Migration of Network Protocols to Post-Quantum Cryptography (PQC): Performance Challenges, Key Size Issues, and Hybrid Solutions in TLS ۱.۳, IPsec, and QUIC

The rapid progress toward cryptographically relevant quantum computers poses an existential threat to the public-key primitives (RSA, ECC) that secure TLS ۱.۳, IPsec, and QUIC, enabling harvest-now-decrypt-later attacks on long-lived network traffic. This paper presents the first comprehensive cross-protocol performance evaluation of post-quantum cryptography migration using the NIST-standardized algorithms ML-KEM and ML-DSA under realistic ۲۰۲۶ network conditions. We compare classical (X۲۵۵۱۹ + ECDSA), hybrid (X۲۵۵۱۹ + ML-KEM-۷۶۸ with ML-DSA-۷۶۸), and pure post-quantum configurations across TLS ۱.۳, IPsec/IKEv۲, and QUIC. Experiments were conducted on production-grade implementations (OpenSSL with liboqs and strong Swan) under controlled latency (۰-۵۰ ms), bandwidth (۱۰۰ Mbps-۱۰ Gbps), packet loss (۰-۵ %), and MTU constraints, with over ۱,۰۰۰ iterations per configuration and statistical reporting of median, p۹۵, and p۹۹ latencies. Results show that hybrid key exchange introduces only modest overhead in TLS ۱.۳ (۸–۱۲% median handshake latency increase, ~۱.۴-۱.۶ KB extra bytes on the wire) while remaining largely unaffected by fragmentation due to TCP. In contrast, UDP-based protocols suffer significantly: IPsec experiences ۶۵-۷۲ % fragmentation probability without mitigation (reduced to <۸ % with IKE INTERMEDIATE at the cost of ۲۲-۳۵ % added latency), and QUIC shows ۱۵-۲۴ % latency increase that worsens to ۳۱-۴۲ % under packet loss. Pure post-quantum configurations consistently underperform hybrids. Energy measurements on edge-class hardware and high-concurrency server tests further highlight practical constraints.

کلیدواژه ها:

Post-quantum cryptography ، TLS ۱.۳ ، IPsec ، QUIC ، hybrid key exchange ، ML-KEM ، fragmentation ، network protocol migration