Composed protocol tracks

Measured inside the handshake, not beside it.

Cycle counts on a primitive don’t tell you what a connection costs. These are full TLS and SSH key exchanges — decomposed phase by phase, sized to the byte, and cross-checked against the liboqs speed tools and eBACS reference cycles so they can be verified against the canonical numbers. Measured on x86 and ARM so the figures travel.

Run date

2026-08-22

Commit

7e3d474

Host

Xeon Platinum 8259CL @ 2.50GHz

liboqs

0.15.0

Architectures

aarch64 · x86_64

OpenSSL

3.0.13

Every track

Hybrid and pure post-quantum against the classical baseline.

Expand any suite for its phase decomposition. The wire column is fixed by the protocol; the timing columns move with host load — read them as a distribution, and read the tail column as how far it strays.

MLKEM768vs X25519

83.3 µs

82.1 µs

89.0 µs

95.0 µs

2.77×

11,998

2,272 B

−47.5%

KEM keygen25.7 µs

KEM encapsulate28.1 µs

KEM decapsulate29.6 µs

Total83.3 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	25.7 µs	25.2 µs	27.5 µs	33.9 µs	2.6 µs	24.8 µs	86.0 µs	1,000
KEM encapsulate	28.1 µs	27.6 µs	30.7 µs	34.9 µs	3.0 µs	27.2 µs	108.6 µs	1,000
KEM decapsulate	29.6 µs	29.2 µs	32.3 µs	36.3 µs	1.4 µs	28.7 µs	41.9 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗MLKEM768

X25519classical baseline

157.6 µs

156.4 µs

165.2 µs

175.3 µs

1.43×

6,345

64 B

baseline

Classical keygen31.3 µs × 2 — client and server62.6 µs

Classical derive47.5 µs × 2 — client and server95.0 µs

Total157.6 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	31.3 µs	31.0 µs	31.8 µs	39.4 µs	1.9 µs	30.8 µs	57.6 µs	1,000
Classical derive	47.5 µs	47.2 µs	50.3 µs	51.7 µs	1.1 µs	46.9 µs	59.0 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗X25519

SecP256r1MLKEM768vs X25519

235.4 µs

233.1 µs

243.9 µs

250.5 µs

2.08×

4,248

2,402 B

+49.0%

KEM keygen25.8 µs

KEM encapsulate27.7 µs

KEM decapsulate29.5 µs

Classical keygen15.6 µs × 2 — client and server31.2 µs

Classical derive60.6 µs × 2 — client and server121.2 µs

Total235.4 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	25.8 µs	25.2 µs	28.9 µs	35.1 µs	2.7 µs	24.8 µs	83.4 µs	1,000
KEM encapsulate	27.7 µs	27.2 µs	31.5 µs	34.6 µs	2.9 µs	26.7 µs	105.4 µs	1,000
KEM decapsulate	29.5 µs	29.2 µs	31.1 µs	36.5 µs	1.3 µs	28.8 µs	40.8 µs	1,000
Classical keygen	15.6 µs	15.4 µs	15.8 µs	20.6 µs	1.5 µs	15.3 µs	54.3 µs	1,000
Classical derive	60.6 µs	60.2 µs	64.9 µs	66.0 µs	1.5 µs	59.9 µs	77.7 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗SecP256r1MLKEM768

X25519MLKEM768vs X25519

240.5 µs

238.4 µs

249.8 µs

255.9 µs

1.81×

4,157

2,336 B

+52.4%

KEM keygen25.8 µs

KEM encapsulate27.7 µs

KEM decapsulate29.5 µs

Classical keygen31.3 µs × 2 — client and server62.5 µs

Classical derive47.5 µs × 2 — client and server95.0 µs

Total240.5 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	25.8 µs	25.3 µs	28.5 µs	32.4 µs	2.4 µs	24.9 µs	77.9 µs	1,000
KEM encapsulate	27.7 µs	27.2 µs	30.9 µs	34.6 µs	3.1 µs	26.7 µs	108.3 µs	1,000
KEM decapsulate	29.5 µs	29.2 µs	32.1 µs	36.0 µs	1.3 µs	28.8 µs	39.6 µs	1,000
Classical keygen	31.3 µs	31.0 µs	31.7 µs	37.6 µs	1.4 µs	30.8 µs	49.4 µs	1,000
Classical derive	47.5 µs	47.3 µs	49.8 µs	50.9 µs	1.5 µs	46.9 µs	83.7 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗X25519MLKEM768

MLKEM768vs X25519

65.7 µs

61.4 µs

76.5 µs

86.5 µs

5.26×

15,225

2,272 B

−78.5%

KEM keygen22.3 µs

KEM encapsulate21.2 µs

KEM decapsulate22.1 µs

Total65.7 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	22.3 µs	18.9 µs	32.0 µs	40.7 µs	8.0 µs	18.6 µs	179.4 µs	1,000
KEM encapsulate	21.2 µs	20.7 µs	22.0 µs	30.6 µs	4.9 µs	20.5 µs	164.8 µs	1,000
KEM decapsulate	22.1 µs	21.6 µs	22.7 µs	32.0 µs	3.6 µs	21.4 µs	117.2 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0.5714%run 7e3d474 ↗MLKEM768

SecP256r1MLKEM768vs X25519

221.9 µs

215.0 µs

238.7 µs

374.7 µs

3.34×

4,507

2,402 B

−24.9%

KEM keygen19.5 µs

KEM encapsulate21.4 µs

KEM decapsulate23.8 µs

Classical keygen18.3 µs × 2 — client and server36.7 µs

Classical derive60.2 µs × 2 — client and server120.5 µs

Total221.9 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	19.5 µs	18.8 µs	19.5 µs	27.8 µs	7.5 µs	18.6 µs	185.6 µs	1,000
KEM encapsulate	21.4 µs	20.7 µs	21.5 µs	31.3 µs	7.2 µs	20.5 µs	190.0 µs	1,000
KEM decapsulate	23.8 µs	22.8 µs	28.7 µs	41.1 µs	8.4 µs	21.5 µs	199.9 µs	1,000
Classical keygen	18.3 µs	17.8 µs	18.3 µs	28.3 µs	5.0 µs	17.6 µs	147.6 µs	1,000
Classical derive	60.2 µs	58.4 µs	65.9 µs	99.0 µs	10.2 µs	58.2 µs	204.9 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0.5714%run 7e3d474 ↗SecP256r1MLKEM768

X25519classical baseline

279.6 µs

286.1 µs

318.6 µs

347.8 µs

3.35×

3,577

64 B

baseline

Classical keygen73.7 µs × 2 — client and server147.3 µs

Classical derive66.1 µs × 2 — client and server132.2 µs

Total279.6 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	73.7 µs	78.1 µs	91.0 µs	96.3 µs	19.5 µs	40.9 µs	417.7 µs	1,000
Classical derive	66.1 µs	65.6 µs	77.8 µs	80.8 µs	4.9 µs	54.6 µs	126.6 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0.5714%run 7e3d474 ↗X25519

X25519MLKEM768vs X25519

290.2 µs

266.1 µs

334.1 µs

691.5 µs

23.84×

3,446

2,336 B

−7.0%

KEM keygen32.9 µs

KEM encapsulate36.0 µs

KEM decapsulate43.0 µs

Classical keygen48.5 µs × 2 — client and server96.9 µs

Classical derive40.7 µs × 2 — client and server81.4 µs

Total290.2 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	32.9 µs	31.9 µs	44.4 µs	53.2 µs	6.3 µs	24.2 µs	156.2 µs	1,000
KEM encapsulate	36.0 µs	35.0 µs	47.6 µs	57.4 µs	8.6 µs	27.1 µs	258.1 µs	1,000
KEM decapsulate	43.0 µs	35.7 µs	41.4 µs	58.6 µs	217.8 µs	21.5 µs	6.11 ms	1,000
Classical keygen	48.5 µs	41.4 µs	65.1 µs	208.1 µs	31.3 µs	40.9 µs	413.7 µs	1,000
Classical derive	40.7 µs	39.7 µs	45.6 µs	56.8 µs	6.5 µs	39.4 µs	186.2 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 0.5714%run 7e3d474 ↗X25519MLKEM768

curve25519-sha256classical baseline

158.3 µs

157.1 µs

164.2 µs

176.3 µs

1.58×

6,317

64 B

baseline

Classical keygen31.4 µs × 2 — client and server62.7 µs

Classical derive47.8 µs × 2 — client and server95.6 µs

Total158.3 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	31.4 µs	31.0 µs	33.0 µs	40.6 µs	1.8 µs	30.7 µs	51.8 µs	1,000
Classical derive	47.8 µs	47.6 µs	50.2 µs	51.3 µs	1.1 µs	47.0 µs	72.7 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗curve25519-sha256

mlkem768x25519-sha256vs curve25519-sha256

241.1 µs

238.9 µs

250.1 µs

262.2 µs

1.90×

4,148

2,336 B

+52.0%

KEM keygen25.6 µs

KEM encapsulate27.6 µs

KEM decapsulate29.6 µs

Classical keygen31.3 µs × 2 — client and server62.6 µs

Classical derive47.8 µs × 2 — client and server95.6 µs

Total241.1 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	25.6 µs	25.2 µs	27.1 µs	32.0 µs	2.4 µs	24.6 µs	87.6 µs	1,000
KEM encapsulate	27.6 µs	27.2 µs	31.7 µs	34.7 µs	3.0 µs	26.8 µs	107.8 µs	1,000
KEM decapsulate	29.6 µs	29.2 µs	31.7 µs	36.5 µs	1.8 µs	28.7 µs	58.1 µs	1,000
Classical keygen	31.3 µs	30.9 µs	32.8 µs	38.0 µs	1.6 µs	30.7 µs	53.7 µs	1,000
Classical derive	47.8 µs	47.6 µs	50.2 µs	51.6 µs	1.0 µs	47.2 µs	58.7 µs	1,000

OQS_DIST_BUILD dispatch · NEON confirmed · ARM64v8 Graviton3CPU steal 0%run 9f57fb3 ↗mlkem768x25519-sha256

curve25519-sha256classical baseline

184.1 µs

161.6 µs

241.1 µs

272.8 µs

4.11×

5,430

64 B

baseline

Classical keygen49.9 µs × 2 — client and server99.8 µs

Classical derive42.2 µs × 2 — client and server84.3 µs

Total184.1 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Classical keygen	49.9 µs	41.0 µs	79.9 µs	91.4 µs	18.9 µs	40.5 µs	285.3 µs	1,000
Classical derive	42.2 µs	39.7 µs	63.1 µs	69.7 µs	7.6 µs	39.4 µs	111.1 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 1%run 7e3d474 ↗curve25519-sha256

mlkem768x25519-sha256vs curve25519-sha256

347.3 µs

335.9 µs

398.4 µs

484.7 µs

3.37×

2,879

2,336 B

+107.9%

KEM keygen32.1 µs

KEM encapsulate35.7 µs

KEM decapsulate36.8 µs

Classical keygen74.2 µs × 2 — client and server148.5 µs

Classical derive47.1 µs × 2 — client and server94.3 µs

Total347.3 µs

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
KEM keygen	32.1 µs	31.0 µs	39.5 µs	51.6 µs	9.2 µs	24.3 µs	252.9 µs	1,000
KEM encapsulate	35.7 µs	34.4 µs	48.0 µs	56.8 µs	8.0 µs	28.2 µs	214.3 µs	1,000
KEM decapsulate	36.8 µs	36.1 µs	40.7 µs	58.2 µs	5.4 µs	27.6 µs	118.0 µs	1,000
Classical keygen	74.2 µs	73.8 µs	90.7 µs	100.9 µs	8.0 µs	55.7 µs	143.0 µs	1,000
Classical derive	47.1 µs	39.8 µs	68.1 µs	101.6 µs	18.5 µs	39.4 µs	440.0 µs	1,000

OQS_DIST_BUILD dispatch · kyber768/falcon AVX2 · SHA3 AVX512VLCPU steal 1%run 7e3d474 ↗mlkem768x25519-sha256

ML-DSA-44

54.8 µs

100.8 µs

37.0 µs

1.28 KB

2.36 KB

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	54.8 µs	53.8 µs	68.8 µs	75.1 µs	7.7 µs	41.8 µs	183.8 µs	1,000
Sign	100.8 µs	78.6 µs	219.5 µs	337.2 µs	62.8 µs	46.8 µs	475.5 µs	1,000
Verify	37.0 µs	33.4 µs	49.3 µs	132.2 µs	17.9 µs	32.1 µs	253.8 µs	1,000

ML-DSA-65

59.9 µs

168.8 µs

56.5 µs

1.91 KB

3.23 KB

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	59.9 µs	51.3 µs	89.1 µs	206.0 µs	27.2 µs	50.7 µs	399.6 µs	1,000
Sign	168.8 µs	135.2 µs	394.6 µs	578.9 µs	110.2 µs	68.3 µs	819.6 µs	1,000
Verify	56.5 µs	50.4 µs	87.3 µs	103.2 µs	17.7 µs	50.0 µs	274.5 µs	1,000

ML-DSA-87

77.5 µs

238.3 µs

76.3 µs

2.53 KB

4.52 KB

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	77.5 µs	74.6 µs	88.5 µs	118.2 µs	12.0 µs	73.0 µs	265.7 µs	1,000
Sign	238.3 µs	185.4 µs	497.8 µs	723.2 µs	252.1 µs	97.5 µs	4.34 ms	1,000
Verify	76.3 µs	72.6 µs	85.1 µs	140.9 µs	18.9 µs	72.2 µs	421.6 µs	1,000

Falcon-512

9.57 ms

359.9 µs

78.9 µs

897 B

752 B

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	9.57 ms	8.77 ms	14.97 ms	19.62 ms	2.66 ms	6.62 ms	25.49 ms	1,000
Sign	359.9 µs	339.6 µs	513.5 µs	616.0 µs	62.1 µs	327.7 µs	1.06 ms	1,000
Verify	78.9 µs	72.4 µs	100.4 µs	210.7 µs	23.7 µs	70.1 µs	352.9 µs	1,000

Falcon-1024

29.96 ms

697.9 µs

147.1 µs

1.75 KB

1.43 KB

Lattice

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	29.96 ms	26.10 ms	51.04 ms	83.03 ms	12.43 ms	20.55 ms	144.68 ms	1,000
Sign	697.9 µs	670.5 µs	858.8 µs	1.08 ms	83.4 µs	642.4 µs	1.44 ms	1,000
Verify	147.1 µs	136.6 µs	197.5 µs	287.7 µs	36.8 µs	133.0 µs	727.8 µs	1,000

SLH_DSA_PURE_SHAKE_128S

181.51 ms

1.412 s

1.42 ms

32 B

7.67 KB

Hash

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	181.51 ms	174.23 ms	198.12 ms	383.56 ms	36.21 ms	166.83 ms	621.71 ms	1,000
Sign	1.412 s	1.350 s	1.594 s	2.939 s	257.81 ms	1.291 s	3.939 s	1,000
Verify	1.42 ms	1.32 ms	1.90 ms	3.35 ms	378.0 µs	1.17 ms	5.46 ms	1,000

SLH_DSA_PURE_SHAKE_128F

4.92 ms

66.42 ms

4.18 ms

32 B

16.69 KB

Hash

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Keygen	4.92 ms	2.82 ms	14.44 ms	32.74 ms	6.13 ms	2.60 ms	64.19 ms	1,000
Sign	66.42 ms	63.29 ms	78.13 ms	130.59 ms	13.28 ms	61.23 ms	250.38 ms	1,000
Verify	4.18 ms	3.80 ms	5.16 ms	7.89 ms	2.90 ms	3.47 ms	73.56 ms	1,000

AES-256-GCMx86_6416,384 B payload · 32 B key · 12 B nonce · 16 B tag

Payload size is a cited choice, not an arbitrary one: RFC 8446 §5.2 — max TLSPlaintext record length.

Phase	Mean	Median	p95	p99	Stdev	Min	Max	Iterations
Encrypt	9.3 µs	9.2 µs	9.6 µs	20.2 µs	1.7 µs	6.8 µs	40.3 µs	1,000
Decrypt	9.4 µs	9.2 µs	9.6 µs	20.7 µs	1.8 µs	7.8 µs	40.3 µs	1,000

How the handshake figure is builtThe handshake mean is composed, not timed end to end: each phase is measured in its own thousand-iteration loop and the handshake figure is their sum, with the classical keygen and derive counted twice because both parties perform them. That identity holds across every committed suite to within 0.002%, and the smoke test fails the build if it stops holding. It is why the phase bars add to exactly 100% — they are the measurement, not an attribution over it.

What these benchmarks do not measureThese are composed handshakes sized on the wire. They are not packet captures: packets per handshake, initial congestion window effects, connections per core under real concurrency, and per-connection memory are not measured here and are not inferable from this data. Where those numbers matter to a capacity decision, they need their own instrument — naming the gap is more useful than estimating across it.

Take the data

Every figure traces to a run.

Clone the harness and you should reproduce these within run-to-run variance.

Overview →Compare algorithms →Raw JSON Methodology Benchmark source