A Practical Field Guide to Post-Quantum Cryptography — Benchmarks Included, Breakthroughs Not

Survey paper benchmarks NIST-standardized PQC algorithms across IoT, healthcare, and defense, quantifying the real migration costs. Useful as a reference table; no new cryptographic results.

You know how every few years your office switches to a new badge system, and for six months everyone's carrying two badges because the old readers haven't been replaced yet? That's PQC migration. The locks still work, the new keys exist, and the actual hard part is the logistics of swapping every door in a building with a billion doors — while keeping them all locked the whole time. This paper's committed claim: a self-contained reference that benchmarks NIST-standardized post-quantum key encapsulation mechanisms (KEMs) and digital signature algorithms, quantifies the quantum resources needed to break current RSA/ECC schemes, and maps the results onto specific industrial verticals (IoT, healthcare, civil infrastructure, defense). It is not proposing a new algorithm. It is assembling a decision matrix for practitioners who need to choose one. The ladder context matters here. The NIST PQC standardization process concluded its initial selections in 2024 (ML-KEM, ML-DSA, SLH-DSA, FN-DSA). This paper benchmarks those finalists and provides comparative performance data — key generation time, encapsulation/decapsulation speed, signature size, verification time — across multiple programming languages (C via liboqs, Rust, Python, Java). The baselines are the algorithms themselves against each other and against classical RSA/ECDSA, not against a competing new scheme. On the quantum-attack side, the paper estimates Shor's algorithm resource requirements: roughly 4,098 logical qubits and about 10^10 Toffoli gates to break RSA-2048, drawing on prior estimates from Gidney and Ekerå (2021). These numbers are not new but are usefully compiled. Architecturally, the paper covers three PQC families: lattice-based (ML-KEM, ML-DSA), hash-based (SLH-DSA, XMSS), and code-based (Classic McEliece). It explicitly notes the tradeoffs: lattice-based schemes are fast but have larger key sizes; hash-based signatures are conservative and well-understood but stateful variants (XMSS) require careful key management; code-based KEMs have enormous public keys (up to ~1 MB for Classic McEliece) but strong security confidence. The benchmarking platform is standard desktop hardware, not embedded or constrained devices — a significant limitation for the IoT claims. Integrity is the weak spot. The benchmarks are the authors' own, run on their own hardware, with no independent replication. The quantum resource estimates are drawn from existing literature rather than independently computed. There's no pre-registration, and the benchmark selection — while reasonable — could be accused of convenience sampling. The paper acknowledges that real-world performance on constrained IoT hardware would differ substantially from their desktop results, but doesn't run those experiments. The industry-application sections (healthcare, defense, civil engineering) are literature reviews, not empirical studies. The milestone question for PQC migration is not about algorithmic invention — it's about deployment coverage. NIST estimates that full PQC migration across U.S. federal systems alone will take until roughly 2035. The paper's contribution is making the selection criteria more accessible, but the real bottleneck is organizational inertia, legacy system compatibility, and the "harvest now, decrypt later" threat timeline. The concrete number to watch: when does the fraction of TLS connections using PQC key exchange cross 50%? Google's Chrome telemetry showed ML-KEM adoption in TLS 1.3 at roughly 10-15% by early 2025. The obvious experiment not run: benchmarking on actual constrained devices (ARM Cortex-M4, RISC-V microcontrollers, FPGA implementations) that represent the IoT use cases the paper discusses at length. The PQCrypto community has extensive embedded benchmarks (pqm4 project). My read: this is a scope/resource limitation, not a hidden negative result. The ten-author team spans multiple institutions across Europe, and the paper reads as a collaborative survey deliverable, likely from an EU-funded project, where the goal was breadth over depth.