Composed protocol tracks

Measured inside the handshake, not beside it.

Cycle counts on a primitive don’t tell you what a connection costs. These are full TLS and SSH key exchanges — decomposed phase by phase, sized to the byte, and cross-checked against the liboqs speed tools and eBACS reference cycles so they can be verified against the canonical numbers. Measured on x86 and ARM so the figures travel.

Run date

2026-09-21

Commit

6ed429a

Host

Xeon Platinum 8488C

liboqs

0.15.0

Architectures

aarch64 · x86_64

OpenSSL

3.0.13

Every track

Hybrid and pure post-quantum against the classical baseline.

Expand any suite for its phase decomposition. The wire column is fixed by the protocol; the timing columns move with host load — read them as a distribution, and read the tail column as how far it strays.

MLKEM768vs X25519

83.3 µs

82.1 µs

89.0 µs

95.0 µs

2.77×

11,998

2,272 B

−47.5%one run · 11 Jul 2026 · 9f57fb31 run on an unidentified host — too few for a range

KEM keygen25.7 µs

KEM encapsulate28.1 µs

KEM decapsulate29.6 µs

Total83.3 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	25.7 µs	25.2 µs	27.5 µs	33.9 µs	2.6 µs	24.8 µs	86.0 µs	1,000
KEM encapsulate	28.1 µs	27.6 µs	30.7 µs	34.9 µs	3.0 µs	27.2 µs	108.6 µs	1,000
KEM decapsulate	29.6 µs	29.2 µs	32.3 µs	36.3 µs	1.4 µs	28.7 µs	41.9 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗MLKEM768

X25519classical baseline

157.6 µs

156.4 µs

165.2 µs

175.3 µs

1.43×

6,345

64 B

baseline

Classical keygen31.3 µs × 2 — client and server62.6 µs

Classical derive47.5 µs × 2 — client and server95.0 µs

Total157.6 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	31.3 µs	31.0 µs	31.8 µs	39.4 µs	1.9 µs	30.8 µs	57.6 µs	1,000
Classical derive	47.5 µs	47.2 µs	50.3 µs	51.7 µs	1.1 µs	46.9 µs	59.0 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗X25519

SecP256r1MLKEM768vs X25519

235.4 µs

233.1 µs

243.9 µs

250.5 µs

2.08×

4,248

2,402 B

+49.0%one run · 11 Jul 2026 · 9f57fb31 run on an unidentified host — too few for a range

KEM keygen25.8 µs

KEM encapsulate27.7 µs

KEM decapsulate29.5 µs

Classical keygen15.6 µs × 2 — client and server31.2 µs

Classical derive60.6 µs × 2 — client and server121.2 µs

Total235.4 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	25.8 µs	25.2 µs	28.9 µs	35.1 µs	2.7 µs	24.8 µs	83.4 µs	1,000
KEM encapsulate	27.7 µs	27.2 µs	31.5 µs	34.6 µs	2.9 µs	26.7 µs	105.4 µs	1,000
KEM decapsulate	29.5 µs	29.2 µs	31.1 µs	36.5 µs	1.3 µs	28.8 µs	40.8 µs	1,000
Classical keygen	15.6 µs	15.4 µs	15.8 µs	20.6 µs	1.5 µs	15.3 µs	54.3 µs	1,000
Classical derive	60.6 µs	60.2 µs	64.9 µs	66.0 µs	1.5 µs	59.9 µs	77.7 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗SecP256r1MLKEM768

X25519MLKEM768vs X25519

240.5 µs

238.4 µs

249.8 µs

255.9 µs

1.81×

4,157

2,336 B

+52.4%one run · 11 Jul 2026 · 9f57fb31 run on an unidentified host — too few for a range

KEM keygen25.8 µs

KEM encapsulate27.7 µs

KEM decapsulate29.5 µs

Classical keygen31.3 µs × 2 — client and server62.5 µs

Classical derive47.5 µs × 2 — client and server95.0 µs

Total240.5 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	25.8 µs	25.3 µs	28.5 µs	32.4 µs	2.4 µs	24.9 µs	77.9 µs	1,000
KEM encapsulate	27.7 µs	27.2 µs	30.9 µs	34.6 µs	3.1 µs	26.7 µs	108.3 µs	1,000
KEM decapsulate	29.5 µs	29.2 µs	32.1 µs	36.0 µs	1.3 µs	28.8 µs	39.6 µs	1,000
Classical keygen	31.3 µs	31.0 µs	31.7 µs	37.6 µs	1.4 µs	30.8 µs	49.4 µs	1,000
Classical derive	47.5 µs	47.3 µs	49.8 µs	50.9 µs	1.5 µs	46.9 µs	83.7 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗X25519MLKEM768

Timing comparisons are published as a median and range across runs on one machine. The current host, which the record does not identify, has 1 run since 11 Jul 2026, fewer than the 7 a range needs, so each comparison shown here is a single dated run.

MLKEM768vs X25519

36.0 µs

34.9 µs

39.3 µs

46.6 µs

9.30×

27,786

2,272 B

−72.2%median of 9 runs · −81.5% to −60.3%latest −78.1% · 21 Sep 2026 · 6ed429a

KEM keygen11.2 µs

KEM encapsulate12.2 µs

KEM decapsulate12.6 µs

Total36.0 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	11.2 µs	10.6 µs	13.2 µs	21.4 µs	4.3 µs	10.2 µs	138.9 µs	1,000
KEM encapsulate	12.2 µs	11.7 µs	13.7 µs	21.9 µs	5.0 µs	11.1 µs	162.3 µs	1,000
KEM decapsulate	12.6 µs	12.4 µs	13.4 µs	22.0 µs	1.3 µs	12.0 µs	25.4 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗MLKEM768

X25519classical baseline

163.4 µs

159.5 µs

194.7 µs

228.6 µs

1.89×

6,120

64 B

baseline

Classical keygen40.2 µs × 2 — client and server80.5 µs

Classical derive41.5 µs × 2 — client and server82.9 µs

Total163.4 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	40.2 µs	31.6 µs	55.6 µs	70.8 µs	10.9 µs	30.1 µs	96.3 µs	1,000
Classical derive	41.5 µs	42.7 µs	50.4 µs	63.9 µs	6.8 µs	31.8 µs	72.3 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗X25519

SecP256r1MLKEM768vs X25519

182.7 µs

178.8 µs

202.5 µs

216.7 µs

3.46×

5,473

2,402 B

+48.4%median of 8 runs · +8.5% to +77.7%latest +12.1% · 21 Sep 2026 · 6ed429a

KEM keygen11.3 µs

KEM encapsulate12.5 µs

KEM decapsulate13.8 µs

Classical keygen15.4 µs × 2 — client and server30.9 µs

Classical derive57.1 µs × 2 — client and server114.2 µs

Total182.7 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	11.3 µs	10.8 µs	13.4 µs	20.4 µs	3.8 µs	10.3 µs	121.5 µs	1,000
KEM encapsulate	12.5 µs	11.7 µs	14.7 µs	22.6 µs	4.6 µs	11.1 µs	147.8 µs	1,000
KEM decapsulate	13.8 µs	12.5 µs	19.7 µs	23.9 µs	4.0 µs	11.9 µs	83.0 µs	1,000
Classical keygen	15.4 µs	13.4 µs	21.1 µs	26.4 µs	4.0 µs	13.1 µs	76.5 µs	1,000
Classical derive	57.1 µs	56.8 µs	64.1 µs	67.4 µs	3.1 µs	54.7 µs	98.3 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗SecP256r1MLKEM768

X25519MLKEM768vs X25519

248.1 µs

244.2 µs

279.4 µs

296.7 µs

2.98×

4,030

2,336 B

+27.9%median of 9 runs · +16.1% to +76.6%latest +53.1% · 21 Sep 2026 · 6ed429a

KEM keygen18.0 µs

KEM encapsulate19.5 µs

KEM decapsulate17.2 µs

Classical keygen52.3 µs × 2 — client and server104.6 µs

Classical derive44.4 µs × 2 — client and server88.9 µs

Total248.1 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	18.0 µs	17.3 µs	19.7 µs	32.6 µs	5.2 µs	11.9 µs	123.9 µs	1,000
KEM encapsulate	19.5 µs	18.8 µs	21.7 µs	33.6 µs	5.8 µs	15.2 µs	181.1 µs	1,000
KEM decapsulate	17.2 µs	19.1 µs	21.4 µs	33.8 µs	4.3 µs	12.1 µs	38.9 µs	1,000
Classical keygen	52.3 µs	51.5 µs	65.1 µs	72.7 µs	5.5 µs	41.1 µs	122.9 µs	1,000
Classical derive	44.4 µs	43.3 µs	52.6 µs	64.8 µs	6.1 µs	37.9 µs	168.0 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗X25519MLKEM768

The aarch64 column was measured 11 Jul 2026, 71 days before the newest run here. These are real measurements, not estimates — but they were not taken alongside the others, so read across the tabs as separate runs rather than as one comparison.

curve25519-sha256classical baseline

158.3 µs

157.1 µs

164.2 µs

176.3 µs

1.58×

6,317

64 B

baseline

Classical keygen31.4 µs × 2 — client and server62.7 µs

Classical derive47.8 µs × 2 — client and server95.6 µs

Total158.3 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	31.4 µs	31.0 µs	33.0 µs	40.6 µs	1.8 µs	30.7 µs	51.8 µs	1,000
Classical derive	47.8 µs	47.6 µs	50.2 µs	51.3 µs	1.1 µs	47.0 µs	72.7 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗curve25519-sha256

mlkem768x25519-sha256vs curve25519-sha256

241.1 µs

238.9 µs

250.1 µs

262.2 µs

1.90×

4,148

2,336 B

+52.0%one run · 11 Jul 2026 · 9f57fb31 run on an unidentified host — too few for a range

KEM keygen25.6 µs

KEM encapsulate27.6 µs

KEM decapsulate29.6 µs

Classical keygen31.3 µs × 2 — client and server62.6 µs

Classical derive47.8 µs × 2 — client and server95.6 µs

Total241.1 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	25.6 µs	25.2 µs	27.1 µs	32.0 µs	2.4 µs	24.6 µs	87.6 µs	1,000
KEM encapsulate	27.6 µs	27.2 µs	31.7 µs	34.7 µs	3.0 µs	26.8 µs	107.8 µs	1,000
KEM decapsulate	29.6 µs	29.2 µs	31.7 µs	36.5 µs	1.8 µs	28.7 µs	58.1 µs	1,000
Classical keygen	31.3 µs	30.9 µs	32.8 µs	38.0 µs	1.6 µs	30.7 µs	53.7 µs	1,000
Classical derive	47.8 µs	47.6 µs	50.2 µs	51.6 µs	1.0 µs	47.2 µs	58.7 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗mlkem768x25519-sha256

curve25519-sha256classical baseline

162.7 µs

165.3 µs

186.4 µs

210.8 µs

1.98×

6,148

64 B

baseline

Classical keygen46.5 µs × 2 — client and server93.0 µs

Classical derive34.8 µs × 2 — client and server69.6 µs

Total162.7 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	46.5 µs	49.5 µs	57.0 µs	72.0 µs	9.7 µs	30.2 µs	98.9 µs	1,000
Classical derive	34.8 µs	33.2 µs	44.4 µs	48.5 µs	4.7 µs	31.8 µs	93.5 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗curve25519-sha256

mlkem768x25519-sha256vs curve25519-sha256

165.2 µs

162.9 µs

180.3 µs

189.2 µs

2.98×

6,052

2,336 B

+54.1%median of 7 runs · +1.2% to +79.3%latest run withheld · 21 Sep 2026 · 6ed429a

KEM keygen11.0 µs

KEM encapsulate12.5 µs

KEM decapsulate12.9 µs

Classical keygen31.2 µs × 2 — client and server62.5 µs

Classical derive33.1 µs × 2 — client and server66.3 µs

Total165.2 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	11.0 µs	10.6 µs	12.5 µs	21.0 µs	3.4 µs	10.1 µs	109.8 µs	1,000
KEM encapsulate	12.5 µs	11.6 µs	15.2 µs	24.4 µs	4.1 µs	11.1 µs	118.6 µs	1,000
KEM decapsulate	12.9 µs	12.6 µs	15.3 µs	22.7 µs	1.7 µs	12.0 µs	30.8 µs	1,000
Classical keygen	31.2 µs	30.6 µs	32.4 µs	41.2 µs	2.4 µs	30.0 µs	67.6 µs	1,000
Classical derive	33.1 µs	32.8 µs	34.4 µs	42.5 µs	2.0 µs	31.7 µs	49.5 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗mlkem768x25519-sha256

mlkem768vs curve25519

53.9 µs

65.8 µs

77.6 µs

6.75×

18,568

2,272 B

−69.4%median of 9 runs · −81.5% to −59.5%latest −71.6% · 21 Sep 2026 · 6ed429a

KEM keygen17.6 µs

KEM encapsulate19.2 µs

KEM decapsulate17.1 µs

Total53.9 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	17.6 µs	17.1 µs	19.3 µs	37.3 µs	5.1 µs	13.8 µs	145.2 µs	1,000
KEM encapsulate	19.2 µs	18.6 µs	21.0 µs	39.7 µs	6.3 µs	13.4 µs	188.5 µs	1,000
KEM decapsulate	17.1 µs	18.5 µs	21.0 µs	30.2 µs	4.2 µs	12.1 µs	43.5 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗mlkem768

curve25519+mlkem768vs curve25519

166.8 µs

163.9 µs

182.3 µs

196.6 µs

3.14×

5,994

2,336 B

withheldwithheld · 21 Sep 2026 · 6ed429a9 runs on c7i.large — too few for a range

KEM keygen11.1 µs

KEM encapsulate12.3 µs

KEM decapsulate12.8 µs

Classical keygen31.3 µs × 2 — client and server62.6 µs

Classical derive34.0 µs × 2 — client and server68.0 µs

Total166.8 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	11.1 µs	10.8 µs	12.4 µs	20.7 µs	3.5 µs	10.3 µs	110.9 µs	1,000
KEM encapsulate	12.3 µs	11.7 µs	13.8 µs	21.5 µs	3.8 µs	11.2 µs	124.2 µs	1,000
KEM decapsulate	12.8 µs	12.6 µs	13.7 µs	22.0 µs	1.6 µs	12.1 µs	33.7 µs	1,000
Classical keygen	31.3 µs	30.8 µs	32.5 µs	40.6 µs	2.3 µs	30.0 µs	73.3 µs	1,000
Classical derive	34.0 µs	33.2 µs	41.5 µs	45.6 µs	3.1 µs	31.7 µs	62.2 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗curve25519+mlkem768

ecp256vs curve25519

169.2 µs

168.7 µs

200.1 µs

214.2 µs

2.17×

5,909

128 B

+18.5%median of 9 runs · −27.0% to +47.5%latest −11.1% · 21 Sep 2026 · 6ed429a

Classical keygen13.8 µs × 2 — client and server27.6 µs

Classical derive70.8 µs × 2 — client and server141.6 µs

Total169.2 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	13.8 µs	13.6 µs	14.1 µs	23.5 µs	2.8 µs	13.1 µs	90.3 µs	1,000
Classical derive	70.8 µs	70.7 µs	86.0 µs	93.1 µs	7.6 µs	55.1 µs	105.2 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗ecp256

ecp256+mlkem768vs curve25519

180.1 µs

178.2 µs

195.5 µs

203.7 µs

3.34×

5,551

2,400 B

withheldwithheld · 21 Sep 2026 · 6ed429a9 runs on c7i.large — too few for a range

KEM keygen13.5 µs

KEM encapsulate12.6 µs

KEM decapsulate12.9 µs

Classical keygen13.8 µs × 2 — client and server27.5 µs

Classical derive56.8 µs × 2 — client and server113.7 µs

Total180.1 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	13.5 µs	11.2 µs	18.5 µs	25.2 µs	4.7 µs	10.3 µs	109.1 µs	1,000
KEM encapsulate	12.6 µs	11.7 µs	15.7 µs	22.6 µs	4.3 µs	11.2 µs	127.1 µs	1,000
KEM decapsulate	12.9 µs	12.7 µs	13.9 µs	21.7 µs	1.5 µs	12.1 µs	33.9 µs	1,000
Classical keygen	13.8 µs	13.5 µs	14.2 µs	23.7 µs	2.5 µs	13.0 µs	77.3 µs	1,000
Classical derive	56.8 µs	56.4 µs	63.8 µs	66.5 µs	2.8 µs	54.8 µs	91.5 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗ecp256+mlkem768

curve25519classical baseline

191.0 µs

189.9 µs

213.4 µs

223.7 µs

1.90×

5,236

64 B

baseline

Classical keygen52.1 µs × 2 — client and server104.3 µs

Classical derive43.3 µs × 2 — client and server86.7 µs

Total191.0 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	52.1 µs	51.4 µs	60.8 µs	65.6 µs	4.2 µs	35.4 µs	110.2 µs	1,000
Classical derive	43.3 µs	43.4 µs	48.9 µs	56.4 µs	4.3 µs	31.9 µs	77.3 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0%run 6ed429a ↗curve25519

ML-DSA-44

18.9 µs

72.2 µs

19.7 µs

1.28 KB

2.36 KB

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	18.9 µs	18.6 µs	19.7 µs	28.9 µs	3.4 µs	17.5 µs	111.1 µs	1,000
Sign	72.2 µs	55.7 µs	153.7 µs	252.0 µs	88.7 µs	26.8 µs	2.48 ms	1,000
Verify	19.7 µs	19.4 µs	20.6 µs	30.6 µs	2.3 µs	18.5 µs	60.4 µs	1,000

ML-DSA-65

29.4 µs

94.0 µs

29.9 µs

1.91 KB

3.23 KB

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	29.4 µs	28.8 µs	32.7 µs	39.1 µs	3.3 µs	27.7 µs	107.0 µs	1,000
Sign	94.0 µs	76.6 µs	219.6 µs	279.2 µs	58.3 µs	38.8 µs	526.6 µs	1,000
Verify	29.9 µs	29.3 µs	33.8 µs	41.3 µs	2.7 µs	28.0 µs	58.2 µs	1,000

ML-DSA-87

58.6 µs

138.6 µs

44.4 µs

2.53 KB

4.52 KB

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	58.6 µs	64.0 µs	75.8 µs	91.4 µs	13.9 µs	41.2 µs	133.8 µs	1,000
Sign	138.6 µs	114.6 µs	281.7 µs	485.1 µs	83.2 µs	57.3 µs	998.8 µs	1,000
Verify	44.4 µs	44.0 µs	50.5 µs	55.0 µs	2.5 µs	42.4 µs	70.5 µs	1,000

Falcon-512

6.05 ms

215.4 µs

45.3 µs

897 B

752 B

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	6.05 ms	5.55 ms	9.04 ms	11.52 ms	1.52 ms	4.59 ms	15.97 ms	1,000
Sign	215.4 µs	214.9 µs	226.7 µs	231.6 µs	7.5 µs	201.8 µs	333.7 µs	1,000
Verify	45.3 µs	44.5 µs	52.6 µs	58.1 µs	3.0 µs	41.1 µs	72.4 µs	1,000

Falcon-1024

18.56 ms

468.9 µs

94.3 µs

1.75 KB

1.43 KB

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	18.56 ms	17.03 ms	28.07 ms	34.34 ms	4.37 ms	14.94 ms	44.15 ms	1,000
Sign	468.9 µs	477.4 µs	496.2 µs	509.1 µs	26.9 µs	406.3 µs	657.9 µs	1,000
Verify	94.3 µs	94.9 µs	105.7 µs	113.6 µs	6.7 µs	81.0 µs	139.6 µs	1,000

SLH_DSA_PURE_SHAKE_128S

111.44 ms

851.44 ms

849.9 µs

32 B

7.67 KB

Hash

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	111.44 ms	111.30 ms	111.93 ms	112.42 ms	2.14 ms	110.44 ms	165.26 ms	1,000
Sign	851.44 ms	851.29 ms	853.56 ms	855.52 ms	2.53 ms	847.93 ms	919.13 ms	1,000
Verify	849.9 µs	850.1 µs	905.7 µs	934.5 µs	35.4 µs	731.8 µs	1.01 ms	1,000

SLH_DSA_PURE_SHAKE_128F

1.74 ms

40.79 ms

2.43 ms

32 B

16.69 KB

Hash

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	1.74 ms	1.74 ms	1.78 ms	1.80 ms	30.6 µs	1.65 ms	1.87 ms	1,000
Sign	40.79 ms	40.76 ms	41.10 ms	41.23 ms	210.6 µs	40.29 ms	44.24 ms	1,000
Verify	2.43 ms	2.43 ms	2.53 ms	2.58 ms	65.9 µs	2.20 ms	2.90 ms	1,000

RSA-2048-PSS

46.75 ms

373.9 µs

40.3 µs

294 B

256 B

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	46.75 ms	43.01 ms	87.91 ms	127.26 ms	29.02 ms	17.31 ms	137.10 ms	20
Sign	373.9 µs	363.4 µs	376.0 µs	646.8 µs	48.8 µs	354.5 µs	670.8 µs	1,000
Verify	40.3 µs	39.8 µs	43.5 µs	52.8 µs	3.3 µs	36.2 µs	82.4 µs	1,000

RSA-3072-PSS

140.29 ms

989.1 µs

66.1 µs

422 B

384 B

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	140.29 ms	145.51 ms	271.45 ms	281.53 ms	82.85 ms	22.77 ms	284.05 ms	10
Sign	989.1 µs	971.2 µs	981.8 µs	1.52 ms	94.8 µs	955.6 µs	1.56 ms	1,000
Verify	66.1 µs	65.2 µs	74.1 µs	77.0 µs	3.1 µs	58.4 µs	105.2 µs	1,000

ECDSA-P256

13.9 µs

25.3 µs

81.4 µs

91 B

70 B

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	13.9 µs	13.2 µs	15.8 µs	22.9 µs	3.0 µs	12.9 µs	94.7 µs	1,000
Sign	25.3 µs	25.0 µs	27.7 µs	34.8 µs	2.9 µs	24.0 µs	98.1 µs	1,000
Verify	81.4 µs	81.3 µs	89.8 µs	91.4 µs	3.3 µs	78.4 µs	112.4 µs	1,000

ECDSA-P384

118.7 µs

165.7 µs

387.1 µs

120 B

101 B

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	118.7 µs	117.7 µs	127.5 µs	131.0 µs	4.7 µs	111.3 µs	172.9 µs	1,000
Sign	165.7 µs	165.0 µs	174.5 µs	178.2 µs	6.1 µs	156.0 µs	250.9 µs	1,000
Verify	387.1 µs	386.7 µs	400.5 µs	409.6 µs	10.2 µs	365.9 µs	501.7 µs	1,000

AES-256-GCMx86_6416,384 B payload · 32 B key · 12 B nonce · 16 B tag

Payload size is a cited choice, not an arbitrary one: RFC 8446 §5.2 — max TLSPlaintext record length.

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Encrypt	2.0 µs	2.0 µs	2.1 µs	3.0 µs	1.0 µs	1.9 µs	19.6 µs	1,000
Decrypt	2.0 µs	1.9 µs	2.1 µs	3.1 µs	0.8 µs	1.9 µs	17.8 µs	1,000

What the IPsec figures coverIKEv2 key establishment (IKE_SA_INIT, plus RFC 9370 IKE_INTERMEDIATE). Authentication payloads, which belong to the signature track.

The weighting is the same as TLS on purpose. The composed total uses the same phase weights as the TLS and SSH tracks, because the crypto multiplicity is the same: both peers generate a classical keypair and both derive, and the additional RFC 9370 key exchange contributes one KEM keygen, one encapsulation and one decapsulation. A different weighting was not invented to make this track look distinct.

Two gaps worth naming. MODP (finite-field) groups are not measured. Group 14 (MODP-2048) is still very common in deployed IPsec and is arguably the most representative classical baseline, but measuring it requires the exact RFC 3526 prime -- and a mistranscribed prime would still compute a shared secret and still produce a plausible timing while measuring a group that is not 14. Left unmeasured rather than measured wrongly. MACsec is named in the same CFDIR use case (3.12) and is not measured here. This track's claim on that cell is IKEv2 key establishment only.

An IPsec tunnel rekeys on a timer or byte budget, so the number of key exchanges over its life is far higher than TLS's one per connection. That multiplier is a property of a deployment's configuration rather than of the cryptography, so it belongs to whoever is costing the tunnel. This track measures the cost of one key establishment.

How the handshake figure is builtThe handshake mean is composed, not timed end to end: each phase is measured in its own thousand-iteration loop and the handshake figure is their sum, with the classical keygen and derive counted twice because both parties perform them. That identity holds across every committed suite to within 0.002%, and the smoke test fails the build if it stops holding. It is why the phase bars add to exactly 100% — they are the measurement, not an attribution over it.

Certificates

An ML-DSA-87 certificate chain is 16.8× the size of the one it replaces.

Every TLS connection that isn't resumed carries the server's chain. This is real: chains minted and measured, not key sizes added up.

Certificate	Sent on the wire	Against ECDSA-P256
ML-DSA-87	14.70 KB	16.78×
ML-DSA-65	10.88 KB	12.42×
ML-DSA-44	7.89 KB	9.01×
RSA-3072	2.14 KB	2.45×
RSA-2048	1.64 KB	1.88×
ECDSA P-256	897 B	the baseline

These are a floor. The certificates behind them carry short names and no Certificate Transparency extensions, where a public certificate carries more — so a real chain is larger, and the post-quantum penalty on a real chain is larger still.

What that costs

Two of them no longer fit in the first round trip.

A server's opening flight has about 14.26 KB before it has to stop and wait for an acknowledgement. Crossing that line doesn't make the handshake bigger — it makes it slower, by a full round trip, on every new connection.

ECDSA P-256

2.20 KB

fits, 12.06 KB spare

ML-DSA-44

11.50 KB

fits, 2.75 KB spare

ML-DSA-65

15.36 KB

over by 1.10 KB

ML-DSA-87

20.47 KB

over by 6.21 KB

RSA-2048

3.14 KB

fits, 11.12 KB spare

RSA-3072

3.77 KB

fits, 10.49 KB spare

Each figure adds three measured parts — a captured ServerHello, the chain above, and the signature over the handshake. The shape of the flight is assumed rather than captured, and it assumes nothing extra: no stapled revocation response, no client certificate, no session ticket. Every one of those pushes the total further over, not back under.

Tokens

A post-quantum access token is 15.7× the one it replaces.

Every signed API call, session cookie and identity assertion carries one of these. Unlike a certificate chain, a token is re-sent on each request — so its size is paid over and over, not once per connection.

Signature	Token on the wire	Against ECDSA-P256
ML-DSA-87	6.34 KB	15.69×
ML-DSA-65	4.63 KB	11.44×
ML-DSA-44	3.47 KB	8.58×
Falcon-512	1.17 KB	2.88×
RSA-3072	830 B	2.00×
RSA-2048	660 B	1.59×

HTTP cookie value

4.00 KB

2.34 KB over

RFC 6265 section 6.1 - servers SHOULD support at least 4096 bytes per cookie.

nginx large_client_header_buffers (one header)

8.00 KB

fits, 1.66 KB spare

nginx default: 4 buffers of 8k. A single header line must fit within one buffer.

Node.js --max-http-header-size (whole header block)

16.00 KB

fits, 9.66 KB spare

Node.js default since 12.x, applied to the total header block rather than one line.

Every figure above is a configurable default, not a limit of the protocol. Crossing one is a question to ask of your own stack rather than a failure — raise the buffer and the token fits. What it tells you is where a post-quantum token stops being invisible: it is the cookie, not the handshake, that runs out of room first.

Take the data

Every figure traces to a run.

Clone the harness and you should reproduce these within run-to-run variance.

Overview →Compare algorithms →Raw JSON Methodology Benchmark source

Measured inside the handshake, not beside it.

Hybrid and pure post-quantum against the classical baseline.

An ML-DSA-87 certificate chain is 16.8× the size of the one it replaces.

Two of them no longer fit in the first round trip.

A post-quantum access token is 15.7× the one it replaces.

Every figure traces to a run.

Know the cost of post-quantum migration.