# Wireless and Fiber-Based Post-Quantum-Cryptography-Secured IPsec Tunnel
## 1 Introduction
Naturally, that holds true for all certificates included in the certificate chain that need to be validated by the end entity. In Table 1, the signature and public key sizes of the three PQC signature algorithms chosen by the NIST are shown in bytes. Additionally, Kyber's public key and encapsulation sizes in bytes can be seen. For reference purposes, Table 2 shows the sizes in bytes for the most commonly used classical signature algorithms. The signature algorithms mentioned in Table 2 are not quantum-safe. Comparing Table 1 with Table 2 shows clearly that the sizes of the PQC algorithms are significantly greater compared to their classical counterparts. Hence, the size of a PQC certificate is considerably greater than the size of a certificate that is signed using classical cryptographic algorithms such as RSA. While PQC algorithms have yet to be standardized and rolled out into production systems, efforts are being taken to examine so-called hybrid certificates [19; 20]. Hybrid certificates are certificates that support the use of multiple algorithms during the transitional phase where classical algorithms are still in use and PQC algorithms are being deployed. For the transition towards the use of quantum-resilient algorithms, PQC must be integrated into existing protocols that are used nowadays such as Internet Protocol security (IPsec). Our work contributes to the goal of integrating PQC into the widely established IPsec protocol. In this work, we use the reference implementations of Falcon, Dilithium, and Kyber that were submitted to the NIST competition. We do not use an optimized, accelerated, or in any form modified version of the algorithms. We benchmark the PQC algorithms Falcon, Dilithium, and Kyber on our experimental setup. We execute the algorithms on different processors for reference purposes. The main challenge that we address in the work we present here is the experimental integration of PQC into the IPsec protocol for the purpose of quantum-resilient communication. We set up a PQC-secured IPsec tunnel and implement the tunnel for two scenarios: (1) an intra-data-center high-speed connection between devices in the data center and (2) a client-to-data-center connection. With this work, it is our goal to contribute to the state of the art by presenting a quantum-safe software stack for setting up a high-speed IPsec tunnel. We demonstrate the use of the IPsec tunnel in a high-performance environment and in an environment with a mobile, low-power client. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Algorithm** & **I** & **II** & **III** & **V** \\ \hline Kyber & Pub key & 800 & & 1184 & 1568 \\ Kyber & Encaps & 768 & & 1088 & 1568 \\ \hline Dilithium & Pub key & & 1312 & 1952 & 2592 \\ Dilithium & Sig & & 2420 & 3293 & 4595 \\ \hline Falcon & Pub key & 897 & & & 1793 \\ Falcon & Sig & 666 & & & 1280 \\ \hline SPHNCS+ & Pub key & 32 & 48 & 64 \\ SPHNCS+ & Sig & 17,088 & & 35,664 & 49,856 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Signature (Sig) and public key (Pub key) sizes of Falcon and Dilithium in bytes for different NIST security levels (I, II, III, and V). Public key (Pub key) and encapsulation (Encaps) size of Kyber in bytes. For SPHNCS+, the sizes in bytes are indicated for the use of SHA-256 128-bit (NIST I), SHA-256 192-bit (NIST III), and SHA-256 256-bit hashing (NIST V). Figure 1: Chain of trust: The root CA signs the intermediate certificate. The end-entity certificate’s authenticity is confirmed by one or more intermediate CAs. Hence, trust is established. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Algorithm** & **Pub Key** & **Sig** \\ \hline RSA 1024 & 128 & 128 \\ \hline RSA 2048 & 256 & 256 \\ \hline RSA 4096 & 512 & 512 \\ \hline SECP384r1 & 48 & 96 \\ \hline SECP521r1 & 65 & 132 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Public key (Pub key) and signature (Sig) sizes of classical signature algorithms in bytes [19]. Classical signature and public key sizes are considerably smaller compared to the sizes employed in PQC signature algorithms.