Energy-Aware System-Level Evaluation of Post-Quantum TLS on Embedded User Equipment over a Disaggregated 5G Network

Abstract: The transition to quantum-resistant security is a critical priority for the next generation of mobile networks, particularly within the disaggregated architecture of 5G. This paper presents an energy-aware system-level evaluation of Post- Quantum Cryptography (PQC) integrated into the Transport Layer Security (TLS) handshake on embedded User Equipment (UE). Using Raspberry Pi 5s as representative embedded processing platforms, we evaluate the performance of NIST-standardized combinations of classical and post-quantum signature and key exchange mechanisms (KEM), incorporating direct on-device power measurements to estimate per-handshake energy consumption. Results experimentally validate a strong coupling between latency and energy consumption, indicating that execution time is the dominant contributor to energy cost. Hash-based signature schemes incur up to 4x higher latency and 2x energy compared to lattice-based alternatives, while the impact of KEMs is comparatively smaller. The analysis further reveals that overall system performance is primarily constrained by cryptographic computation and concurrency-induced contention rather than network transport effects. These findings provide practical guidance for PQC deployment in mobile environments and demonstrate that lattice-based signatures offer a more favorable balance between security, efficiency, and scalability for 5G systems.

• The paper demonstrates that computational overhead—especially in signature operations—dominates energy consumption and latency in post-quantum TLS handshakes.
• The study shows that lattice-based signatures (e.g., Falcon, ML-DSA) yield scalable, low-latency performance under varying concurrency in 5G contexts.
• The results highlight key trade-offs between energy efficiency and cryptographic complexity, emphasizing the need for hardware acceleration in hash-based schemes.

Energy-Aware Evaluation of Post-Quantum TLS on Embedded 5G User Equipment

Introduction and Motivation

Quantum computing threatens the security of classical public-key cryptosystems foundational to protocols like TLS. In the mobile communications landscape, 5G's disaggregated architecture—with stringent energy and latency constraints on user equipment (UE)—requires a careful assessment of post-quantum cryptography (PQC) deployment feasibility. While prior studies commonly isolate protocol or cryptographic benchmarking, practical system-level PQC performance within 5G contexts remains underexplored, especially with respect to energy consumption and computational bottlenecks on embedded hardware.

This work empirically investigates the impact of NIST-standardized PQC primitives on TLS handshake performance, energy efficiency, and system stability in a 5G testbed with embedded nodes. The methodology leverages Raspberry Pi 5 devices, emulated RAN/core, and direct, device-level power monitoring to capture energy/cost trade-offs under varying concurrency levels and cryptographic suites.

Figure 1: Disaggregated 5G PQC Testbed Architecture. The red-dashed path denotes the logical end-to-end PQC TLS handshake overlay, while the blue solid lines indicate the hardware-level Ethernet connections.

System Architecture and Measurement Approach

The architecture decouples network and computation domains. PQC handshake operations run on real devices (Raspberry Pi 5, representative of edge UE), while the 5G network stack (NG-RAN, core functions) is virtualized. This setup isolates and enables precise measurement of the cryptographic workload's true system-level effects without confounding interference from network virtualization artifacts.

Each node is instrumented for both power and temperature; measurements include average and peak values over experiment durations, capturing both instantaneous and cumulative system behavior. Concurrency is modeled as multiple simultaneous client UEs, allowing the analysis of the scaling limits and stress regimes reflective of realistic mobile network access patterns.

Experimental Design: Cryptographic Suites and Concurrency Scaling

The study systematically evaluates 16 cryptographic configurations, covering all relevant NIST PQC KEMs (ML-KEM, HQC), signatures (Falcon, ML-DSA, SLH-DSA), and their classical (X25519, P-256) and hybrid pairings. Concurrency is varied across 1, 4, 10, 20, and 40 parallel handshake sessions to traverse the transitions from underutilization to contention and saturation.

Metrics include handshake latency, energy per handshake, server CPU utilization and temperature, throughput, retransmissions, RTT, and per-device power. These are computed for completed (not attempted) handshakes, ensuring fair comparative analysis.

Key Findings: Latency, Energy, and Concurrency Effects

Latency–Energy Coupling

There is a pronounced correlation between handshake execution time and total energy per connection. The computational overhead, especially of signature operations, dominates energy consumption rather than peak power draw. Significantly, hash-based signatures (SLH-DSA) impose up to 4$\times$ higher handshake latency and double the per-connection energy compared to lattice-based signatures (Falcon, ML-DSA). KEM choice (ML-KEM versus HQC) produces only second-order effects relative to signatures.

Figure 2: Latency-energy relationship for classical and post-quantum TLS configurations at low ($C=1$) and high ($C=40$) concurrency. Marker shape represents signature scheme, color KEM.

Scalability and Saturation

Under increased concurrency, system performance bifurcates according to signature class:

• SLH-DSA-based: Latency grows sharply and nonlinearly, exceeding 4.7 seconds at $C=40$ with high CPU utilization (~36%). This regime is characterized by rising retransmissions and, at extreme stress, decreased completed handshakes, indicating system degradation rather than recovery.
• Lattice-based (Falcon, ML-DSA): Modest, near-linear latency scaling observed, maintaining sub-1.5s handshakes and sub-3% CPU use at $C=40$. These configurations closely track classical ECDSA behavior in both single and moderate concurrency regimes.
• Throughput: Increases with concurrency until hitting a system-dependent plateau, beyond which added concurrency yields additional latency and retransmissions but little throughput gain.

Network versus Computation Dominance

The stable RTT (4–18 ms, independent of PQC scheme) alongside steep increases in handshake latency and retransmissions disambiguates the system bottleneck as computational, not network-induced. This finding is robust to network load and underscores the urgent need for cryptographic offloads or acceleration for PQC deployment on embedded platforms.

Retransmissions, Stress, and System Stability

Retransmissions serve as a proxy for processing-induced queueing and system backlog, especially under load-intensive configurations. For SLH-DSA, retransmissions rise rapidly with concurrency but then fall at the highest load, reflecting not improved performance but incomplete handshakes due to processing collapse.

Figure 3: Retransmissions versus concurrent client UEs across signature schemes and KEMs. Each subplot shows a signature scheme, with lines denoting KEMs. Retransmissions increase with concurrency, indicating growing delays. The drop for HQC + SLH-DSA reflects saturation, where fewer retransmissions result from incomplete handshakes rather than improved performance.

Power, Thermal, and Resource Characteristics

Client devices exhibit higher transient peak power (up to 8 W) but only brief excursions, whereas servers see sustained, moderate increases with overall temperature always below thermal throttling thresholds. Memory constraints are non-binding in this experimental setup, with PQC-induced overhead well within typical embedded device capacity (5.8–6.2 MB total use).

Theoretical and Practical Implications

The findings clearly delineate cryptographic computation, especially signature evaluation, as the rate-limiting factor for PQC adoption in constrained environments. Lattice-based signatures enable scalable, low-latency TLS handshakes on edge-class UEs—a critical property for large-scale, real-time mobile deployments. In contrast, hash-based signatures (e.g., SLH-DSA) compromise both energy and latency targets, rendering them unsuitable for high-concurrency or latency-sensitive applications without substantive hardware support.

The strong coupling of energy cost to execution duration (rather than peak power) implies that latency optimization directly advances energy efficiency. Concurrency-induced system collapse modes reinforce the necessity of dynamic load management, admission control, and possibly hybrid cryptographic approaches that can degrade gracefully under stress.

From a system architecture perspective, optimizing network links alone provides negligible improvements in PQC-enabled deployments; co-design of lightweight PQC primitives, cryptographic libraries, and runtime systems is essential. Moreover, PQC algorithm selection (favoring efficient lattice-based over hash-based signatures) emerges as a dominant axis of practical security/performance trade-off in mobile 5G environments.

Speculation and Future Directions

The experimental evidence suggests further work in hardware acceleration for hash-based signatures and optimization of lattice-based implementations will likely drive future PQC adoption on constrained platforms. Over-the-air effects, real wireless link variability, external precision power measurement, and broader processor/hardware diversity remain necessary avenues to fully characterize PQC deployment feasibility and system limits.

The emergence of energy-aware PQC performance benchmarks will inform not only cryptographic library development but also inform device selection and network architecture design for quantum-secure mobile systems. As PQC schemes evolve, ongoing evaluation that incorporates concurrency and energy perspectives will be essential for safe, performant transition strategies.

Conclusion

This comprehensive system-level analysis establishes cryptographic computation—principally the signature primitive—as the chief determinant of post-quantum TLS performance and energy consumption on embedded UEs in disaggregated 5G networks. Lattice-based signatures enable efficient, scalable PQC handshake deployment with negligible added cost over classical protocols, while hash-based schemes are an impediment absent acceleration. These results directly inform PQC suite selection and highlight the imperative for joint optimization of cryptography and system design in resource-constrained quantum-resilient mobile architectures (2607.03988).