Technical Summary: MQTT Across a Raspberry Pi 5 IoT Network Utilizing Quantum-resistant Signature Algorithms

Problem Statement

The rapid proliferation of Internet of Things (IoT) devices has introduced millions of resource-constrained nodes into critical and consumer infrastructures. These devices rely on lightweight protocols like Message Queuing Telemetry Transport (MQTT) for communication. However, the security of these networks is increasingly threatened by the advent of quantum computing. Specifically, Shor's algorithm poses a direct risk to the RSA and elliptic curve cryptography currently used to secure MQTT communications via TLS. Given the long operational lifespan of many IoT devices (often decades) and the slow update cycles of deployed systems, there is an urgent need to transition to Post-Quantum Cryptography (PQC) to ensure long-term resilience.

The primary challenge in this transition is the resource constraint of IoT hardware. Many PQC algorithms require larger keys and signatures, leading to substantial computational overhead and memory allocation issues that could degrade the performance of lightweight devices.

Methodology

To investigate the feasibility of integrating PQC into resource-constrained IoT environments, the authors implemented a functional MQTT-based IoT network using three Raspberry Pi 5 units. The system models a standard publish-subscribe architecture:

1. Publisher: A Raspberry Pi 5 connected to an HC-SR501 PIR motion sensor circuit. It detects motion, translates it into a digital payload, and publishes messages to a specific topic (motion-sensor).
2. Broker: A central Raspberry Pi 5 running the Mosquitto MQTT broker, responsible for routing messages between the publisher and subscriber.
3. Subscriber: A third Raspberry Pi 5 that subscribes to the motion-sensor topic to receive and log data.

Cryptographic Implementation:
The study specifically integrates the FALCON digital signature scheme, one of the NIST-selected lattice-based PQC algorithms. FALCON was chosen for its compactness and efficiency, featuring smaller key and signature sizes compared to other NIST candidates like CRYSTALS-Dilithium and SPHINCS+.

The implementation utilized a software stack comprising:

• OpenSSL: For TLS/SSL management.
• liboqs: An open-source C library providing quantum-safe algorithms.
• oqs-provider: A shared library enabling OpenSSL to use quantum-safe algorithms (specifically FALCON).
• Mosquitto: The MQTT broker/client library, compiled with PQC support.

The system was configured to use FALCON-1024 for certificate-based authentication, replacing standard RSA-2048 to secure the TLS 1.3 connections between the devices.

Key Contributions

1. Practical Hardware Implementation: Unlike previous demonstrations that relied on Docker containers (which abstract away physical hardware constraints), this work provides a practical implementation on real hardware. It addresses real-world constraints such as GPIO interfacing, physical certificate distribution, and network limitations inherent to embedded endpoints.
2. End-to-End PQC Workflow: The authors provide a complete, operational workflow that includes sensing, message publishing, brokering, and subscribing, all secured by quantum-safe techniques. This includes scripts for environment setup, certificate generation, and system initialization.
3. Performance Benchmarking: The study empirically measures the performance trade-offs of deploying lattice-based PQC on lightweight hardware, specifically focusing on certificate generation times.

Results

The authors conducted performance testing by comparing the certificate generation times of FALCON-1024 against the classical RSA-2048 algorithm on the Raspberry Pi 5 nodes. The testing involved running the generation scripts 25 times for each algorithm on both the publisher and subscriber devices.

• FALCON-1024 Performance: The FALCON algorithm generated certificates in approximately 68–70 milliseconds on average.
• RSA-2048 Performance: The RSA algorithm required over 300 milliseconds on the same devices.

Contrary to the common perception that PQC algorithms are universally more computationally expensive than classical alternatives, the results indicated that FALCON-1024 was significantly faster than RSA-2048 in this specific context. The authors attribute this to the fact that RSA certificate generation is dominated by expensive large integer primality testing and modular exponentiation, which scales poorly. In contrast, FALCON relies on polynomial arithmetic over NTRU lattices and Fast Fourier Transforms, which are more efficient at equivalent security levels.

Significance and Claims

The paper claims that the integration of PQC into lightweight IoT messaging architectures is not only feasible but can be achieved without disrupting overall system functionality. The key takeaways include:

• Viability of FALCON: FALCON demonstrates competitive and, in the case of certificate generation, superior performance compared to RSA on embedded hardware. This suggests that specific PQC algorithms can offer practical performance advantages alongside long-term security benefits.
• Proactive Security: The study validates that PQC can be deployed proactively in IoT infrastructures rather than waiting for a quantum threat to materialize. This is crucial given the long lifespan of IoT devices.
• Cryptographic Agility: The modular use of libraries (OpenSSL, liboqs, oqsprovider) allows for quantum-safe implementations without modifying application-level MQTT logic, facilitating a smoother transition to post-quantum security.

The authors conclude that while PQC generally introduces overhead, the specific characteristics of FALCON make it a viable option for securing current and future IoT infrastructures, providing a foundation for cryptographic agility in the transition to a post-quantum world.

Future Work

The paper acknowledges that FALCON relies on high-precision Gaussian sampling and floating-point operations, which may introduce timing leaks and side-channel vulnerabilities. As a direction for future work, the authors propose evaluating SOLMAE, a lattice-based signature scheme similar to FALCON in compactness but designed with explicit resilience against side-channel attacks, within the same testbed.