Skip to content
PQC Portal
ไทย

Step 4 of 4

The cost & where to start

Post-quantum keys and signatures are bigger. What that means in practice, and the first steps an organisation can take.

Written by

  1. Step 1: Quantum basics
  2. Step 2: The threat
  3. Step 3: The fix
  4. Step 4: The cost & where to start

The cost: more bytes

Post-quantum keys and signatures are much larger. Key exchange absorbs this well. Certificate chains, which carry several signatures and keys, are the harder part of the migration.

Key exchange: bytes on the wire per TLS handshakeClassicalPost-quantum
  • X2551964
  • X25519MLKEM7682,336

Client share + server share. X25519MLKEM768: 1,216 + 1,120.

Signature size, bytesClassicalPost-quantum
  • Ed2551964
  • ECDSA P-25664
  • RSA-2048256
  • ML-DSA-442,420
  • ML-DSA-653,309
  • SLH-DSA-128s7,856

Raw encodings. ECDSA shown as r‖s without DER.

What it means in practice

04,0008,00012,00016,000ECDSA P-256448 B2 × 64 + 5 × 64ML-DSA-4414,724 B2 × 1,312 + 5 × 2,420~14.6 KB: first flight of a new TCP connectionMerkle Tree Certificates → fewer signatures
  1. 1Today: ECDSAA typical handshake carries roughly 2 public keys and 5 signatures (certificates, Certificate Transparency, the handshake itself). With ECDSA P-256 that is about 448 bytes.
  2. 2All switched to ML-DSA-44The same 2 keys and 5 signatures with ML-DSA-44 add up to 14,724 bytes, about 33 times more.
  3. 3Why that mattersA new TCP connection usually sends about 10 packets (~14.6 KB) before waiting for a reply. Authentication data this large, plus the rest of the handshake, can cost an extra round trip.
  4. 4Ways forwardDesigns such as Merkle Tree Certificates cut how many signatures a browser has to receive. That is why post-quantum certificates are moving more slowly than key exchange.

TLS handshakes

The ClientHello grows past a single packet. Most networks cope; some old middleboxes that assumed small ClientHellos broke during browser rollouts.

Certificates

A chain with ML-DSA keys and signatures adds kilobytes to every handshake. That is why post-quantum certificates are moving more slowly than post-quantum key exchange.

Constrained devices

Smartcards, IoT and firmware updates feel the size and memory cost most.

Where to start

  1. 1Inventory where you use public-key cryptography: TLS, VPN, SSH, code signing, PKI, HSMs.
  2. 2Prioritise data that must stay secret for years, and systems with long lifetimes.
  3. 3Turn on hybrid key exchange where your stack supports it (TLS 1.3, recent OpenSSH).
  4. 4Ask vendors for their post-quantum roadmap and dates.
  5. 5Build crypto agility: make algorithms configurable so the next change is cheaper.
Technical deep dive

Sizes in bytes (FIPS 203/204/205): ML-KEM-768 encapsulation key 1,184, ciphertext 1,088; ML-DSA-65 public key 1,952, signature 3,309; SLH-DSA-SHA2-128s public key 32, signature 7,856. SLH-DSA has tiny keys but huge signatures, so the trade-off differs by algorithm.

A TLS handshake typically carries several signatures and public keys: the certificate chain, Certificate Transparency timestamps and the handshake signature itself. Signature size multiplies.