Post-quantum cryptography on constrained IoT microcontrollers

Short answer: Two recent benchmark papers report that the standardised post-quantum algorithms run on small microcontrollers. On an ARM Cortex-M0+ (the RP2040 at 133 MHz), ML-KEM-512 completes a key exchange in about 36 ms, while ML-DSA signing shows high latency variance because of rejection sampling. On an ESP32-C6, all tested ML-KEM, ML-DSA and SLH-DSA parameter sets ran without external memory, with SLH-DSA showing substantially higher latency. These are laboratory benchmarks, not product results.

ML-KEM on a Cortex-M0+

An arXiv paper says migration to post-quantum cryptography is urgent for Internet of Things devices with 10 to 20 year lifespans, and that no systematic benchmarks existed for the finalised standards on the most constrained 32-bit processor class. It presents what it calls the first isolated algorithm-level benchmarks of ML-KEM (FIPS 203) and ML-DSA (FIPS 204) on an ARM Cortex-M0+. The board is the RP2040 (Raspberry Pi Pico) at 133 MHz with 264 KB of SRAM, running PQClean reference C implementations at all three security levels of each algorithm.

The authors report that ML-KEM-512 completes a full key exchange in 35.7 ms in the latest version of the paper (36.3 ms in an earlier version), using about 2.8 mJ. They state this is 17 times faster and uses 94% less energy than ECDH P-256 on the same hardware. They also report that the Cortex-M0+ is only 1.8 to 1.9 times slower than published Cortex-M4 results, despite lacking 64-bit multiply, DSP and SIMD instructions.

ML-DSA signing latency

The same paper reports that ML-DSA signing has high latency variance because of rejection sampling, with a coefficient of variation of 66 to 73% and 99th-percentile latency up to 1,125 ms for ML-DSA-87. Variable signing time is a design consideration for applications with strict timing needs, though the paper measures one board and one implementation.

ESP32-C6 comparison

A PLOS ONE study evaluates ML-KEM, ML-DSA and SLH-DSA from the liboqs library on the ESP32-C6, across all standardised parameter sets. It reports that all of them execute successfully without external memory support. ML-KEM shows stable and predictable memory usage, with execution time rising with security level. ML-DSA key generation and signing cost more, and verification is comparatively efficient. SLH-DSA shows substantially higher execution latency, which the authors attribute to the computational cost of hash-based signatures on embedded hardware. The authors say performance and latency trade-offs need careful consideration.

Limits

These are measurements on two development boards with specific libraries. They say nothing about side-channel resistance, power budgets in a real product, or how a device would be updated. Numbers will differ with optimised implementations.

FAQ

Can ML-KEM run on a Cortex-M0+?

The arXiv paper reports it can, with ML-KEM-512 taking about 36 ms for a key exchange on an RP2040.

Why is ML-DSA signing slow to predict?

The paper attributes the variance to rejection sampling, with a 66 to 73% coefficient of variation.

How does the Cortex-M0+ compare with a Cortex-M4?

The authors report a 1.8 to 1.9 times slowdown against published Cortex-M4 results.

Are hash-based signatures efficient on these devices?

In the ESP32-C6 study, SLH-DSA showed substantially higher latency than the lattice-based schemes.

What hardware was tested?

An RP2040 board at 133 MHz with 264 KB of SRAM, and an ESP32-C6.