Post-Quantum Key Size Calculator
Compare FIPS 203/204 key, ciphertext and signature sizes against X25519 and Ed25519, and size the bandwidth impact.
About Post-Quantum Key Size Calculator
Lattice schemes replace a 32-byte X25519 key with roughly 1.2 kB and a 64-byte signature with 3.3 kB, because their security rests on structured lattices rather than a compact group element. SLH-DSA inverts the trade: a 32-byte public key but a 7,856-byte signature. ML-KEM-768 pushes a TLS ClientHello past a single packet, which changes how handshakes interact with MTU and initial congestion windows — the main practical obstacle to post-quantum rollout is size, not speed.
Formula
Post-Quantum Key Size
wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid.
- ML-KEM-768
- 1,184-byte public key and 1,088-byte ciphertext
- ML-DSA-65
- 1,952-byte public key and 3,309-byte signature
- hybrid
- Classical and post-quantum secrets concatenated, safe if either holds
Worked example
With the default values below, Post-Quantum Key Size Calculator returns Public Key Size of 1,184. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Post-quantum algorithmone of ML-KEM-512 (FIPS 203, level 1), ML-KEM-768 (FIPS 203, level 3), ML-KEM-1024 (FIPS 203, level 5), ML-DSA-44 (FIPS 204, level 2), ML-DSA-65 (FIPS 204, level 3), ML-DSA-87 (FIPS 204, level 5), SLH-DSA-SHA2-128s (FIPS 205)
- ML-KEM-768 (FIPS 203, level 3)
- Handshakes or signatures per dayminimum 1 ops/day
- 50,000,000 ops/day
- Send a classical key alongside (hybrid)
- Yes
Results
- Public Key Size
- 1,184 bytes
- Private Key Size
- 2,400 bytes
- Ciphertext or Signature Size
- 1,088 bytes
- Bytes on the Wire per Operation
- 2,336 bytes
- Growth vs the Classical Equivalent
- 35.5 ×
- Daily Bandwidth
- 108.78 GiB
- NIST Security Category
- Category 3 (≈AES-192)
Step by step
- 1Values used
- 2Post-Quantum Key Size
- 3Public Key Size= 1,184 bytes
- 4Private Key Size= 2,400 bytes
- 5Ciphertext or Signature Size= 1,088 bytes
- 6Bytes on the Wire per Operation= 2,336 bytes
- 7Growth vs the Classical Equivalent= 35.5 ×
- 8Daily Bandwidth= 108.78 GiB
Assumptions and limits
- The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Post-Quantum Key Size calculated?
wire cost = public key + ciphertext or signature, plus 32 B (X25519) or 64 B (Ed25519) when running hybrid. Lattice schemes replace a 32-byte X25519 key with roughly 1.2 kB and a 64-byte signature with 3.3 kB, because their security rests on structured lattices rather than a compact group element. SLH-DSA inverts the trade: a 32-byte public key but a 7,856-byte signature.
Why does Post-Quantum Key Size matter?
ML-KEM-768 pushes a TLS ClientHello past a single packet, which changes how handshakes interact with MTU and initial congestion windows — the main practical obstacle to post-quantum rollout is size, not speed.
What values do I need to enter?
This calculator takes 3 inputs: Post-quantum algorithm, Handshakes or signatures per day, Send a classical key alongside (hybrid). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why run hybrid rather than pure post-quantum?
Lattice assumptions are young. A hybrid secret derived from both X25519 and ML-KEM stays secure if either component holds, so a break in the new scheme does not immediately undo your traffic protection.
Which parameter set should I pick?
ML-KEM-768 and ML-DSA-65 are the mainstream choices — NIST Category 3, roughly AES-192-equivalent, and what browser and library deployments have standardised on. Go to Category 5 only where a 256-bit target is mandated.