FIPS 203 · 204 · 205 · measured daily

Post-quantum cryptography, measured.

Every NIST-standardized post-quantum algorithm, benchmarked on real silicon and composed into full TLS and SSH handshakes. One thousand timed iterations per operation, garbage collector disabled, process pinned to a core. Every number links to the run that produced it.

Run date

2026-08-22

Commit

7e3d474

Host

Xeon Platinum 8259CL @ 2.50GHz

Instance

t3.medium

liboqs

0.15.0

CPU steal

6.9%

Algorithms tracked

3 KEMs, 5 signature schemes

Signing spread

6,972×

ML-DSA-65 against SLH-DSA-SHAKE-128s

Hybrid TLS wire cost

36.5×

2,336 B against classical 64 B

Run integrity

6.9%

CPU steal on t3.medium. Disclosed, not hidden

Signing time

The gap the standard doesn't warn you about.

Logarithmic axis — on a linear one, all but the largest bar would be invisible. That is the finding, not a plotting convenience.

ML-DSA-44

Lattice · level 2

108.8 µs

ML-DSA-87

Lattice · level 5

186.4 µs

ML-DSA-65

Lattice · level 3

202.9 µs

SLH-DSA-SHAKE-128f

Hash-based

66.65 ms

SLH-DSA-SHAKE-128s

Hash-based

1.415 s

100 µs1 ms10 ms100 ms1 s

Lattice (FIPS 204)Hash-based (FIPS 205)

FIPS 203

Key encapsulation — ML-KEM.

Replaces RSA and ECC key exchange. Sizes are what goes on the wire.

Algorithm	Keygen	Encap	Decap	Encap ops/sec	Public key	Ciphertext
ML-KEM-512NIST level 1	13.8 µs	25.5 µs	27.9 µs	39,179	800 B	768 B
ML-KEM-768NIST level 3	21.1 µs	23.2 µs	22.7 µs	43,140	1.16 KB	1.06 KB
ML-KEM-1024NIST level 5	25.8 µs	29.4 µs	47.0 µs	33,965	1.53 KB	1.53 KB

FIPS 204 · 205

Digital signatures — ML-DSA and SLH-DSA.

Note the inversion: the hash-based schemes carry the smallest public keys and the slowest signing on the board.

Algorithm	Keygen	Sign	Verify	Public key	Signature	Family
ML-DSA-44NIST level 2	37.4 µs	108.8 µs	58.3 µs	1.28 KB	2.36 KB	Lattice
ML-DSA-65NIST level 3	92.0 µs	202.9 µs	67.9 µs	1.91 KB	3.23 KB	Lattice
ML-DSA-87NIST level 5	87.8 µs	186.4 µs	74.8 µs	2.53 KB	4.52 KB	Lattice
SLH-DSA-SHAKE-128sNIST level 1	183.93 ms	1.415 s	1.43 ms	32 B	7.67 KB	Hash
SLH-DSA-SHAKE-128fNIST level 1	2.74 ms	66.65 ms	3.97 ms	32 B	16.69 KB	Hash

TLS 1.3 key exchange · composed

What it costs inside a real handshake.

Primitives in isolation don't tell you this. Full handshakes, same host, same night.

MLKEM768

Pure post-quantum key exchange

Mean

65.7 µs

Wire

2,272 B

vs classical

−78.5%

SecP256r1MLKEM768

Hybrid, NIST curve

Mean

221.9 µs

Wire

2,402 B

vs classical

−24.9%

X25519MLKEM768

Hybrid — the one most stacks deploy

Mean

290.2 µs

Wire

2,336 B

vs classical

−7.0%

X25519

Classical baseline

Mean

279.6 µs

Wire

64 B

vs classical

baseline

Read this before quoting a timing deltaThis run carried 6.9% CPU steal on a burstable instance, which inflates the classical baseline and compresses every delta above. Timing deltas from this host are a distribution, not a verdict. The byte counts are not — those are fixed by the protocol, not the processor. Read the wire column as the durable number. Migration to a dedicated-core instance is scheduled.

Take the data

Nothing here is behind a login.

Current-day snapshot free, forever. Clone the harness and you should reproduce these within run-to-run variance.

Compare algorithms →Protocol tracks →View the run Benchmark source Methodology