Post-Quantum Cryptography on ESP32 · Developer Portal

[giscus[bot]]

Post-Quantum Cryptography on ESP32 · Developer Portal

Post-quantum cryptographic algorithms are now standardized to protect connected devices against future quantum computing threats. This post introduces esp-pqc, a component that brings ML-KEM and ML-DSA to Espressif SoCs, and shows how to implement hybrid TLS 1.3 to safeguard network communication and Secure Boot V2 to verify firmware integrity, complete with real-world memory, flash, and performance benchmarks.

https://developer.espressif.com/blog/2026/10/esp32-post-quantum-cryptography/

[saivamshidanthoju]

This is a very interesting step toward making IoT devices more secure against future quantum computing threats! I’m especially interested in how ML-KEM and ML-DSA perform on resource-constrained ESP32 devices. It would be helpful to understand the memory usage, handshake latency, and power consumption compared with traditional cryptography. Also, does hybrid TLS 1.3 introduce any noticeable performance overhead on lower-end ESP32 boards? Great work!

[Pranav1904]

Tested on an ESP32-C5 (240 MHz, -O2) using the esp_hybrid_tls example with an OpenSSL 3.6 server over Wi-Fi.

• Classical (X25519 + ECDSA-P256): 953 KB flash, 17 KB peak stack, 6.9 KB heap during the session, and 249/263 ms minimum/median handshake time.
• Full PQC (X25519MLKEM768 + ML-DSA-65): Adds 36 KB flash over classical, with 35 KB peak stack, 20 KB session heap, and 416/476 ms minimum/median handshake time.

Breakdown of the additional overhead:

• ML-KEM-768: Adds approximately 17 KB of flash and 24 ms to the minimum handshake time compared with classical.
• ML-DSA-65: Adds approximately another 19 KB of flash and 143 ms to the minimum handshake time, mainly due to the larger certificate and signature verification.

Static RAM remains around 130 KB across both configurations. Checking the ML-DSA certificate takes 9.4 ms, compared with 1.9 ms for ECDSA.

All measurements were collected on-device. Power consumption has not been measured, and performance on other chips may vary.