Benchmarking Post-Quantum Cryptography on Resource-Constrained IoT Devices: ML-KEM and ML-DSA on ARM Cortex-M0+
This paper presents the first systematic benchmarks of the finalized NIST post-quantum standards ML-KEM and ML-DSA on the resource-constrained ARM Cortex-M0+ processor, demonstrating that ML-KEM-512 is significantly faster and more energy-efficient than ECDH P-256 while revealing high latency variance in ML-DSA signing due to rejection sampling.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you have a massive library of secrets (your data) that you want to keep safe for the next 20 years. Right now, you lock them in a vault using a specific type of key (classical cryptography). But there's a scary rumor that in the future, a "Quantum Thief" will arrive with a master key that can open any of your current locks in seconds.
The problem? Many of your locks are on devices that will still be running in 20 years—like smart meters, medical sensors, or factory controllers. These devices are tiny, cheap, and have very little brainpower (memory and processing speed). They are the "Cortex-M0+" chips mentioned in the paper.
This paper is a stress test to see if we can swap out the old locks for new, "Quantum-Proof" locks (called ML-KEM and ML-DSA) on these tiny, cheap devices without breaking them.
Here is the breakdown of what they found, using some everyday analogies:
1. The Hardware: The "Tiny, Cheap Worker"
The researchers tested these new locks on the RP2040 chip (found in the Raspberry Pi Pico).
- The Analogy: Think of the old, powerful chips (Cortex-M4) as a Formula 1 car. They have big engines, turbochargers, and can do complex math very fast.
- The Cortex-M0+ is like a bicycle. It has no gears, no turbo, and the rider has to pedal everything manually. It's slow, it has no fancy features, and it's designed to be incredibly cheap (under $5).
- The Challenge: Can you ride a bicycle up a steep mountain (Quantum-Proof encryption) that usually requires a sports car?
2. The New Locks: ML-KEM (The Key Exchange)
ML-KEM is used to establish a secret connection between two devices.
- The Result: The researchers found that the "bicycle" (M0+) can actually do this surprisingly well!
- The Analogy: Using the old locks (ECDH), it took the bicycle 617 milliseconds to exchange keys. Using the new Quantum-Proof locks (ML-KEM-512), it only took 35.7 milliseconds.
- The Surprise: The new locks are actually 17 times faster and use 94% less energy than the old ones on this tiny chip. It's like discovering that pedaling a bicycle up a hill is actually easier than driving a heavy truck up the same hill because the truck's engine is inefficient on small gears.
3. The Tricky Lock: ML-DSA (The Digital Signature)
ML-DSA is used to sign documents to prove they are authentic (like a digital signature on a contract).
- The Problem: This lock has a quirk. To sign a document, the algorithm tries to generate a signature, checks if it's "good enough," and if not, it throws it away and tries again. This is called Rejection Sampling.
- The Analogy: Imagine you are trying to throw a ball through a hoop.
- Old Locks: You throw the ball, and it goes through every time. Consistent.
- New Locks (ML-DSA): You throw the ball. 90% of the time, it goes through. But sometimes, it hits the rim, bounces off, and you have to try again. Sometimes, you have to try 10 or 20 times before it finally goes through.
- The Result: The average time is okay, but the worst-case scenario is terrible.
- For the highest security level, 99% of the time, the signature is done in under 1 second. But 1% of the time, it takes over 1.1 seconds of the tiny chip's brainpower just to sign one thing.
- Why this matters: If you are controlling a robot arm or a medical pump that needs a response in 100 milliseconds, this "waiting for the ball to go through the hoop" could cause the system to freeze or crash.
4. The Memory Issue: The "Backpack"
Tiny devices have very little memory (RAM).
- The Analogy: Think of memory as a backpack.
- ML-KEM (Key Exchange): The backpack is small. Even the biggest version fits easily.
- ML-DSA (Signing): The backpack gets huge. The highest security version requires a backpack that takes up 45% of the entire device's memory.
- The Takeaway: You can fit the "Key Exchange" on almost any cheap device. But if you want to "Sign" things with the highest security, you need a device with a slightly bigger backpack (more memory).
5. The "Bicycle vs. Sports Car" Comparison
The researchers compared their "Bicycle" (M0+) to the "Sports Car" (M4) results from other studies.
- The Finding: The bicycle was only 1.8 to 1.9 times slower than the sports car.
- Why? Usually, people think a bicycle is 5 or 10 times slower. But because the new encryption math is so efficient, the lack of a "turbocharger" (advanced processor features) didn't hurt as much as expected. The new math is just so good that even a slow processor can handle it.
The Bottom Line
- Good News: We can protect our tiny, cheap, 20-year-old devices against future quantum hackers. The "Key Exchange" (ML-KEM) is fast, efficient, and fits on almost anything.
- Caution: The "Digital Signature" (ML-DSA) is a bit unpredictable. It's fast most of the time, but occasionally it takes a long time to finish. If you are building a system that needs to react instantly (like a self-driving car or a pacemaker), you need to plan for those occasional "long waits" or use a different type of signature.
- The Verdict: The migration to Quantum-Proof security is possible even on the cheapest, smallest chips we use today. We don't need to throw away our old devices; we just need to update their software.
In short: The paper proves that the "bicycle" can carry the heavy load of future security, as long as we know how to handle the occasional wobble.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.