# Secure and Scalable Internet of Things Model Using Post-Quantum MACsec
## 5 Experimental Environment and Results  
### Experimental Environment  
To evaluate our proposal, we assessed the impact of applying the NTRU algorithm to PQC-TLS on IoT device performance. The performance gap was measured as the security level increased in terms of CPU usage and operation time. Experiments were conducted on an IoT device, which consists of Raspberry Pi 3B+, featuring a 64-bit ARM Cortex-A53 Quad-Core Processor and 1 GB Memory to mimic the SSI experiment environment under identical conditions. In addition, a server was equipped with a 2.4 GHz 8-Core Intel Core i9 and 64 GB Memory to utilize the NTRU cryptographic algorithm across six security levels: 80, 112, 128, 160, 192, and 256 bits. Considering the issuance of certificates to the devices or the direct generation on the IoT devices, experiments were carried out on both the server and IoT devices to test the PQC key pair generation. Furthermore, we also measured the performance of the encryption of the secret key on the server and the decryption of the same on the IoT device within the PQC-TLS framework.  
Table 3 compares the key sizes of the NTRUs and RSA across various security levels [15]. By measuring the computing resources required for key generation, encryption, and decryption at each security level for the NTRUs, we aimed to validate the effectiveness of SSI-PQM as an IoT network platform. Our findings were then compared to previous research that reported that NTRUs exhibit superior performance compared to RSA at similar security levels, with respect to key size [28].  
\begin{table}
\begin{tabular}{l l} \hline \hline
1. & PQC -TLS Communication Setup in Step\#1 \\  & (a) & IoT device and CN initiate PQC-TLS handshake. \\  & (b) & CN generates a pre-master secret randomly: \\  & & Secret Key = KDF(PreMasterSecret, “session key derivation”) \\  & (c) & CN securely distributes the pre-master secret to the IoT device. \\  & (d) & IoT device and CN derive session keys from the pre-master secret: \\  & & Secret Key = KDF(PreMasterSecret, “session key derivation”) \\ \hline
2. & L2 TP Authentication and 802.1X Authentication Preparation in Step\#1 \\  & (a) & IoT device attempts L2 TP authentication with CN using the established PQC-TLS session. \\  & (b) & if L2 TP authentication succeeds then \\  & \(\bullet\) & Proceed with 802.1X Authentication Preparation in Step\#1. \\  & i. & CN prepares IoT device’s account information, MAC address, and pre-master secret. \\  & ii. & CN transmits the prepared information to the 802.1X authentication server. \\  & (c) & \\  & \(\bullet\) & Terminate PQC-TLS communication and abort the process. \\
3. & EAP-PSK-based 802.1X Authentication in Step\#3 \\  & (a) & IoT device initiates 802.1X authentication with CN, using EAP-PSK protocol. \\  & (b) & PSK is derived from the previously exchanged pre-master secret: \\  & & \\ \hline \hline \end{tabular}
\end{table}
Table 2: The process of applying the pre-master secret used in PQC-TLS to EAP-PSK.  
Since the client, corresponding to the IoT device, is responsible for PQC key pair generation and the decryption of the ciphertext, we measured the time taken for these processes. Our implementation refers to the Python version of NTRUs by pointed sphere [14; 29].