The TLS Post-Quantum Experiment

What this post added

This post details a large-scale experiment conducted with Google to evaluate the performance and feasibility of deploying two post-quantum key agreement algorithms (SIKE and HRSS) within TLS 1.3. The experiment measured server-side handshake durations, comparing the performance of the post-quantum algorithms against the classical X25519. Results indicated that HRSS (CECPQ2) generally outperformed SIKE (CECPQ2b), suggesting that fast algorithms with large keys might be more suitable for TLS than slow algorithms with small keys. However, for the slowest connections on certain devices (Android, Linux, Windows), CECPQ2b showed better performance, potentially due to factors like packet fragmentation and loss. The experiment also analyzed the impact of session resumption, IP version, and network location on handshake latency, finding that session resumption significantly speeds up handshakes and that IPv6 connections were faster on desktop/laptop devices but slower on mobile devices.