Imagine you're moving house and everyone tells you the new furniture is bigger, heavier, harder to get through the door. You dread moving day. Then you discover the new furniture is actually lighter than the old stuff — the dread was based on assumptions about wood density that turned out wrong for the specific manufacturer you're buying from. That's the core finding here: post-quantum cryptography on tiny IoT devices isn't the performance penalty everyone assumed. On the right stack, it's a performance upgrade. The committed claim: on wolfSSL-based TLS 1.3 implementations running on sub-$10 microcontrollers (Raspberry Pi Pico W, Pico 2 W, ESP32), the full post-quantum combination ML-KEM-512 + ML-DSA-44 completes handshakes 41% faster than the classical X25519 + RSA-PSS pairing on the Pico W, and 8.9× faster on the ESP32. The assumed hierarchy — that elliptic-curve key exchange is inherently cheaper than lattice-based PQC — does not hold when the hardware lacks optimized Curve25519 assembly. This is an empirical result, not a theoretical argument. The benchmark matrix is thorough for a workshop paper: 36 algorithm combinations pairing three ML-KEM parameter sets (512/768/1024) and two classical key exchanges (X25519, ECC P-256) with six authentication algorithms (ML-DSA-44/65/87, Ed25519, ECDSA, RSA-PSS), measured across four devices. They track both handshake latency and energy consumption — the latter matters enormously for battery-powered IoT. The Raspberry Pi Zero, being an order of magnitude more capable, showed near-uniform results across all combinations, which is itself a useful data point: on anything above bare-metal microcontroller class, algorithm choice barely matters. The ladder result against the implicit baseline is where this gets interesting. The conventional wisdom in the PQC migration community is that hybrid modes (classical + PQC bundled together) are the safe transitional path. This paper shows the IETF's draft-specified X25519+ML-KEM-768 hybrid incurs approximately the summed cost of both components rather than offering any performance compromise. On hardware without Curve25519 assembly optimization, hybrid is strictly worse than pure PQC. That's a pointed finding aimed directly at the standards process. The integrity picture is solid for a benchmarking paper but has clear bounds. All measurements are on real hardware with a specific TLS library (wolfSSL), which means results are implementation-dependent by design. The authors are transparent about this: they're measuring wolfSSL's code paths, not abstract algorithm complexity. The ESP32's 8.9× speedup for PQC likely reflects that wolfSSL's lattice code is better optimized for that architecture than its ECC code, not that lattice math is inherently 8.9× faster. This is simultaneously the paper's strength (real-world measurements on real devices) and its limitation (change the library and results may shift). One honest caveat the authors surface: ML-DSA's signing time has higher variance than classical alternatives. For applications with strict latency-predictability budgets — think industrial control loops or safety-critical sensor networks — this jitter is a real engineering concern, even if mean performance is better. The paper flags this but doesn't quantify the tail distribution, which would be the natural next measurement. The practical upshot for anyone managing an IoT fleet facing the 2028-2035 PQC migration deadlines: the performance excuse for delaying migration on constrained devices is weaker than assumed. The bottleneck is likely firmware toolchain readiness and supply-chain certification, not algorithm overhead. For the specific combination of wolfSSL on ARM Cortex-M and Xtensa architectures, pure ML-KEM-512/ML-DSA-44 is already the pragmatic default.
