Post-Quantum Performance: A Comprehensive Benchmark Analysis

The Performance Question

As organizations evaluate post-quantum cryptography adoption, performance is a critical concern. Post-quantum algorithms have fundamentally different computational characteristics than their classical counterparts—larger keys, different mathematical operations, and new optimization opportunities.

This analysis presents comprehensive benchmarks of HPCrypt's ML-DSA and ML-KEM implementations, explaining not just the numbers but the underlying factors that determine performance.

Benchmark Methodology

Test Environment

All measurements were conducted on standardized hardware to ensure reproducibility:

Measurement Protocol

Each operation was measured using the following protocol:

1. Warmup: 1000 iterations discarded to stabilize CPU frequency
2. Measurement: 10,000 iterations with nanosecond precision timing
3. Statistical Analysis: Median reported with IQR for outlier resistance
4. Repetition: 5 independent runs to verify consistency

ML-DSA Benchmark Results

Key Generation Performance

Key generation is typically a one-time cost, but matters for applications generating many ephemeral keys:

Signing Performance

Signing is the most computationally intensive operation due to rejection sampling:

Verification Performance

Verification is typically the most frequent operation in deployed systems:

ML-KEM Benchmark Results

Key Generation

Encapsulation

Decapsulation

Optimization Techniques

1. Vectorized Number Theoretic Transform (NTT)

The NTT is the computational core of lattice-based cryptography. Our AVX2 implementation processes 8 coefficients simultaneously:

#[target_feature(enable = "avx2")]
unsafe fn ntt_butterfly_avx2(
    a: &mut [i32; 256],
    zetas: &[i32; 128]
) {
    for layer in 0..8 {
        let m = 1 << layer;
        let k = 128 >> layer;

        for i in (0..256).step_by(2 * m) {
            let zeta = _mm256_set1_epi32(zetas[m + i / (2 * m)]);

            for j in (i..i + m).step_by(8) {
                let a_vec = _mm256_loadu_si256(a[j..].as_ptr() as *const __m256i);
                let b_vec = _mm256_loadu_si256(a[j + m..].as_ptr() as *const __m256i);

                let t = montgomery_mul_avx2(b_vec, zeta);
                let sum = _mm256_add_epi32(a_vec, t);
                let diff = _mm256_sub_epi32(a_vec, t);

                _mm256_storeu_si256(a[j..].as_mut_ptr() as *mut __m256i, sum);
                _mm256_storeu_si256(a[j + m..].as_mut_ptr() as *mut __m256i, diff);
            }
        }
    }
}

2. Montgomery Multiplication

We use Montgomery representation to avoid expensive division operations:

// Convert to Montgomery form once
let a_mont = to_montgomery(a);
let b_mont = to_montgomery(b);

// Multiply in Montgomery form (no division)
let c_mont = montgomery_mul(a_mont, b_mont);

// Convert back only when needed
let c = from_montgomery(c_mont);

This saves approximately 15-20% in polynomial multiplication routines.

3. Lazy Reduction

Instead of reducing after every arithmetic operation, we accumulate results and reduce once:

// Traditional approach: 3 reductions
let t1 = (a * b) % q;
let t2 = (t1 + c * d) % q;
let t3 = (t2 + e * f) % q;

// Lazy reduction: 1 reduction
let sum = a * b + c * d + e * f;  // May exceed q
let result = barrett_reduce(sum);  // Single reduction

4. Cache-Optimized Memory Access

We structure data layouts to maximize cache utilization:

// Poor cache behavior: strided access
for i in 0..256 {
    for j in 0..4 {
        result[j][i] = process(input[j][i]);
    }
}

// Optimized: sequential access
for j in 0..4 {
    for i in 0..256 {
        result[j][i] = process(input[j][i]);
    }
}

Platform Comparison

Performance varies significantly across platforms:

Recommendations by Use Case

Web Servers (TLS)

For TLS key exchange with ML-KEM:

Code Signing

For software signatures with ML-DSA:

IoT and Embedded

For constrained environments:

Running Your Own Benchmarks

Reproduce these results on your hardware:

# Clone and build
git clone https://github.com/seceq/hpcrypt
cd hpcrypt

# Run comprehensive benchmarks
cargo bench --features=bench

# Run specific algorithm
cargo bench --features=bench -- ml_dsa_65

# Generate comparison report
cargo bench --features=bench -- --save-baseline current
cargo bench --features=bench -- --baseline current

Benchmark results are output in both human-readable format and JSON for automated analysis.

Conclusion

Post-quantum cryptography is ready for production deployment. With careful implementation, the performance overhead compared to classical algorithms is modest—and in some cases, post-quantum algorithms outperform their classical counterparts for equivalent security levels.

HPCrypt demonstrates that pure Rust implementations can achieve performance competitive with optimized C libraries while providing the safety guarantees Rust is known for. As quantum computing advances, this combination of security, safety, and performance will become increasingly important.