Search

Abstract The development of quantum computers poses a risk to the cryptographic algorithms utilized by current public key infrastructure (PKI). High performance computing (HPC), inter- and intra-datacenter communications, and governmental communications are particularly vulnerable to security attacks by quantum computers. In response, there are on-going efforts on implementing post-quantum cryptography (PQC) despite the considerable overhead involved in processing PQC encrypted data packets in comparison with their classical counterparts. This work aims to help with the transition to quantum resistant cryptographic schemes by means of providing a thorough experimental performance comparison of the four algorithms selected by the National Institute of Standards and Technology (NIST) for standardization when implemented in a data processing unit (DPU). The experiments are conducted at line-rate, demonstrating for the first time operation at almost 100 Gbit/s and hence suitability for high-capacity data center environments.

In the near future, commercially accessible quantum computers are anticipated to revolutionize the world as we know it. These advanced machines are predicted to render traditional cryptographic security measures, deeply ingrained in contemporary communication, obsolete. While symmetric cryptography methods like AES can withstand quantum assaults if key sizes are doubled compared to current standards, asymmetric cryptographic techniques, such as RSA, are vulnerable to compromise. Consequently, there is a pressing need to transition towards post-quantum cryptography (PQC) principles in order to safeguard our privacy effectively. A challenge is to include PQC into existing protocols and thus into the existing communication structure. In this work, we report on the first experimental IPsec tunnel secured by the PQC algorithms Falcon, Dilithium, and Kyber. We deploy our IPsec tunnel in two scenarios. The first scenario represents a high-performance data center environment where many machines are interconnected via high-speed networks. We achieve an IPsec tunnel with an AES-256 GCM encrypted east–west throughput of 100 Gbit/s line rate. The second scenario shows an IPsec tunnel between a wireless NVIDIA Jetson and the cloud that achieves a 0.486 Gbit/s AES-256 GCM encrypted north–south throughput. This case represents a mobile device that communicates securely with applications running in the cloud.