pq-transport: measure what a hybrid key exchange costs a QUIC handshake - #11
Open
megonen wants to merge 1 commit into
Open
pq-transport: measure what a hybrid key exchange costs a QUIC handshake#11megonen wants to merge 1 commit into
megonen wants to merge 1 commit into
Conversation
The handshake numbers we had for X25519MLKEM768 came from TCP-TLS, where the concern is a handshake outgrowing a packet. QUIC is not TCP-TLS, and two of its properties pull in opposite directions: the client's Initial is padded to 1200 bytes whatever it carries, and a server may not send more than 3x what it has received before validating the peer's address. Neither effect is guessable, so this measures them on the real quinn + rustls stack. The two arms differ in kx_groups and nothing else -- same TLS version, suites, certificate and ALPN -- so the delta belongs to the key exchange. What it found, with a UDP relay recording every datagram: - The client's first flight goes from 1 datagram (1200 B) to 2 (2400 B): the hybrid ClientHello no longer fits a single QUIC Initial. - Total handshake bytes go 5202 -> 7653, x1.47. That is markedly cheaper than TCP-TLS's x2.49, because QUIC pads the Initial regardless and the classical case is already carrying padding the hybrid fills. - The flight structure is unchanged -- client, server, client -- so there is no additional round trip. On a real link, where latency is RTT and not CPU, that is the number that matters. - Anti-amplification is not a constraint and moves in the defender's favour: the larger client flight raises the server's allowance from 3600 to 7200 bytes, against 1338 and 2538 actually sent. The wall-clock figure is deliberately not treated as a result. On loopback it is dominated by scheduler wakeups, spanning 0.6-2.0 ms across runs of the same arm on the same machine. The README says so rather than leaving a reader to quote it. The key exchange's real CPU cost is small and already measured properly in the PQC benchmark. That also means there is no per-machine matrix here: datagram counts, byte totals and flight structure are protocol-determined and identical on any machine, and the one quantity that does vary is measured better elsewhere.
10 tasks
Collaborator
Author
|
Spec side: logos-co/logos-lips#429 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pq-transport: measure what a hybrid key exchange costs a QUIC handshake
Measurement harness supporting the phase-0 post-quantum transport RFC
(logos-co/logos-lips — [RFC] Post-Quantum Transport Security): a QUIC
handshake benchmark on the real quinn + rustls stack, varying the key exchange
group (
X25519vsX25519MLKEM768) and nothing else.What it answers
The TCP-TLS numbers in
reports/pqcprice the hybrid at ×1.26 latency /×2.49 bytes — but we run QUIC, and QUIC changes the accounting. Measured
(median of 300 handshakes, packet trace included in
results/):X25519X25519MLKEM768only datagrams per flight change. On a real link, where handshake latency is
set by RTT, the hybrid costs approximately nothing in latency.
Initial is padded to 1200 bytes regardless, so the classical handshake
already pays for padding the hybrid simply fills.
flight raises the 3× allowance from 3600 to 7200 B, against 1338 and 2538 B
actually sent before address validation.
The README states explicitly that the harness's wall-clock column is not to be
quoted: on loopback it is dominated by scheduler wakeups (0.6–2.0 ms spread
across runs of the same arm). The protocol-determined quantities above are what
the tool exists to measure; CPU cost of the key exchange itself is measured in
reports/pqc.Layout
tools/benchmarks/pq-transport/quic-handshake/— Makefile, pinned toolchain,Cargo.lock, andresults/mac.txtstamped with CPU and rustc version.