# Energy Consumption Framework and Analysis of Post-Quantum Key-Generation on Embedded Devices
## 5 Evaluation
### Energy Results--Key Generation
#### 5.1.2 Extrapolating Potential Energy Savings  
This section presents a highly speculative, order-of-magnitude estimate of the potential energy savings that could be realised by transitioning notionally from RSA-2048 key generation to ML-KEM-512 on a large scale. Due to the decentralised nature of key generation across various systems globally, the assumptions made here are necessarily quite broad. Key generation is also a comparatively low-volume cryptographic operation compared with others in the suite, and the results are accordingly small. Several key areas where RSA key generation is prevalent are considered:  
* **Web Servers (HTTPS):** Assuming approximately 300 million websites active globally using certificates (an estimate in Jan 2025 based on [44]), and a conservative average certificate cycle of 3 months (LetsEncrypt uses 60 days and has over 50% of the market), this equates to roughly 1.2 billion key generations per year. * **VPN Users:** With an estimated 1.5 billion VPN users globally [45], assuming each host generates a new key each year, this adds another 1.5 billion key generations annually. * **Other Applications (VPN, Email, SSH):** A conservative estimate for the combined key generation for secure email, SSH, and other applications is around 10% of the web server figure, supposing approximately 120 million key generations per year. Based on these highly speculative assumptions, the total estimated RSA key generations per year could be in the order of 2.82 billion. The experiment demonstrated (Figure 4) that the energy consumption for generating a single RSA-2048 key was approximately 1.093 Joules on the test platform. Therefore, taking this and RSA-2048 as the baseline, the total estimated annual energy consumption for key generation across these applications if performed on a Raspberry Pi 5 would be in the order of 3.082 GigaJoules. To convert this to kilowatt-hours (kWh)  
\[3,082,000,000\,\mathrm{J}\times\frac{1\,\mathrm{W}\cdot\mathrm{s}}{1\,\mathrm{ J}}\times\frac{1\,\mathrm{W}\cdot\mathrm{h}}{3600\,\mathrm{s}}\times\frac{1\, \mathrm{kW}\cdot\mathrm{h}}{1000\,\mathrm{W}\cdot\mathrm{h}}\approx 856.11\, \mathrm{kWh}\]  
Assuming an average electricity unit price of GBP 0.26 per kWh (based on the UK average from QEP Table 2.2.4 referenced in [46]), the estimated annual cost for RSA-2048 key generation across these 2.82 billion keys would be approximately  
\[856.11\,\mathrm{kWh}\times 0.26/\mathrm{kWh}\approx 222.59\,\mathrm{GBP}\]  
The experiments determined the energy consumption for ML-KEM-512 (offering comparable NIST Level 3 security to RSA-2028) to be approximately 7.61 Joules per 1000 key generations, or 0.00761 Joules per key. The energy saving per key generated would therefore be \(1.093-0.00761=1.09939\) Joules for each key. This suggests that less than 1% of the energy would be required for key generation using ML-KEM-512 PQC compared with RSA-2048, \(\sim\)131 times more efficient. For NIST 'Level 5' security, comparing RSA-4096 (11.952 Joules per key) with ML-KEM-1024 (approximately 0.00789 Joules per key), the potential energy saving multiplier is even more significant, at around 1500 times, whereas ECC P-521 (approximately 0.003376 Joules per key) is around 350 times more energy efficient than RSA-4096. Also noted here is that ML-KEM-1024 is circa four times more efficient than EC-P521, a significant advantage for the newer quantum-robust technology. In conclusion, while this extrapolation is based on numerous broad assumptions, it suggests that a large-scale transition from traditional key generation techniques like RSA-2048 to post-quantum alternatives such as ML-KEM could lead to substantial energy savings and reduced computational overhead, as well as protection from quantum techniques such as Shor. Whilst the work in this paper was carried out on the lower-power Raspberry Pi 5 platform, it is fully expected that there would be similar order of magnitude results on other computational architectures.