Validate transfer of per-object performance costs to HPKE

Confirm whether the per-object performance costs measured for the study’s envelope-encryption format transfer to an HPKE-conformant envelope using ML-KEM-768 or an X25519–ML-KEM-768 hybrid.

Background

The paper’s envelope has the broad structure of HPKE base mode but is not HPKE-conformant: it uses a different key schedule, nonce construction, and application-level truncation protection. The authors did not implement or benchmark HPKE and only expect the measured per-object costs to transfer because the KEM operation and AEAD work would be similar. That expectation remains unvalidated.

References

Since an HPKE-based envelope would perform the same KEM operation once per object, a key schedule of a few hash calls and the same AEAD, we expect the per-object costs reported here to transfer, but that expectation is untested, and a new design should use HPKE and not this format.

— Benchmarking Post-Quantum Key Encapsulation in S3-Compatible Object Storage under Client Concurrency  (2610.21457 - Lingala et al., 15 Oct 2026) in Section 3, subsection “Post-Quantum KEMs, Hybrids and HPKE”