# Energy Consumption Framework and Analysis of Post-Quantum Key-Generation on Embedded Devices
## 2 Related Literature
### NIST Standardisation  
In 2022, the National Institute of Standards and Technology (NIST) finalised its first set of quantum-resistant cryptographic algorithms [9] following a standardisation process initiated in 2017. This competition aimed to identify cryptographic methods resilient to both classical and quantum computer attacks. The selected algorithms were published as Federal Information Processing Standards (FIPS), establishing them as de facto standardssuitable for production use [31]. NIST's FIPS standards are widely recognised benchmarks for cryptography, making NIST's PQC selections likely to be adopted by industry and governments internationally.  
This paper primarily focuses on FIPS 203 [32], which standardises ML-KEM (formerly Kyber). ML-KEM is a Key Exchange Mechanism (KEM) that securely establishes a session between two parties using asymmetric encryption, subsequently enabling a shared secret symmetric key to be agreed and used for the secure encryption of data transfers between the parties. It employs lattice-based cryptography, relying on the mathematical difficulty of lattice problems like the Shortest Vector Problem (SVP) and Learning With Errors (LWE), believed to be hard to attack using both classical and quantum computers [31]. ML-KEM is designed to replace existing key-exchange protocols in applications, e.g., for websites and setting up other secure channels.  
Whilst ML-KEM is currently the only finalised FIPS standard for post-quantum key exchange, in March 2025, the NIST further selected Hamming Quasi-Cyclic (HQC) [33] as an alternative method to move towards standardisation. For this paper's experimentation, ML-KEM was used, owing to its integration into the OpenSSL 3.5 production library [10]. The first batch of NIST PQC standards [31] also included two digital signature algorithms: FIPS 204 [34], standardising ML-DSA (formerly Dilithium); and FIPS 205 [35], detailing SLH-DSA (formerly SPHNCS+).  
Beyond the First Batch PQC Standards--Round 4  
Many of the cryptographic techniques in the PQC process are based on lattice-based category methods [33], which unlike other techniques do not have a long history of use and validation nor have formal proofs attached to them. The NIST therefore sought diverse algorithm candidates, to mitigate risks associated with potential vulnerabilities in a specific category (specifically lattices), as noted on page 4 of the Round-4 NIST PQC status paper [33].  
As part of the evaluation of these candidates, the Isogeny-based key exchange candidate SIKE was withdrawn after a flaw was discovered--see pp. 1, 8 and 16 of [33]. Subsequently, the NIST selected Hamming Quasi-Cyclic (HQC), as per page 18 in the same document [33], a non-lattice-based key exchange protocol utilising 'quasi-cyclic codes', for standardisation. This alternative will proceed towards formalisation with a designated name and FIPS standard. Having multiple standardised options also allows for easier adoption of alternatives based on the environmental requirements of the deployment, such as bounds of working memory or key length. This desire for diverse characteristics across all areas is highlighted throughout the Round 4 status paper [33].