Skip to content
Calcrivo

Post-Quantum Key Size Calculator

Compare FIPS 203/204 key, ciphertext and signature sizes against X25519 and Ed25519, and size the bandwidth impact.

Inputs

ops/day

Hybrid adds 32 B for X25519 or 64 B for Ed25519.

Public Key Size

1,184bytes

Private Key Size

2,400bytes

Ciphertext or Signature Size

1,088bytes

Bytes on the Wire per Operation

2,336bytes

Growth vs the Classical Equivalent

35.5×

Daily Bandwidth

108.78GiB

NIST Security Category

Category 3 (≈AES-192)

Step by step

  1. Values used

    Post-quantum algorithm = ML-KEM-768 (FIPS 203, level 3); Handshakes or signatures per day = 50,000,000 ops/day; Send a classical key alongside (hybrid) = Yes

  2. Post-Quantum Key Size

    wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid.

  3. Public Key Size

    = 1,184 bytes

  4. Private Key Size

    = 2,400 bytes

  5. Ciphertext or Signature Size

    = 1,088 bytes

  6. Bytes on the Wire per Operation

    = 2,336 bytes

  7. Growth vs the Classical Equivalent

    = 35.5 ×

  8. Daily Bandwidth

    = 108.78 GiB

How it works

Lattice schemes replace a 32-byte X25519 key with roughly 1.2 kB and a 64-byte signature with 3.3 kB, because their security rests on structured lattices rather than a compact group element. SLH-DSA inverts the trade: a 32-byte public key but a 7,856-byte signature. ML-KEM-768 pushes a TLS ClientHello past a single packet, which changes how handshakes interact with MTU and initial congestion windows — the main practical obstacle to post-quantum rollout is size, not speed.

Formula

Post-Quantum Key Size

wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid.

ML-KEM-768
1,184-byte public key and 1,088-byte ciphertext
ML-DSA-65
1,952-byte public key and 3,309-byte signature
hybrid
Classical and post-quantum secrets concatenated, safe if either holds

Frequently Asked Questions

How is Post-Quantum Key Size calculated?

wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid. Lattice schemes replace a 32-byte X25519 key with roughly 1.2 kB and a 64-byte signature with 3.3 kB, because their security rests on structured lattices rather than a compact group element. SLH-DSA inverts the trade: a 32-byte public key but a 7,856-byte signature.

Why does Post-Quantum Key Size matter?

ML-KEM-768 pushes a TLS ClientHello past a single packet, which changes how handshakes interact with MTU and initial congestion windows — the main practical obstacle to post-quantum rollout is size, not speed.

What values do I need to enter?

This calculator takes 3 inputs: Post-quantum algorithm, Handshakes or signatures per day, Send a classical key alongside (hybrid). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why run hybrid rather than pure post-quantum?

Lattice assumptions are young. A hybrid secret derived from both X25519 and ML-KEM stays secure if either component holds, so a break in the new scheme does not immediately undo your traffic protection.

Which parameter set should I pick?

ML-KEM-768 and ML-DSA-65 are the mainstream choices — NIST Category 3, roughly AES-192-equivalent, and what browser and library deployments have standardised on. Go to Category 5 only where a 256-bit target is mandated.

You might also need