Post-quantum cryptography, measured.
Every NIST-standardized post-quantum algorithm, benchmarked on real silicon and composed into full TLS and SSH handshakes. One thousand timed iterations per operation, garbage collector disabled, process pinned to a core. Every number links to the run that produced it.
The gap the standard doesn't warn you about.
Logarithmic axis — on a linear one, all but the largest bar would be invisible. That is the finding, not a plotting convenience.
Key encapsulation — ML-KEM.
Replaces RSA and ECC key exchange. Sizes are what goes on the wire.
| Algorithm | Keygen | Encap | Decap | Encap ops/sec | Public key | Ciphertext |
|---|---|---|---|---|---|---|
| ML-KEM-512NIST level 1 | 7.7 µs | 8.8 µs | 13.9 µs | 113,728 | 800 B | 768 B |
| ML-KEM-768NIST level 3 | 17.1 µs | 19.2 µs | 19.9 µs | 52,010 | 1.16 KB | 1.06 KB |
| ML-KEM-1024NIST level 5 | 21.6 µs | 23.6 µs | 25.9 µs | 42,387 | 1.53 KB | 1.53 KB |
Digital signatures — ML-DSA and SLH-DSA.
Note the inversion: the hash-based schemes carry the smallest public keys and the slowest signing on the board.
| Algorithm | Keygen | Sign | Verify | Public key | Signature | Family |
|---|---|---|---|---|---|---|
| ML-DSA-44NIST level 2 | 21.9 µs | 58.1 µs | 19.8 µs | 1.28 KB | 2.36 KB | Lattice |
| ML-DSA-65NIST level 3 | 30.3 µs | 129.3 µs | 29.8 µs | 1.91 KB | 3.23 KB | Lattice |
| ML-DSA-87NIST level 5 | 43.5 µs | 112.2 µs | 44.5 µs | 2.53 KB | 4.52 KB | Lattice |
| SLH-DSA-SHAKE-128sNIST level 1 | 111.54 ms | 850.80 ms | 852.1 µs | 32 B | 7.67 KB | Hash |
| SLH-DSA-SHAKE-128fNIST level 1 | 1.75 ms | 40.74 ms | 2.42 ms | 32 B | 16.69 KB | Hash |
Hash-based signatures — for things that must still verify in 2045.
Firmware and boot chains are signed once and verified for the life of the hardware. Their signatures have to outlast the device, which is a different problem from securing a connection today.
PQC Arena tracks four parameter sets, with published test vectors and a verification-only path — the operation that matters here, since a firmware signature is produced once and checked on every boot. The schemes are compiled and proven in Q-Advantage’s own reference container. They are not yet enabled in the liboqs build on the host that produces published numbers, and we will not publish a figure measured anywhere else.
Shown here rather than left out. An algorithm absent from a benchmark is indistinguishable from one nobody thought about, and these two are the standardised answer for long-lived signing.
What it costs inside a real handshake.
Primitives in isolation don't tell you this. Full handshakes, same host, same night.
Nothing here is behind a login.
Current-day snapshot free, forever. Clone the harness and you should reproduce these within run-to-run variance.