# Post-Quantum Migration of the Tor Application
## 4 Implementation
### PQC Runtimes  
The schemes of interest were benchmarked using the OQS library to grasp the performance of the nodes against PQC schemes. Table 8 shows the average number of operations per second on Raspberry Pi (4 GB of RAM) 4b and 5 for both KEMs and signatures. Here, Raspberry Pi 4 significantly under-performed compared to the results published by OQS. For example, ML-KEM-512 ran 3807 key generation operations per second, whereas \begin{table}
\begin{tabular}{l c c c} \hline \hline  & **Sign/s** & **Verify/s** & **Model** \\ \hline Ed25519 & 2939.1 & 1327.0 & 4b \\ RSA2048 & 199.2 & 7492.9 & 4b \\ RSA3072 & 21.3 & 1209.6 & 4b \\ Ed25519 & 16,301.1 & 6846.1 & 5 \\ RSA2048 & 281.0 & 10,289.0 & 5 \\ RSA3072 & 90.1 & 4652.2 & 5 \\ \hline \hline  & **Key Exchange/s** & & **Model** \\ \hline X25519 & 1044.6 & & 4b \\ X25519 & 5973.5 & & 5 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Benchmark of Tor’s asymmetric schemes on Raspberry Pi. Average operation iteration per second. Figure 3: Execution speed per function. Kyber-512 achieved 23,348 keygen/s (Table 4). On the other hand, model 5 accomplished closer outputs. Based on the fact that a key exchange for a KEM requires key generation, encapsulation, and decapsulation operations,  
\[T_{\text{KE}}=T_{\text{kengen}}+T_{\text{encaps}}+T_{\text{decaps}}.\]  
Here, the fastest post-quantum KEM scheme performed slightly faster than X25519. The 4b model achieved 0.95 ms per classical KE exchange and 0.91 ms per ML-KEM-512 KE; nonetheless, model 5 achieved closer results with 0.167 ms per X25519 against 0.161 ms. The operations per second are displayed in Tables 7 and 8. On the client (x86_64 architecture), X25519 was benchmarked as KEM and it resulted in 22,839.0 keygen/s, 11,950.9 encaps/s, and 26,040.8 decaps/s, thus corresponding to a speed of 0.1659 ms per key exchange. Meanwhile, ML-KEM-512 produced 38,732.0 keygen/s, 33,241.3 encaps/s, and 36,170 decaps/s, showing a speed difference of 66% (between 0.1659 and 0.0835). From a runtime point of view, adopting ML-KEM-44 to replace Curve25519 key exchange on these devices would result in an acceleration of the overall process. Yet, this is the only scheme where X25519 is slower. On Raspberry model 4b, ML-KEM-768 showed a 14% execution time increase, while sntrup761 performed the KE operations in 43.3 ms, nearly 50 times slower than X25519. Nevertheless, on the client, the NTRU scheme was only six times slower than the classical key exchange with a timing of 1.005 ms/KE. Regarding DSA schemes, Edwards-curve 25519 signing remains the fastest of the standards, followed by Falcon-512, which is still, on average, 4.8 times slower. Moreover, Ed25519 key and signature sizes (32 and 64 bytes, respectively) stay significantly smaller than both post-quantum DSAs (see Tables 4 and 6), which introduces storage and transmission overhead. It should be noted that the need for flexible key management increases as the public and private keys of Falcon and ML-DSA differ, unlike the currently used Ed25519. In terms of verifying operation speed, Falcon slightly surpasses RSA2048 on Raspberry Pi 4b and runs almost twice as fast in comparison to model 5. Without taking size and key pair generation into consideration, the fastest combination of quantum-robust signature cryptosystems, as a hybrid, would be Falcon-512 with Ed25519 at security level one. RSA is not considered, as Tor is trying to move away slowly from it. However, if one considers key sizes and key pair operations per second, ML-DSA with Ed25519 is a better choice, achieving the second NIST security category.