PQC TLS Transmission Cost Testing - crt26/PQC-LEO GitHub Wiki

This tool provides automated testing for TLS 1.3 handshake transmission costs using Post-Quantum Cryptography (PQC), Hybrid-PQC, and classical algorithms. It measures the number of bytes sent and received during one-way and mutually authenticated TLS handshakes for every supported signing-algorithm/KEM pairing and classical signing-algorithm/key-exchange-group/ciphersuite combination. It utilises the PQC, Hybrid-PQC, and classical algorithms integrated into OpenSSL 4.0.3 and the OQS-Provider library.

The tool performs both one-way and mutual authentication for every supported PQC, Hybrid-PQC, and classical algorithm configuration. The results are outputted as CSV files, with each file containing the handshake transmission costs for a specific algorithm category.

The automated testing tool is currently only supported on the following devices:

• x86 Linux Machines using a Debian-based operating system
• ARM Linux devices using a 64-bit Debian-based Operating System

This tool supports PQC and Hybrid-PQC algorithms available through OpenSSL 4.0.3 and the OQS-Provider, with a small number excluded because of known incompatibilities and dependency limitations. It also supports various classical digital signature, key-exchange-group, and ciphersuite combinations which can be used as a baseline to compare PQC/Hybrid-PQC results to.

The algorithms used within this category of testing are the same as those used for TLS handshake performance testing. The supported algorithms are listed in the following project documentation:

Supported Algorithms

Before running the TLS handshake transmission cost testing tool, please ensure that the following prerequisites are met:

• The project has been set up using installation mode 2 (Full Install), or installation mode 1 followed by mode 3 (TLS Testing Libraries Only).

• Generate the required CA, server, and client certificates and private keys by running tls_generate_keys.sh script. This script creates the necessary credentials for both one-way and mutual authentication testing.

• TCP port 4433 is available on the localhost interface for the OpenSSL s_server to listen on during testing. Ensure that no other services are using this port and the firewall allows traffic on this port on that interface.

The required certificates and keys can be generated by running the following command from the scripts/test_scripts directory:

./tls_generate_keys.sh

Once the prerequisites are met, the TLS handshake transmission cost testing tool can be executed. The tool is a standalone Python script located in the scripts/test_scripts directory.

It can be run using the following command from the scripts/test_scripts directory:

python3 get_pqc_tls_bytes.py

The script will prompt the user to ask if they wish to assign a custom Machine-ID or use the default Machine-ID of 1. The Machine-ID is used to create a unique directory for storing the results of the test. If the selected Machine-ID directory already exists, the tool will prompt to either replace that directory or select another Machine-ID.

Once the Machine-ID is selected, the tool tests every supported PQC and Hybrid-PQC signing-algorithm/KEM pairing and every supported classical signing-algorithm/key-exchange-group/ciphersuite combination, using both one-way and mutual authentication.

Results are extracted directly from the OpenSSL s_client handshake summary and written as CSV files. They do not require the framework's result parsing scripts. Because the results are already structured in the testing script, there are no unparsed results generated for this testing category.

The generated results are stored in the following directory: test_data/results/tls_handshake_bytes/machine_x/

Where machine_x is the selected Machine-ID.

The result CSVs are separated into three files, one for each algorithm category:

• pqc_tls_handshake_bytes_results.csv - Contains results for all supported PQC algorithms.

• hybrid_tls_handshake_bytes_results.csv - Contains results for all supported Hybrid-PQC algorithms.

• classic_tls_handshake_bytes_results.csv - Contains results for all supported classical algorithms.