Post-Quantum Key Size Calculator
Compare FIPS 203/204 key, ciphertext and signature sizes against X25519 and Ed25519, and size the bandwidth impact.
Inputs
Hybrid adds 32 B for X25519 or 64 B for Ed25519.
Public Key Size
1,184bytes
Private Key Size
2,400bytes
Ciphertext or Signature Size
1,088bytes
Bytes on the Wire per Operation
2,336bytes
Growth vs the Classical Equivalent
35.5×
Daily Bandwidth
108.78GiB
NIST Security Category
Category 3 (≈AES-192)
Step by step
Values used
Post-quantum algorithm = ML-KEM-768 (FIPS 203, level 3); Handshakes or signatures per day = 50,000,000 ops/day; Send a classical key alongside (hybrid) = Yes
Post-Quantum Key Size
wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid.
Public Key Size
= 1,184 bytes
Private Key Size
= 2,400 bytes
Ciphertext or Signature Size
= 1,088 bytes
Bytes on the Wire per Operation
= 2,336 bytes
Growth vs the Classical Equivalent
= 35.5 ×
Daily Bandwidth
= 108.78 GiB
How it works
Lattice schemes replace a 32-byte X25519 key with roughly 1.2 kB and a 64-byte signature with 3.3 kB, because their security rests on structured lattices rather than a compact group element. SLH-DSA inverts the trade: a 32-byte public key but a 7,856-byte signature. ML-KEM-768 pushes a TLS ClientHello past a single packet, which changes how handshakes interact with MTU and initial congestion windows — the main practical obstacle to post-quantum rollout is size, not speed.
Formula
Post-Quantum Key Size
wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid.
- ML-KEM-768
- 1,184-byte public key and 1,088-byte ciphertext
- ML-DSA-65
- 1,952-byte public key and 3,309-byte signature
- hybrid
- Classical and post-quantum secrets concatenated, safe if either holds
Frequently Asked Questions
How is Post-Quantum Key Size calculated?
wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid. Lattice schemes replace a 32-byte X25519 key with roughly 1.2 kB and a 64-byte signature with 3.3 kB, because their security rests on structured lattices rather than a compact group element. SLH-DSA inverts the trade: a 32-byte public key but a 7,856-byte signature.
Why does Post-Quantum Key Size matter?
ML-KEM-768 pushes a TLS ClientHello past a single packet, which changes how handshakes interact with MTU and initial congestion windows — the main practical obstacle to post-quantum rollout is size, not speed.
What values do I need to enter?
This calculator takes 3 inputs: Post-quantum algorithm, Handshakes or signatures per day, Send a classical key alongside (hybrid). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why run hybrid rather than pure post-quantum?
Lattice assumptions are young. A hybrid secret derived from both X25519 and ML-KEM stays secure if either component holds, so a break in the new scheme does not immediately undo your traffic protection.
Which parameter set should I pick?
ML-KEM-768 and ML-DSA-65 are the mainstream choices — NIST Category 3, roughly AES-192-equivalent, and what browser and library deployments have standardised on. Go to Category 5 only where a 256-bit target is mandated.