Newest papers

Testing TLS 1.3 PQC on constrained devices and microcontrollers

Olivier Gillot, William J. Buchanan, Callum Turino · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27766 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Este documento se centra en los dispositivos de clase IoT y los microcontroladores de mano hipocráticos y la viabilidad de utilizar PQC para conectar estos dispositivos en conexiones TLS 1.3 seguras. Usando la autenticación wolfSSL, debemos comparar en una matriz de algoritmo TLS 1.3 de 36 combinaciones, pareando los dispositivos ML-KEM-512/768/1024 y X25519/ECC P-256 y el intercambio de claves de energía completa con ML-DSA-44/65/87, Ed25519, ECDSA, y RSA-PSS auténtico, en cuatro dispositivos (Raspberry PiET W & Pico W & Pico 2 W, ESP32, y un Raspberry Pi Zero), midiendo el rendimiento de la energía cuántica completa de la latencia manual y el consumo de energía. Hemos encontrado

Machine translation (Meta M2M100); the English original follows.

Abstract

The UK, EU and US governments have set timelines for post-quantum cryptography migration of critical systems, with deadlines ranging from 2028 to 2035. This paper focuses on IoT-class devices and microcontrollers and the viability of using PQC to connect these devices in secure TLS 1.3 connections. Using wolfSSL, we benchmark a 36-combination TLS 1.3 algorithm matrix, pairing ML-KEM-512/768/1024 and X25519/ECC P-256 key exchange with ML-DSA-44/65/87, Ed25519, ECDSA, and RSA-PSS authentication, across four devices (Raspberry Pi Pico W & Pico 2 W, ESP32, and a Raspberry Pi Zero), measuring both handshake latency and energy consumption. We found that in capable devices, all choices in the TLS matrix gave similar results, but that in IoT-class devices, PQC performance is highly implementation- and architecture-dependent: the common assumption that elliptic-curve key exchange must be cheaper than post-quantum lattice-based key exchange does not hold in this wolfSSL-based implementation, where the best full-PQC combination (ML-KEM-512 + ML-DSA-44) completes TLS handshakes 41% faster than the equivalent classical-modern pairing (X25519 + RSA-PSS) on the Pico W (up to 2.12x as energy-efficient, depending on the paired authentication algorithm), and 8.9x faster on the ESP32. Full-PQC, ML-KEM-512/ML-DSA-44, is not only possible but energy-competitive with or superior to Hybrid or Elliptic Curve alternatives on the most constrained devices, though ML-DSA's variable signing time means applications with strict latency-predictability budgets must accept this variance as the cost of full quantum-safe authentication. We further show that the IETF's draft-specified X25519+ML-KEM-768 hybrid incurs approximately the combined cost of its two components, rather than offering a performance compromise, making pure ML-KEM the more practical choice on hardware lacking Curve25519 assembly support.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Handshake, Key exchange, Key (lock), Microcontroller, Ranging

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange