Measuring the NIST Migration Cost: Standards-Conformant Post-Quantum Hybrid Encryption for IoT Telemetry

Today's internet encryption could be broken by future quantum computers. This work measures whether tiny, low-power sensor chips can already run the new quantum-resistant standards without new hardware.

The Approach

A standards-conformant hybrid scheme: ML-KEM-512 (FIPS 203) establishes the session key and Ascon-AEAD128 (SP 800-232) encrypts the payload, both used without modification. It is deployed end to end over MQTT through an untrusted Mosquitto broker that holds no key material, with no TLS. A Python gateway verifies and decrypts. The threat model treats the broker as fully compromised.

It is evaluated on an ESP32 (Xtensa, 240 MHz) and an ESP32-C3 (RISC-V, 160 MHz) using hardware cycle counters (ESP-IDF v5.5.5), with cost split into a fixed part and a per-byte part.

Results Reported in the Manuscript

• Standardising Ascon lowers its per-byte cost by 2.5% on the ESP32 and 8.4% on the ESP32-C3. That is a 2.5x bigger reduction on the board that lacks a byte-reordering instruction, which supports NIST's stated reason for the byte-order change.
• Key establishment completes in 232 ms using 13.2 kB of RAM on the more constrained board (median handshake 210.5 ms on the ESP32, 232.0 ms on the ESP32-C3). ML-KEM-512 uses at most 13.4 kB, about 3.3% of on-chip SRAM.
• Added wire overhead is a constant 24 bytes per message. All 1,236 genuine frames verified; three deliberately replayed frames were rejected.
• All six Ascon variants passed 6,534 official NIST known-answer tests on both boards.
• Conclusion: the evaluated hardware can absorb the migration without replacement.

The manuscript reports the first measurement of standardised Ascon-AEAD128 on constrained hardware. As the paper is under review, treat that as a claim, not a settled fact.

Limitations Stated in the Paper

• One measurement pass per board.
• Code runs from cached flash, so absolute cycle counts include cache effects.
• Energy was not measured and there are no side-channel countermeasures.
• The gateway is not resource-constrained.
• The key is pinned in firmware, so there is no forward secrecy.

My Contribution

First author. I did the implementation, deployment and measurement.