Marin Ivezic Warns: Massive PQC Key and Signature Sizes Threaten to Overwhelm Network Infrastructure

Marin Ivezic Global

Overview

Marin Ivezic cautions that the transition to Post-Quantum Cryptography (PQC) presents complex infrastructure challenges beyond mere algorithm replacement. He highlights that dramatically increased key and signature sizes—e.g., ML-KEM-768 key shares are 38 times larger than X25519, and ML-DSA-65 signatures are 51 times larger than ECDSA—could overwhelm existing network devices like firewalls and middleboxes. The article stresses the importance of hybrid cryptography and framing PQC migration as an ongoing cryptographic agility program to address these unexpected operational hurdles effectively.

In Depth

Background

The advancement of quantum computers poses a significant threat to the security of current public-key cryptography, making the transition to Post-Quantum Cryptography (PQC) an urgent global imperative. However, many organizations tend to underestimate that PQC migration impacts not only pure cryptographic technical aspects but also extensive underlying IT infrastructure. This warning strongly suggests the critical need to consider operational facets such as technical compatibility, performance, and the cost of upgrading existing infrastructure early in PQC migration planning.

Key Findings

Marin Ivezic warns that the transition to PQC entails complex challenges beyond mere algorithm replacement. He specifically highlights how dramatically increased key and signature sizes from PQC algorithms could overwhelm existing network infrastructure, including firewalls and middleboxes. For instance, NIST-selected ML-KEM-768 key shares are up to 38 times larger than those from traditional elliptic curve cryptography (e.g., X25519), and ML-DSA-65 signatures can be 51 times larger than existing ECDSA signatures.

Such significant increases are projected to lead to higher network traffic, processing delays, and potential performance degradation or capacity overruns for existing network equipment and security devices like firewalls, load balancers, and intrusion detection systems. Many legacy systems are simply not designed to efficiently process such voluminous cryptographic data.

To address these challenges, the article emphasizes the essential role of implementing hybrid cryptographic schemes. Hybrid methods combine PQC algorithms with existing classical cryptographic algorithms, enabling a phased migration that balances compatibility with enhanced security. Crucially, PQC migration should not be viewed as a ‘one-time project’ but rather as a ‘continuous cryptographic agility program’ designed to build systems flexible enough to adapt to future technological shifts and evolving threats.

PQC migration is anticipated to be a complex, multi-year undertaking. Ivezic’s insights underscore that enterprises must deeply understand their specific network environments and infrastructure characteristics, extending beyond mere compliance with NIST standards, when formulating PQC strategies. Infrastructure upgrade plans to accommodate these increased key and signature sizes will be a crucial factor in accurately estimating migration costs and timelines. This information provides valuable insights for researchers, engineers, and investors to comprehend the realistic operational challenges of PQC migration and the imperative for strategic investments to effectively address them.

Get our weekly technology intelligence — free

Receive an infographic that lets you judge at a glance whether each field’s analysis report is worth reading.

Subscribe Free — Weekly Tech Intelligence

By subscribing, you’ll receive Troy-Technical’s weekly technology intelligence newsletter.

• Your email and selected fields are used only to deliver the newsletter.
• We never share your information with third parties.
• You can unsubscribe anytime via the link in each email.

See our Privacy Policy for details.

Agree & Continue ▶

Takes about a minute · Unsubscribe anytime