CONTROLLED BASELINE COMPARISON
PQC application layer vs DTLS 1.2
Measured configurations shown side by side. No universal performance claim is implied.
PQC
ML-KEM-512-styleHKDF-SHA-256AES-256-CCMPer-device HMACCoAP · UDP 5683
VS
DTLS 1.2
ECDHE P-256ECDSA P-256AES-256-CCMServer identity verifiedUDP 5684
SUCCESSFUL MESSAGES / HOUR
PQC 24-HOUR MEASUREMENTS
Successful messages
32,790
Decrypt match
99.997%
RTT mean
213.83ms
RTT P95
503ms
Sender KEM mean
9.24ms
Receiver KEM mean
10.52ms
Messages / hour
1366.31
Needed a retry
49
PQC does a fresh KEM per message; DTLS amortizes a handshake across a session. RTT includes that per-message work.
DTLS 24-HOUR MEASUREMENTS
Successful messages
42,346
Parity
100%
RTT mean
11.98ms
RTT P95
18ms
Sender handshake mean
1926.68ms
Receiver handshake mean
1818.41ms
EXPERIMENTAL BASELINE CONSTRAINTS
Development certificate fixturesNo receiver-side client certificate authenticationDTLS cookies unavailable in inherited BL602 Mbed TLS build
SIZES (BYTES)
KEM public key800
KEM secret key1632
KEM ciphertext768
KEM shared secret32
Plaintext message22
Protected payload874
PQC CoAP datagram890
PQC IPv4 packet918
DTLS CoAP payload36
DTLS record (typical)73
512 parameter set, ML-KEM-512-style. No FIPS 203 conformance claimed.
DTLS 24H NOTES
- • 2 sender failures: ssl_read timeouts (~5002 ms) — one during a Wi-Fi disconnect
- • Handshake outliers 27,712 ms (sender) / 14,086 ms (receiver) — both completed
- • 5 record-length telemetry anomalies; typical record 73 B
- • receiver_process_ms starts after DTLS decrypt — not decryption time