Post-quantum signatures and KEMs were built for servers, not for a meter on a coin cell and a 50 kbps link. Q-Stream protects the steady-state path in firmware — kilobytes of state, a 16-byte tag, sub-millisecond compute — so the fleet goes quantum-safe without a hardware swap.
| Metric | ML-KEM-768 | ML-DSA-44 | SLH-DSA-128f | Classic McEliece | Q-Stream | Q-Stream advantage |
|---|---|---|---|---|---|---|
| CPU cycles (sign) | ~0.5–1 M | ~2–4 M | ~10.6 M | ~1.5 M | ~500–1,000 | 1,000×–10,000× faster |
| Signature size | 1088 B | 2420 B | 17 KB | 128 B | 32 B | 12×–75× smaller |
| RAM usage | ~10–15 KB | ~30–40 KB | ~20–30 KB | ~300+ KB | < 1 KB | 15×–300× lower |
| Math complexity | Polynomial (NTT) | 64-bit floating point | Polynomial (NTT) | Large matrix ops | Simple arithmetic | Native logic |
| Verify / sec | ~2,000 | ~2,000 | ~1,000 | Very slow (key load) | ~1,000,000+ | Massive scaling |
| Battery impact | High (burst mode) | Severe (~200 ms active) | High (20 ms active) | Critical (radio drain) | < 0.1 ms | Extended life |
| Handshake time | ~5–10 ms | ~200.0 ms | ~11.0 ms | ~1 hr (at 300 bps) | ~0.01 ms | Instantaneous |
| Radio on-time | 7+ packets (frag) | 6+ packets (frag) | 20+ packets (frag) | 2,000+ packets (frag) | 1 packet (native) | No congestion |
| CapEx per meter | ~£125+ (replace) | ~£125+ (replace) | ~£125+ (replace) | £250+ (replace) | £0 (firmware only) | Total cost avoidance |
Why it compounds on a meter. On a constrained link, transmitted size drives both latency and battery drain. A 32-byte tag in a single native packet sidesteps the fragmentation, handshakes and burst-radio cost that PQC signatures impose — which is what turns a per-operation speed-up into fleet-wide cost and battery-life avoidance.
| Metric | ML-KEM-768 | ML-DSA-44 | SLH-DSA-128f | Classic McEliece | Q-Streammodelled steady-state | Interpretation |
|---|---|---|---|---|---|---|
| System role | Bootstrap KEM | Signature | Conservative hash-based signature | Alternate code-based KEM | Rekey + MAC | Q-Stream is compared as a steady-state protection path, not a public-key certificate primitive. |
| CPU cycles / operation | 658,754 encaps707,827 decap | 3,943,121 sign1,421,623 verify | 368,575,228 sign21,923,628 verify | ~1.5 M decap (order-of-mag.) | ~20,192 derive+tag~20,192 verify | Recurrent endpoint compute is far lower in the Q-Stream model than repeated asymmetric operations. |
| Transmitted object size | 1088 B ciphertext | 2420 B signature | 17,088 B signature | 128 B ciphertext | 16 B tag + amortized shared Q-Block | Airtime and fragmentation scale strongly with transmitted object size. |
| Long-term key / state size | 1184 B pub2400 B sec | 1312 B pub2560 B sec | 32 B pub / hash-based private structure | Very large public key / large private key structure | 256-bit local secret state | Q-Stream keeps persistent endpoint state very small. |
| Endpoint RAM footprint | ~6.5 KiB during encap | ~44.8 KiB during sign | ~2.5 KiB during sign | ~300+ KiB | < 1 KiB modeled | Small recurrent memory demand favours constrained meters and IoT nodes. |
| Math complexity | Module lattice | Module lattice | Hash hypertree | Large matrix ops / code-based | Simple traversal + symmetric check | An architectural simplification, not merely a speed optimization. |
| Compute time @ 80 MHz | ~8.23 ms~8.85 ms | ~49.29 ms~17.77 ms | ~4607 ms~274 ms | ~18.75 ms decap (illustrative) | ~0.25 ms | The embedded timing gap becomes large once operations are normalized to an MCU-class clock. |
| Radio on-time @ 50 kbps | ~174 ms | ~387 ms | ~2734 ms | ~20.48 ms ciphertext, but large-key provisioning burden | ~2.56 ms | On constrained links, transmitted size dominates steady-state latency and energy cost. |