Q-Shield · PQC benchmarks
Post-quantum cryptography, measured.
Independent performance benchmarks for the NIST-standardized PQC algorithms — ML-KEM, ML-DSA, and SLH-DSA. Re-run daily on auditable infrastructure. Every data point links back to the GitHub commit that produced it.
Latest run2026-07-07 09:32 UTC
commitbfd529d- CPU
- Xeon Platinum 8259CL @ 2.50GHz
- Instance
- t3.mediumburstable
- OS / Kernel
- 24.04.4 LTS
- liboqs
- 0.15.0
- Wall clock
- 49m 51s
- CPU steal
- 0.83%
Quick comparisons
The takeaways from this week's data
Open compare view
fasterslower
The signature speed gap
Lattice vs hash, side by side.
ML-DSA-65· sign284.6 µs
SLH-DSA-SHAKE-128s· sign1.301 s
Sign throughput ratio4.6k×
Security level tradeoff
More bits, more time.
ML-KEM-768· decap22.4 µs
ML-KEM-1024· decap31.8 µs
Decap mean ratio1.42×
Fast vs Small
Sign or store, pick one.
SLH-DSA-SHAKE-128f· sign62.37 ms
SLH-DSA-SHAKE-128s· sign1.301 s
Sign speed-up20.9×
Across the ML-DSA range
Levels 2, 3, and 5.
ML-DSA-44· sign143.2 µs
ML-DSA-87· sign180.8 µs
Sign mean ratio1.26×
Key Encapsulation (KEM)
ML-KEM — FIPS 203. Replaces RSA/ECC key exchange.
3 algorithms
| Algorithm | Op | Mean | p95 | p99 | Ops/sec | Pub key | Ciphertext |
|---|---|---|---|---|---|---|---|
| ML-KEM-512ML-KEM-512 | keygen | 23.1 µs | 25.1 µs | 42.7 µs | 43,325 | 800 B | 768 B |
| ″ML-KEM-512 | encap | 23.7 µs | 29.0 µs | 48.6 µs | 42,193 | ||
| ″ML-KEM-512 | decap | 15.7 µs | 15.8 µs | 26.3 µs | 63,674 | ||
| ML-KEM-768ML-KEM-768 | keygen | 18.7 µs | 19.0 µs | 27.5 µs | 53,500 | 1.16 KB | 1.06 KB |
| ″ML-KEM-768 | encap | 22.1 µs | 33.3 µs | 44.3 µs | 45,205 | ||
| ″ML-KEM-768 | decap | 22.4 µs | 30.0 µs | 41.4 µs | 44,577 | ||
| ML-KEM-1024ML-KEM-1024 | keygen | 24.4 µs | 33.9 µs | 41.9 µs | 40,993 | 1.53 KB | 1.53 KB |
| ″ML-KEM-1024 | encap | 26.9 µs | 35.4 µs | 45.7 µs | 37,153 | ||
| ″ML-KEM-1024 | decap | 31.8 µs | 47.5 µs | 90.5 µs | 31,431 |
Digital Signatures
ML-DSA (FIPS 204, lattice-based) and SLH-DSA (FIPS 205, hash-based).
5 algorithms
| Algorithm | Op | Mean | p95 | p99 | Ops/sec | Pub key | Signature |
|---|---|---|---|---|---|---|---|
| ML-DSA-44ML-DSA-44 | keygen | 55.8 µs | 71.2 µs | 85.5 µs | 17,929 | 1.28 KB | 2.36 KB |
| ″ML-DSA-44 | sign | 143.2 µs | 312.8 µs | 497.8 µs | 6,981 | ||
| ″ML-DSA-44 | verify | 33.4 µs | 40.3 µs | 47.7 µs | 29,897 | ||
| ML-DSA-65ML-DSA-65 | keygen | 88.0 µs | 107.0 µs | 123.8 µs | 11,362 | 1.91 KB | 3.23 KB |
| ″ML-DSA-65 | sign | 284.6 µs | 597.6 µs | 937.2 µs | 3,513 | ||
| ″ML-DSA-65 | verify | 61.6 µs | 97.5 µs | 149.7 µs | 16,233 | ||
| ML-DSA-87ML-DSA-87 | keygen | 80.1 µs | 98.7 µs | 181.6 µs | 12,484 | 2.53 KB | 4.52 KB |
| ″ML-DSA-87 | sign | 180.8 µs | 367.3 µs | 509.0 µs | 5,532 | ||
| ″ML-DSA-87 | verify | 74.6 µs | 82.0 µs | 125.1 µs | 13,410 | ||
| SLH-DSA-SHAKE-128sSLH-DSA-SHAKE-128s | keygen | 170.19 ms | 176.57 ms | 189.51 ms | 5.9 | 32 B | 7.67 KB |
| ″SLH-DSA-SHAKE-128s | sign | 1.301 s | 1.338 s | 1.399 s | 0.77 | ||
| ″SLH-DSA-SHAKE-128s | verify | 1.32 ms | 1.48 ms | 2.01 ms | 757 | ||
| SLH-DSA-SHAKE-128fSLH-DSA-SHAKE-128f | keygen | 2.65 ms | 2.76 ms | 3.15 ms | 378 | 32 B | 16.69 KB |
| ″SLH-DSA-SHAKE-128f | sign | 62.37 ms | 66.88 ms | 70.92 ms | 16.0 | ||
| ″SLH-DSA-SHAKE-128f | verify | 3.72 ms | 3.94 ms | 5.08 ms | 269 |