Mobile Energy Requirements of the Upcoming NIST Post-Quantum Cryptography Standards

TL;DR

This paper analyzes the energy consumption of post-quantum cryptography algorithms on mobile devices, highlighting their impact on battery life and proposing guidelines for their use in IoT and mobile systems.

Contribution

It provides the first extensive energy requirement analysis of PQC algorithms on a Cortex M4 platform, relating computational costs to data transmission and offering practical usage guidelines.

Findings

Structured-lattice PQC schemes are energy-efficient for mobile devices.

Energy, bandwidth, and latency vary widely among PQC algorithms.

Recommendations favor lattice-based schemes for cloud-connected mobile applications.

Abstract

Standardization of Post-Quantum Cryptography (PQC) was started by NIST in 2016 and has proceeded to its second elimination round. The upcoming standards are intended to replace (or supplement) current RSA and Elliptic Curve Cryptography (ECC) on all targets, including lightweight, embedded, and mobile systems. We present an energy requirement analysis based on extensive measurements of PQC candidate algorithms on a Cortex M4 - based reference platform. We relate computational (energy) costs of PQC algorithms to their data transmission costs which are expected to increase with new types of public keys and ciphertext messages. The energy, bandwidth, and latency needs of PQC algorithms span several orders of magnitude, which is substantial enough to impact battery life, user experience, and application protocol design. We propose metrics and guidelines for PQC algorithm usage in IoT and mobile systems based on our findings. Our evidence supports the view that fast structured-lattice PQC schemes are the preferred choice for cloud-connected mobile devices in most use cases, even when per-bit data transmission energy cost is relatively high.