Network Impact of Post-Quantum Certificate Chain sizes on Time to First Byte in TLS Deployments

• URL: http://arxiv.org/abs/2604.24869v1
• Date: Mon, 27 Apr 2026 18:00:23 GMT
• Title: Network Impact of Post-Quantum Certificate Chain sizes on Time to First Byte in TLS Deployments
• Abstract summary: Post-Quantum Cryptography (PQC) introduces significant deployment challenges in real-world networks.<n>We evaluate the latency cost of transitioning existing internet infrastructure to quantum-safe certificate schemes.<n>We additionally examine how CDN properties such as session resumption, certificate size optimizations, and geographical distribution reduce latency penalties.
• Score: 0.256101750765765
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Post-Quantum Cryptography (PQC) is a rapidly growing deployment challenge as cryptographically relevant quantum computers (CRQC) continue to advance, leaving traditional cryptographic algorithms used in X.509 vulnerable to attack. However, PQC introduces significant deployment challenges in real-world networks, with handshake sizes increasing from 5x to over 20x compared to classical algorithms. In this work, we evaluate the time to first byte (TTFB) under CDN-focused TLS conditions to characterize the latency cost of transitioning existing internet infrastructure to quantum-safe certificate schemes. We observe discrete increases in TTFB as certificate chain sizes exceed transport layer data flight limits. To isolate the impact of certificate chains, we evaluate both ECDSA and ML-DSA-based certificate schemes, generating similarly sized certificate chains through controlled addition of certificate extensions. We additionally examine how CDN properties such as session resumption, certificate size optimizations, and geographical distribution reduce latency penalties. We utilize Zeek-monitored TLS traffic through a High-Performance Computing System (NCSA) with terabyte network connectivity across the nation to quantify real-world session resumption rates. We compare CDN-driven size optimization with Merkle Tree Certificates (MTC) to examine how size reductions allow certificate chains to remain under the flight limit threshold. We find that MTC allows for 2x-3x increase in supportable certificate chain size, whereas CDN-based optimizations yield more limited reductions, supporting up to approximately 1.6x certificate chain size increase.

Related papers

• Practical Post-Quantum Cryptography for Bandwidth Constrained or Non-Terrestrial Networks, and Power Constrained Devices [5.100227795968935]
  Post-quantum (PQ) cryptographic algorithms require larger certificates, signatures, and keys.<n>These costs are especially severe in Non-Terrestrial Networks (NTNs)<n>This paper investigates an alternative cryptographic framework that replaces PQ digital certificates with shared secret keys (SSKs)
  arXiv  Detail & Related papers  (2026-07-25T02:51:15Z)
• A Lightweight Post-Quantum Authentication Framework for 5G Base Station Bootstrapping [10.889502556532639]
  EMULSION is a symmetric chained publicly verifiable authentication framework for 5G broadcast authentication.<n>It achieves 33x lower end-to-end delay and 31x less communication overhead than ML-DSA, and 12x lower delay and 5.4x less overhead than FN-DSA.<n>We formally prove the security of EMULSION and open-source its implementation for public testing and adaptation.
  arXiv  Detail & Related papers  (2026-06-29T16:42:16Z)
• OScaR: The Occam's Razor for Extreme KV Cache Quantization in LLMs and Beyond [50.440302567029654]
  Multi-modal intelligence has made the Key-Value cache a dominant memory bottleneck for efficient deployment.<n>In this work, we revisit the inherent limitations of the per-channel quantization paradigm.<n>We propose OScaR, an accurate and lightweight KV cache compression framework for X-LLMs.
  arXiv  Detail & Related papers  (2026-05-19T10:53:03Z)
• Empowering Mobile Networks Security Resilience by using Post-Quantum Cryptography [0.05461938536945721]
  We experimentally integrate NIST-standardized ML-KEM-768 and ML-DSA into an open-source 5G core (free5GC) using a sidecar proxy pattern that preserves network functions (NFs)<n>Results show that sidecar-based PQC insertion enables a non-disruptive and operationally predictable migration path for quantum-resilient 5G signaling.
  arXiv  Detail & Related papers  (2026-03-30T16:09:56Z)
• QoeSiGN: Towards Qualified Collaborative eSignatures [42.138439537056954]
  EU's eIDAS regulation specifies, e.g., advanced and qualified (QES) eSignatures.<n>QESs are based on a qualified certificate issued by a qualified trust service provider (QTSP)<n>We perform a threat analysis on the QES-creation process of Austria's national eID.<n>We present QoeSiGN, utilizing novel P2C2 technologies.
  arXiv  Detail & Related papers  (2025-12-15T18:07:17Z)
• Time-Based State-Management of Hash-Based Signature CAs for VPN-Authentication [3.3548757628577603]
  IPsec-based VPN connection authentication requires post-quantum cryptography.<n>We propose a design with time-based state-management that assigns VPN devices a certificate authority.<n> leaf certificates are based on classical cryptography but have a short validity time.
  arXiv  Detail & Related papers  (2025-09-15T08:49:08Z)
• Performance and Storage Analysis of CRYSTALS Kyber as a Post Quantum Replacement for RSA and ECC [45.88028371034407]
  CRYSTALS-Kyber is a post-quantum cryptographic solution standardized by NIST in 2022.<n>This study evaluates Kyber's practical viability through performance testing across various implementation schemes.
  arXiv  Detail & Related papers  (2025-08-03T09:53:45Z)
• Analysis of Post-Quantum Cryptography in User Equipment in 5G and Beyond [5.422409088453788]
  Quantum computing has led to the transition to post-quantum cryptography (PQC)<n>This paper presents a detailed implementation and performance evaluation of NIST-selected PQC algorithms in user equipment (UE) to UE communications over 5G networks.<n>We evaluate performance based on handshake latency, CPU and memory usage, bandwidth, and retransmission rates, under varying cryptographic configurations and client loads.
  arXiv  Detail & Related papers  (2025-07-22T23:21:16Z)
• Quantum Skyshield: Quantum Key Distribution and Post-Quantum Authentication for Low-Altitude Wireless Networks in Adverse Skies [36.14072181405793]
  Low-altitude wireless networks (LAWNs) have emerged as a critical backbone for supporting the low-altitude economy.<n>To meet growing data demands, some LAWN deployments incorporate free-space optical (FSO) links, which offer exceptional bandwidth and beam directivity.<n>Quantum Skyshield is proposed to enable reliable communication between the base transceiver station (BTS) and LAWN.
  arXiv  Detail & Related papers  (2025-07-20T04:43:33Z)
• A Scalable Framework for Post-Quantum Authentication in Public Key Infrastructures [0.0]
  This work explores the performance and scalability of a hierarchical certificate authority framework with automated certificate issuance.<n>The system is designed for compatibility with both classical and PQC algorithms, promoting crypto-agility while ensuring robust security against quantum-based threats.
  arXiv  Detail & Related papers  (2025-04-16T13:18:11Z)
• Design and Simulation of the Adaptive Continuous Entanglement Generation Protocol [41.82512234114899]
  A critical performance metric for quantum networks is the time-to-serve (TTS) for users' EP requests.<n>In this paper, we study the Adaptive Continuous entanglement generation Protocol (ACP), which enables quantum network nodes to continuously generate EPs with their neighbors.<n>ACP reduces TTS by up to 94% and increases entanglement fidelity by up to 0.05.
  arXiv  Detail & Related papers  (2025-02-04T03:22:27Z)
• Hybrid Scheme of Post-Quantum Cryptography and Elliptic-Curve Cryptography for Certificates -- A Case Study of Security Credential Management System in Vehicle-to-Everything Communications [0.0]
  This study proposes a hybrid certificate scheme of PQC and ECC to overcome the challenges in V2X communication.<n>PQC is used to establish a security level resistant to quantum computing attacks, while ECC is utilized to establish anonymous certificates.
  arXiv  Detail & Related papers  (2025-01-13T02:59:59Z)
• Improved Mask-CTC for Non-Autoregressive End-to-End ASR [49.192579824582694]
  Recently proposed end-to-end ASR system based on mask-predict with connectionist temporal classification (CTC) We propose to enhance the network architecture by employing a recently proposed architecture called Conformer. Next, we propose new training and decoding methods by introducing auxiliary objective to predict the length of a partial target sequence.
  arXiv  Detail & Related papers  (2020-10-26T01:22:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.