handshakes traverse this path rather than a real air interface.
  • ad hoc to paper Completed handshakes (not attempted) are the correct normalization base for latency, throughput and energy metrics under overload.
    Explicit methodological choice in §IV-B1; affects high-concurrency energy and retransmission interpretation.

pith-pipeline@v1.1.0-grok45 · 18708 in / 2895 out tokens · 25921 ms · 2026-07-11T22:29:00.458259+00:00 · methodology

0 comments
read the original abstract

The transition to quantum-resistant security is a critical priority for the next generation of mobile networks, particularly within the disaggregated architecture of 5G. This paper presents an energy-aware system-level evaluation of Post- Quantum Cryptography (PQC) integrated into the Transport Layer Security (TLS) handshake on embedded User Equipment (UE). Using Raspberry Pi 5s as representative embedded processing platforms, we evaluate the performance of NIST-standardized combinations of classical and post-quantum signature and key exchange mechanisms (KEM), incorporating direct on-device power measurements to estimate per-handshake energy consumption. Results experimentally validate a strong coupling between latency and energy consumption, indicating that execution time is the dominant contributor to energy cost. Hash-based signature schemes incur up to 4x higher latency and 2x energy compared to lattice-based alternatives, while the impact of KEMs is comparatively smaller. The analysis further reveals that overall system performance is primarily constrained by cryptographic computation and concurrency-induced contention rather than network transport effects. These findings provide practical guidance for PQC deployment in mobile environments and demonstrate that lattice-based signatures offer a more favorable balance between security, efficiency, and scalability for 5G systems.

Figures

Figures reproduced from arXiv: 2607.03988 by Abdullah Aydeger, Sanzida Hoque.

Figure 1
Figure 1. Figure 1: Disaggregated 5G PQC Testbed Architecture. The red [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Latency-energy relationship for classical and post [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Retransmissions versus concurrent client UEs across signature schemes and KEMs. Each subplot shows a signature [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

25 extracted references

  1. [1]

    Evaluating transport layer security 1.3 optimization strategies for 5g cross-border roaming: A comprehensive security and performance analysis,

    J. K. Lastre, Y . Ko, H. Kwon, and I. You, “Evaluating transport layer security 1.3 optimization strategies for 5g cross-border roaming: A comprehensive security and performance analysis,”Sensors, vol. 25, no. 19, p. 6144, 2025

    2025

  2. [2]

    Exploring post quantum cryp- tography with quantum key distribution for sustainable mobile network architecture design,

    S. Hoque, A. Aydeger, and E. Zeydan, “Exploring post quantum cryp- tography with quantum key distribution for sustainable mobile network architecture design,” inProceedings of the 4th workshop on performance and energy efficiency in concurrent and distributed systems, pp. 9–16, 2024

    2024

  3. [3]

    Post-quantum cryptog- raphy

    National Institute of Standards and Technology, “Post-quantum cryptog- raphy.” https://csrc.nist.gov/projects/post-quantum-cryptography, 2024

    2024

  4. [4]

    Status report on the fourth round of the nist post-quantum cryptography standardization process,

    G. Alagic, M. Bros, P. Ciadoux, D. Cooper, Q. Dang, T. Dang, J. Kelsey, J. Lichtinger, Y .-K. Liu, C. Miller, D. Moody, R. Peralta, R. Perlner, A. Robinson, H. Silberg, D. Smith-Tone, and N. Waller, “Status report on the fourth round of the nist post-quantum cryptography standardization process,” Tech. Rep. NIST IR 8545, National Institute of Standards an...

    2025

  5. [5]

    Module-Lattice-Based Key-Encapsulation Mechanism Standard,

    National Institute of Standards and Technology, “Module-Lattice-Based Key-Encapsulation Mechanism Standard,” Federal Information Process- ing Standard FIPS 203, National Institute of Standards and Technology, Aug. 2024. Planning note (Nov. 17, 2025): future revision anticipated; see errata documentation

    2024

  6. [6]

    Module-Lattice-Based Digital Signature Standard,

    National Institute of Standards and Technology, “Module-Lattice-Based Digital Signature Standard,” Federal Information Processing Standard FIPS 204, National Institute of Standards and Technology, Aug. 2024. Published August 13, 2024; planning note indicates minor errata to be addressed in a future revision

    2024

  7. [7]

    Stateless Hash-Based Digital Signature Standard,

    National Institute of Standards and Technology, “Stateless Hash-Based Digital Signature Standard,” Federal Information Processing Standard FIPS 205, National Institute of Standards and Technology, Aug. 2024. Published August 13, 2024

    2024

  8. [8]

    Comparative analysis of post- quantum handshake performance in quic and tls protocols,

    J. A. Montenegro, R. Rios, and J. Bonilla, “Comparative analysis of post- quantum handshake performance in quic and tls protocols,”Computer Networks, p. 111957, 2025

    2025

  9. [9]

    Faster post-quantum tls 1.3 based on ml-kem: Implementation and assessment,

    J. Zheng, H. Zhu, Y . Dong, Z. Song, Z. Zhang, Y . Yang, and Y . Zhao, “Faster post-quantum tls 1.3 based on ml-kem: Implementation and assessment,” inEuropean Symposium on Research in Computer Security, pp. 123–143, Springer, 2024

    2024

  10. [10]

    Energy consumption evaluation of post-quantum tls 1.3 for resource-constrained embedded devices,

    G. Tasopoulos, C. Dimopoulos, A. P. Fournaris, R. K. Zhao, A. Sakzad, and R. Steinfeld, “Energy consumption evaluation of post-quantum tls 1.3 for resource-constrained embedded devices,” inProceedings of the 20th ACM International Conference on Computing Frontiers, pp. 366–374, 2023

    2023

  11. [11]

    Post quantum cryptography analysis of tls tunneling on a constrained device.,

    J. Barton, W. J. Buchanan, N. Pitropakis, S. Sayeed, and W. Abramson, “Post quantum cryptography analysis of tls tunneling on a constrained device.,” inICISSP, pp. 551–561, 2022

    2022

  12. [12]

    The impact of data-heavy, post- quantum tls 1.3 on the time-to-last-byte of real-world connections,

    P. Kampanakis and W. Childs-Klein, “The impact of data-heavy, post- quantum tls 1.3 on the time-to-last-byte of real-world connections,” Cryptology ePrint Archive, 2024

    2024

  13. [13]

    Protecting chrome traffic with hybrid ky- ber kem,

    Google Chromium Team, “Protecting chrome traffic with hybrid ky- ber kem,” 2023. https://blog.chromium.org/2023/08/protecting-chrome- traffic-with-hybrid.html

    2023

  14. [14]

    State of the post-quantum internet in 2025,

    B. Westerbaan, “State of the post-quantum internet in 2025,” 2025. Online; accessed 26-Apr-2026

    2025

  15. [15]

    Post-quantum cryptography implementation considera- tions in tls,

    J. Schaumann, “Post-quantum cryptography implementation considera- tions in tls,” August 2025. Accessed: 2026-04-25

    2025

  16. [16]

    Energy consumption framework and analysis of post-quantum key-generation on embedded devices,

    J. C. Patterson, W. J. Buchanan, and C. Turino, “Energy consumption framework and analysis of post-quantum key-generation on embedded devices,”Journal of Cybersecurity and Privacy, vol. 5, no. 3, p. 42, 2025

    2025

  17. [17]

    Hybrid ml-kem in tls 1.3: Performance analysis on arm64 under network stress,

    C. ˙Ince, “Hybrid ml-kem in tls 1.3: Performance analysis on arm64 under network stress,”Computer Science, no. 2026, 2026

    2026

  18. [18]

    Integrating and benchmarking kpqc in tls/x. 509,

    M. Sim, G. Song, S. Eum, M. Lee, S. Yoon, A. Baksi, and H. Seo, “Integrating and benchmarking kpqc in tls/x. 509,”Electronics, vol. 14, no. 18, p. 3717, 2025

    2025

  19. [19]

    Post-quantum cryptography migration of a physical 5g testbed,

    D. Liu, S. I. Jang, N. Sultan, S. Lai, S. C.-K. Chau, J. Chan, and H. Suzuki, “Post-quantum cryptography migration of a physical 5g testbed,” inProceedings of the 2025 1st Workshop on Quantum-Resistant Cryptography and Security, pp. 63–72, 2025

    2025

  20. [20]

    Analysis of post- quantum cryptography in user equipment in 5g and beyond,

    S. Hoque, A. Aydeger, E. Zeydan, and M. Liyanage, “Analysis of post- quantum cryptography in user equipment in 5g and beyond,” in2025 IEEE 50th Conference on Local Computer Networks (LCN), pp. 1–9, IEEE, 2025

    2025

  21. [21]

    Post- quantum cryptography integration into the future mobile core: A service- based architecture perspective,

    S. Hoque, A. Aydeger, J. Baranda, E. Zeydan, and F. Wilhelmi, “Post- quantum cryptography integration into the future mobile core: A service- based architecture perspective,”IEEE Network, 2026

    2026

  22. [22]

    Post-quantum secure ue-to-ue communications,

    S. Hoque, A. Aydeger, and E. Zeydan, “Post-quantum secure ue-to-ue communications,” in2024 15th International Conference on Network of the Future (NoF), pp. 28–30, IEEE, 2024

    2024

  23. [23]

    Empowering mobile networks security resilience by using post-quantum cryptography,

    R. A. Faval, R. Moreira, and F. d. O. Silva, “Empowering mobile networks security resilience by using post-quantum cryptography,”arXiv preprint arXiv:2603.28626, 2026

    arXiv 2026

  24. [24]

    An applied analysis of securing 5g/6g core networks with post-quantum key encapsulation methods,

    P. Scalise, R. Garcia, M. Boeding, M. Hempel, and H. Sharif, “An applied analysis of securing 5g/6g core networks with post-quantum key encapsulation methods,”Electronics, vol. 13, no. 21, p. 4258, 2024

    2024

  25. [25]

    Effects of clock resolution on the scheduling of interactive and soft real-time processes,

    Y . Etsion, D. Tsafrir, and D. G. Feitelson, “Effects of clock resolution on the scheduling of interactive and soft real-time processes,” inProceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, pp. 172–183, 2003

    2003