- The paper introduces Colibri, an open-source, single-threaded C implementation of Minimal IKE that separates protocol logic from wire-format serialization and interoperates with StrongSwan.
- The authors integrate ephemeral ML-KEM-512 into the unfragmented INIT exchange and retain PSK-HMAC authentication, achieving NIST security level 1 while preserving forward secrecy.
- Colibri uses about 3–5 times less memory than minimized StrongSwan and adds roughly 770 bytes to INIT messages and 0.47 MB of peak memory for post-quantum operation.
Context and motivation
IPsec provides layer-3 confidentiality, integrity, and authentication through Security Associations (SAs), whose negotiation, authentication, and key distribution are handled by the Internet Key Exchange (IKE) protocol. The current standard, IKEv2 (RFC 7296), has grown into a highly extensible framework whose footprint is prohibitive for resource-constrained devices such as IoT nodes and satellite terminals. RFC 7815 defines Minimal IKE, a stripped-down initiator-only subset of IKEv2 intended precisely for such environments, yet the protocol has seen little adoption — the authors observe that no efficient open-source implementation existed prior to this work, and consequently no performance studies of Minimal IKE with post-quantum primitives.
The timing matters: NIST's post-quantum standardization process concluded on March 11, 2025, with two KEMs (ML-KEM, HQC-KEM) and three signature schemes (ML-DSA, FN-DSA, SLH-DSA) standardized. Since Shor's algorithm breaks DH and RSA/ECDSA-based authentication, any IKE variant that remains classical is not viable long-term. The paper addresses both gaps simultaneously by delivering Colibri, an open-source Minimal IKE implementation, and a post-quantum variant of the protocol evaluated through it.
Minimal IKE as a design point
Minimal IKE retains only the INIT and AUTH exchanges of IKEv2 and drops everything else: notification-driven extension negotiation, MOBIKE, fragmentation, rekeying via CREATE_CHILD_SA, and EAP or full signature-based authentication. The cipher suite is static rather than dynamically negotiated, payload ordering is fixed, and parsing is correspondingly simplified. Key refresh replaces in-place rekeying with periodic full reauthentication (Reauth), which removes the state-management overhead of auxiliary exchanges and Dead Peer Detection at the cost of re-executing the entire handshake.
These simplifications are not merely cosmetic. Static structure eliminates runtime negotiation branches — a common source of parsing vulnerabilities — and reduces both bandwidth and memory footprint. The trade-off, which the paper states plainly, is loss of flexibility: no mobility, no fragmentation, no incremental rekeying.
The post-quantum transition strategy
The central technical difficulty is asymmetric in impact across the two exchanges. The AUTH phase tolerates large cryptographic material because IKEv2 supports message fragmentation there, so oversized post-quantum signatures or certificates can be transmitted without structural changes. The INIT phase, by contrast, explicitly forbids fragmentation to prevent denial-of-service via buffer exhaustion from unauthenticated peers. Post-quantum KEM public keys and ciphertexts routinely exceed typical MTUs — ML-KEM alone fits, but HQC-KEM ciphertexts (4,433 bytes at 128-bit security) do not. Standard IKEv2 handles this via dedicated extensions (RFC 8784, 9242, 9370), but these add exactly the kind of complexity Minimal IKE exists to avoid.
The authors' approach is deliberately minimal:
- INIT phase: integrate ML-KEM-512 directly into the KE payload. ML-KEM is the only standardized KEM small enough to avoid IP fragmentation during INIT. Semantically, the responder's KE payload now carries an encapsulated ciphertext rather than a DH public value; syntactically, the payload signals the new key establishment method.
- AUTH phase: retain PSK-based authentication with HMAC, which is the mandatory method in RFC 7815 and achieves quantum resistance through symmetric primitives without introducing large post-quantum signatures.
The combination yields resistance against a cryptographically relevant quantum computer attacker at NIST security level 1. A necessary caveat the paper makes explicit: PSK/HMAC authentication alone would be insufficient, since all key material would derive from long-term shared secrets, so a single endpoint compromise would break all past and future sessions. The ephemeral ML-KEM exchange is what supplies forward secrecy; the security claim therefore depends jointly on the KEM's ephemerality and the secrecy of the pre-shared key.
Colibri implementation
Colibri is written from scratch in C as a single-threaded initiator. Its architecture separates logical structs (endianness-independent C structures for protocol semantics, cryptography, and state) from binary structs (packed wire-format representations matching the RFC exactly), with a dedicated translation layer between them. This dual-representation design cleanly isolates protocol logic from serialization concerns and confines byte-order handling to one layer. Standard functionality is delegated to external libraries (OpenSSL) rather than reimplemented.
Validation uses a Dockerized StrongSwan responder, chosen because Minimal IKE defines only the initiator role; interoperability with a reference-compliant full IKEv2 implementation serves as the correctness check for message formatting, cryptographic operations, and protocol behavior.
Benchmarks compare Colibri against a minimized StrongSwan IKEv2 initiator using identical cipher suites (SHA-1 PRF/AUTH, AES-128, X25519 classically; ML-KEM-512 post-quantum), all primitives from OpenSSL. One fairness limitation is acknowledged upfront: StrongSwan requires at least six threads while Colibri is single-threaded, and no single-threaded StrongSwan configuration exists, so timing comparisons carry this intrinsic asymmetry.
| Metric |
Colibri |
StrongSwan |
| Init request size (classical / PQ) |
152 B / 920 B |
240 B / 1164 B |
| Auth request size (classical / PQ) |
108 B / 108 B |
108 B / 172 B |
| Avg memory (classical / PQ) |
1.28 MB / 1.75 MB |
6.21 MB / 6.67 MB |
| Peak memory (classical / PQ) |
1.67 MB / 2.13 MB |
6.62 MB / 6.99 MB |
Three findings stand out. First, memory usage — the binding constraint on constrained devices — is reduced roughly 5× (average) and 4× (peak) classically, and 3–4× post-quantum, despite Colibri doing more work per thread. Second, post-quantum request generation in Colibri is faster than StrongSwan's (1.116 ms vs. 1.764 ms for INIT) even with a sixth of the threads, indicating that StrongSwan's overhead is architectural rather than cryptographic. Third, the post-quantum transition costs Colibri only ~770 additional bytes on INIT and ~0.47 MB peak memory relative to its classical variant — the ML-KEM integration fits within a single unfragmented packet as designed, validating the central protocol-design claim that Minimal IKE can absorb post-quantum key establishment without structural extension.
The implication is direct: quantum-resistant IPsec negotiation becomes feasible on devices where full IKEv2 was already marginal, and remains feasible after the PQC transition.
Limitations and open questions
Several caveats bound the results. The benchmark comparison is inherently unfair on threading, as noted above, though the direction of the memory advantage is unlikely to reverse. The evaluation covers only the initiator side validated against StrongSwan; no deployment-scale or network-condition testing (lossy links, high-latency satellite channels) is reported. Security level 1 (ML-KEM-512) is the weakest NIST category, and the PSK-based authentication model presumes an out-of-band key distribution channel whose management cost is not analyzed. Reauth-based key refresh trades continuous protection for periodic re-execution; the exposure window and its acceptability under an adversary model with a CRQC are not quantified. Finally, the hybrid classical-plus-post-quantum transitional mode and KEM-based authentication replacing signatures are proposed but not implemented.
Conclusion
This work converts Minimal IKE from an unimplemented RFC into a usable, measured artifact: Colibri demonstrates order-of-magnitude-relevant reductions in memory footprint versus StrongSwan, and its ML-KEM-integrated variant shows that post-quantum key establishment can be absorbed into the fragment-free INIT exchange without violating the protocol's minimality. The remaining open questions concern higher security levels, hybrid transitions, signature-free KEM authentication, and behavior under realistic constrained-network conditions.