# Post-Quantum Authentication in the MQTT Protocol
## 4 Materials and Methods
### Implementation of MQTT Authenticated with Digital Signatures  
Experiments were run on Docker ([[https://www.docker.com/](https://www.docker.com/)]([https://www.docker.com/](https://www.docker.com/)) (accessed on 2 February 2023)), a container management software. Results were gathered using Docker's Research Usage extension ([[https://www.docker.com/blog/how-to-monitor-container-memory-and-cpu-usage-in-docker-desktop/](https://www.docker.com/blog/how-to-monitor-container-memory-and-cpu-usage-in-docker-desktop/)]([https://www.docker.com/blog/how-to-monitor-container-memory-and-cpu-usage-in-docker-desktop/](https://www.docker.com/blog/how-to-monitor-container-memory-and-cpu-usage-in-docker-desktop/)) (accessed on 2 February 2023)). The Docker environment has 4 CPU Cores and 8 GB of memory allocated for its use. Docker was run on an Apple Computer with a 2.9 GHz Quad-Core Intel Core i7 with 16 GB RAM.  
The interaction setup on Docker closely matches what is seen in Figure 1, with the difference that TLS is used to secure the MQTT connection; this is currently the only option for secure MQTT. There is a broker (matching the gateway), a publisher (matching the temperature sensor) and a subscriber (matching the mobile device). The network is set up and the publisher publishes 60 updates to the broker. The broker then forwards on these updates to the subscriber. The CPU, memory and disk usages, time taken and data sent over the network are monitored. This network was set up three times with the CRYSTALS-Dilithium digital signature scheme at security levels 2, 3 and 5 (referred to as dilithium2, dilithium3 and dilithium5, respectively, for brevity). This experiment was  
Figure 9: Average authentication time in KEM-based and signature-based protocols.  
repeated with limited Docker resources (memory limited to 1 GB, 1 CPU core, and swap memory limited to 512 MB) to view what effect the constraint would have on the function of the MQTT network.  
The Docker image used for the experiments can be found at the demos fork of open-quantum-safe ([[https://github.com/anhu/oqs-demos/tree/wolfmqtt_compat/mosquuitto](https://github.com/anhu/oqs-demos/tree/wolfmqtt_compat/mosquuitto)]([https://github.com/anhu/oqs-demos/tree/wolfmqtt_compat/mosquuitto](https://github.com/anhu/oqs-demos/tree/wolfmqtt_compat/mosquuitto)) (accessed on 2 February 2023)) where it builds Mosquito ([[https://mosquuitto.org/](https://mosquuitto.org/)]([https://mosquuitto.org/](https://mosquuitto.org/)) (accessed on 2 February 2023)), an open source MQTT broker. Docker was chosen because our focus is on the postquantum scheme and its incorporation in MQTT, rather than on the considerations required when there are issues with the network connection.  
We decided to use CRYSTALS-Dilithium as the digital signature algorithm of choice because NIST has concluded that CRYSTALS-Dilithium is well suited for most applications [24]. Additionally, Falcon, another to-be-standardized postquantum digital signature algorithm, uses floating point arithmetic, which is undesirable for IoT devices due to the greater computational costs required. Indeed, floating point arithmetic on more constrained devices is implemented in software, resulting in significantly slower calculations. There is also potential for side-channel attacks on Falcon as a result [25].