On the Energy Cost of Post-Quantum Key Establishment in Wireless Low-Power Personal Area Networks

This paper demonstrates that in wireless low-power Personal Area Networks, the communication energy cost of Post-Quantum Key Exchange often exceeds its computational cost, necessitating coordinated protocol and lower-layer optimizations to achieve efficient quantum-resilient operation.

The Gist

The Big Picture: The "Quantum" Elephant in the Room

Imagine you have a very secure, tiny mailbox (your smart device, like a fitness tracker or a smart light). For years, you've used a special lock (RSA or Elliptic Curve cryptography) that is small, light, and easy to carry. It fits perfectly in your pocket and doesn't drain your battery.

But now, scientists are building a super-powerful "Quantum Computer" that acts like a master key thief. It can pick your old locks in seconds. To stop this thief, we need a new, super-strong lock (Post-Quantum Cryptography or PQC).

The Problem: This new super-lock is huge. It's not a small key anymore; it's a giant, heavy steel safe. If you try to carry this giant safe through a narrow, crowded hallway (your low-power wireless network), you're going to trip, drop it, and exhaust yourself.

The Paper's Mission: Measuring the Exhaustion

The authors of this paper asked a simple question: "How much battery will our tiny devices lose just trying to carry these giant new locks?"

Many experts before them only looked at how hard it is to make the lock (the math). They thought, "If we make the math faster, we save energy."

But this paper realized that carrying the lock is actually the bigger problem. They found that for tiny devices, the energy spent sending the data is often much higher than the energy spent calculating it.

The Experiment: The "Bluetooth" Delivery Service

To test this, the researchers used Bluetooth Low Energy (BLE), which is the standard language for smart devices. They set up a real-world delivery scenario:

1. The Setup: They used real hardware (nRF52840 chips) and a super-sensitive power meter (like a high-tech scale) to measure every tiny drop of energy used.
2. The Delivery: They tried to send the new "giant locks" (ML-KEM keys) from one device to another.
3. The Obstacle: The wireless "hallway" (the radio signal) has a size limit. You can't send the whole giant safe in one go. You have to break it into tiny boxes (packets), send them one by one, wait for a "thumbs up" (acknowledgment) from the receiver, and then send the next box.

The Big Discovery: It's Not the Math, It's the Traffic

The results were surprising. Here is what they found, using our analogies:

• The "Math" Cost (Computation): This is the energy used by the brain of the device to calculate the lock. It goes up a bit as the lock gets stronger, but it's manageable.
• The "Traffic" Cost (Communication): This is the energy used by the radio to shout the data across the room. Because the new locks are so big, the device has to shout many times.
  • The Fragmentation Trap: Because the data is huge, it gets chopped into tiny pieces. Every time you send a piece, you have to wait for a "thumbs up." This waiting and shouting takes a massive amount of energy.
  • The Result: In many cases, sending the data used 2 to 8 times more energy than actually making the lock. The "heavy lifting" wasn't the math; it was the delivery truck making 50 trips instead of one.

The Solution: The "Super-Express" Lane

The paper didn't just find a problem; it found a way to fix it. They discovered that by tweaking the settings of the Bluetooth connection (specifically enabling something called DLE or Data Length Extension), they could make the "boxes" bigger.

• Before: Imagine sending a giant pizza by cutting it into 50 tiny slices and mailing each slice in a separate envelope. You spend all your money on postage (energy).
• After (With Optimization): You put the whole pizza in one big box. You still pay for postage, but you only do it once.

By making the "boxes" bigger, they reduced the total energy needed to send the key by 25% to 34%.

The Takeaway for the Future

This paper teaches us three main lessons for the future of the "Internet of Things" (IoT):

1. Don't just look at the math: When designing security for tiny devices, don't just worry about making the code faster. You have to worry about how much data you are sending.
2. Communication is King: For these tiny devices, the radio (sending data) is the biggest battery drain, not the processor (thinking).
3. It's a Team Effort: To make these devices quantum-safe, we need to optimize the whole system together—the math, the software, and the radio settings.

In a nutshell: We can protect our smart devices from future quantum hackers, but we have to be smart about how we send the keys. If we don't optimize the delivery method, our smart devices will run out of battery before they even finish the handshake!

Technical Summary

1. Problem Statement

The emergence of large-scale quantum computers threatens current public-key cryptosystems (RSA, ECC), necessitating a transition to Post-Quantum Cryptography (PQC). While PQC algorithms (such as ML-KEM and ML-DSA) are designed to resist quantum attacks, they produce significantly larger public keys and ciphertexts (often 10–100x larger than ECC).

The Core Conflict:
Personal Area Networks (PANs), particularly low-power wireless technologies like Bluetooth Low Energy (BLE), operate under strict energy budgets. Integrating PQC into these networks introduces three critical costs:

1. Increased Computation: Higher CPU cycles for cryptographic operations.
2. Packet Fragmentation: Large PQC payloads exceed standard link-layer frame sizes, forcing fragmentation.
3. Prolonged Radio Activity: Fragmentation leads to increased transmission time, more acknowledgments (ACKs), and inter-frame spacing (IFS), all of which dominate energy consumption in low-power radios.

The Gap: Prior research has largely focused on optimizing the computational cost of PQC on embedded systems (cycle counts, memory usage) while largely ignoring the communication cost. This paper argues that for low-power PANs, the communication overhead caused by large payloads may actually exceed the computational cost, a factor previously unquantified.

2. Methodology

The authors conducted a measurement-driven empirical study using Bluetooth Low Energy (BLE) as a representative low-power PAN stack.

• Experimental Setup:

  • Hardware: Nordic nRF52840 development kit powered by a 3.0V DC source.
  • Measurement Tool: Nordic Power Profiler Kit II (PPK2) sampling at 100 kHz.
  • Software: Zephyr RTOS with ML-KEM (Kyber) implementations from PQClean.
  • Protocol: A custom, minimal, one-round KEM-based key exchange (Peripheral generates keys, Central encapsulates, Peripheral decapsulates) implemented over the BLE GATT/ATT layer.
  • Variables: Evaluated three NIST security levels (ML-KEM-512, 768, 1024) across various ATT MTU sizes and Link Layer (LL) PDU sizes (including Default vs. Data Length Extension/DLE enabled).

• Energy Modeling Approach:
  The authors decomposed total energy ($E_{pqke}$) into two components:

  1. Computation ($E_{comp}$): Estimated using cycle counts from the pqm4 benchmark converted to energy, then calibrated with a correction factor ($\gamma_{comp}$) to account for OS scheduling and memory access overheads.
  2. Communication ($E_{comm}$): Modeled based on radio current, data rate, and total PHY-layer bytes (including headers, fragmentation, ACKs, and IFS). This was also calibrated with a correction factor ($\gamma_{comm}$) to account for hardware/firmware residuals.
  3. Validation: Theoretical models were compared against empirical measurements to derive these calibration factors.

3. Key Contributions

1. Measurement-Driven Characterization: The first empirical study to quantify the full energy cost of PQC key exchange on real BLE hardware, separating computation from communication.
2. Identification of Dominant Costs: The study reveals that communication energy often dominates PQC key establishment in low-power networks, a finding contrary to the assumption that computation is the primary bottleneck.
3. Calibrated Energy Model: Developed a practical analytical model with empirically derived correction factors ($\gamma \approx 1.15$ for communication, $1.12–1.62$ for computation) that allows developers to accurately predict energy costs under different configurations.
4. Cross-Layer Design Guidelines: Provided specific strategies for optimizing PQC in PANs, demonstrating that link-layer configuration (fragmentation reduction) is as critical as algorithm selection.

4. Key Results

• Communication vs. Computation:

  • In unoptimized configurations (small LL PDUs), communication energy accounts for 57%–63% of the total PQKE energy.
  • Even with optimized settings (DLE enabled), communication remains a significant portion, though the balance shifts toward computation for higher security levels (e.g., at ML-KEM-1024 with DLE, communication drops to ~37%).
  • Total Energy Cost: PQKE energy ranges from 721 $\mu$J to 2633 $\mu$J, which is 2.5x to 8.5x higher than classical ECDH pairing (~328 $\mu$J).

• Impact of Configuration:

  • Fragmentation is the Killer: Small Link Layer PDUs cause severe fragmentation, drastically increasing energy due to headers and ACKs.
  • Data Length Extension (DLE): Enabling DLE (larger LL PDUs) reduces total PQKE energy by 25%–34% across all security levels by minimizing fragmentation overhead.
  • Security Level Trade-off: Moving from ML-KEM-512 to ML-KEM-1024 roughly doubles the computation cost but has a negligible effect on communication cost (which is driven by payload size and fragmentation rules, not the specific math of the algorithm).

• Session-Level Impact:

  • For a typical session transmitting a 1 kB payload, the key establishment phase (PQKE) dominates the total energy budget, consuming several times more energy than the payload transmission itself.

5. Significance and Design Implications

The paper reframes quantum-resilient pairing not merely as a cryptographic challenge, but as a cross-layer optimization problem.

• For Developers:

  • Optimize Link Layers First: Before optimizing algorithms, developers must optimize link-layer parameters (MTU, PDU size). Enabling DLE is critical for PQC feasibility in PANs.
  • Security-Energy Trade-off: Designers can use the proposed model to select the appropriate NIST security level based on device energy budgets. Energy-harvesting devices might opt for ML-KEM-512, while grid-powered nodes can support ML-KEM-1024.
  • Short-Lived High-Throughput Mode: PQKE should be treated as a transient phase where link parameters are temporarily optimized for high throughput to minimize fragmentation, reverting to low-duty-cycle settings afterward.

• For Standardization:

  • Future PAN standards (beyond BLE) must account for the "communication tax" of PQC. Protocols relying on contention-based access (like IEEE 802.15.4 or BLE Mesh) will face even greater energy penalties due to retransmissions and collisions caused by large fragmented packets.
  • The findings suggest a need for "secured access windows" or adaptive reliability policies in contention-based networks to handle large PQC artifacts without exhausting node batteries.

Conclusion:
Quantum resilience is feasible on constrained devices, but only if the communication overhead is aggressively managed. The paper proves that without coordinated protocol configuration and lower-layer optimization, the energy cost of PQC could render low-power PANs impractical.