Compare FIPS 203/204 key, ciphertext and signature sizes against X25519 and Ed25519, and size the bandwidth impact.
Lattice schemes replace a 32-byte X25519 key with roughly 1.2 kB and a 64-byte signature with 3.3 kB, because their security rests on structured lattices rather than a compact group element. SLH-DSA inverts the trade: a 32-byte public key but a 7,856-byte signature. ML-KEM-768 pushes a TLS ClientHello past a single packet, which changes how handshakes interact with MTU and initial congestion windows — the main practical obstacle to post-quantum rollout is size, not speed.
Post-Quantum Key Size
wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid.
wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid. Lattice schemes replace a 32-byte X25519 key with roughly 1.2 kB and a 64-byte signature with 3.3 kB, because their security rests on structured lattices rather than a compact group element. SLH-DSA inverts the trade: a 32-byte public key but a 7,856-byte signature.
ML-KEM-768 pushes a TLS ClientHello past a single packet, which changes how handshakes interact with MTU and initial congestion windows — the main practical obstacle to post-quantum rollout is size, not speed.
This calculator takes 3 inputs: Post-quantum algorithm, Handshakes or signatures per day, Send a classical key alongside (hybrid). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Lattice assumptions are young. A hybrid secret derived from both X25519 and ML-KEM stays secure if either component holds, so a break in the new scheme does not immediately undo your traffic protection.
ML-KEM-768 and ML-DSA-65 are the mainstream choices — NIST Category 3, roughly AES-192-equivalent, and what browser and library deployments have standardised on. Go to Category 5 only where a 256-bit target is mandated.