Systems and methods for measuring one or more metrics of a cryptographic algorithm in a post-quantum cryptography system
Systems, apparatuses, and methods are disclosed for measuring one or more metrics of a cryptographic algorithm in a post-quantum cryptography (PQC) system. An example method includes obtaining a set of operating parameters comprising an algorithm of interest, wherein the algorithm of interest is a PQC algorithm, a legacy algorithm operating in a hybrid PQC system, or a variant thereof, and wherein the algorithm of interest is wrapped to present, via a wrapped algorithm of interest, a standardized interface to a sequence of benchmark operations. The example method further includes observing benchmark values of the one or more metrics, wherein the one or more metrics pertain to a designated benchmark operation from the sequence of benchmark operations. The example method further includes outputting a report comprising the benchmark values of the one or more metrics.
1. A method for measuring one or more metrics of a cryptographic algorithm in a post-quantum cryptography (PQC) system, the method comprising:
obtaining, via communications hardware, a set of operating parameters comprising an algorithm of interest, wherein the algorithm of interest is a PQC algorithm or a legacy cryptographic algorithm operating in a hybrid PQC system, and wherein the algorithm of interest is wrapped to present, via a wrapped algorithm of interest, a standardized interface to a sequence of benchmark operations;
observing, via a benchmarking circuitry interfaced to an isolated private network, benchmark values of the one or more metrics for a designated benchmark operation from an execution of the sequence of benchmark operations, wherein the designated benchmark operation is performed in the isolated private network, wherein the one or more metrics comprise:
a first duration of time taken to execute the designated benchmark operation,
a second duration of time taken to execute a subprocess of the designated benchmark operation,
volatile storage usage due to the execution of the designated benchmark operation,
non-volatile storage usage due to the execution of the designated benchmark operation,
processor usage due to the execution of the designated benchmark operation, or
a quantity derived from one or more of the above metrics; and
outputting, via the communications hardware, a report comprising the benchmark values of the one or more metrics.
2. The method of claim 1 , wherein the set of operating parameters further comprises:
the sequence of benchmark operations;
a payload descriptor specifying a payload of data being secured; and
a network address specifying a local or remote port where the payload is sent or received;
wherein the execution of the sequence of benchmark operations utilizes the payload specified by the payload descriptor, and wherein transfer of the payload is directed to or from the network address.
3. The method of claim 1 , wherein the sequence of benchmark operations comprises:
generating a cryptographic key pair;
encrypting a first message;
decrypting a second message;
signing a third message;
verifying a signed fourth message;
transferring a cryptographic payload; or
performing a composite operation integrating one or more of the above.
4. The method of claim 1 , wherein the sequence of benchmark operations comprises operations for implementing a key establishment scheme.
5. The method of claim 1 , wherein the set of operating parameters comprises a list of algorithms of interest, and wherein the sequence of benchmark operations specifies a designated algorithm of interest from the list of algorithms of interest executing each benchmark operation from the sequence of benchmark operations.
6. The method of claim 1 , further comprising:
causing the execution, via a driver circuitry, of the sequence of benchmark operations using the wrapped algorithm of interest.
7. The method of claim 6 , further comprising:
obtaining, via the communications hardware, additional sets of operating parameters comprising additional algorithms of interest wrapped to present, via additional wrapped algorithms of interest, standardized interfaces to the sequence of benchmark operations;
causing the execution, via the driver circuitry, of the sequence of benchmark operations using the additional wrapped algorithms of interest;
observing, via the benchmarking circuitry, additional benchmark values of the one or more metrics for the designated benchmark operation from execution of the sequence of benchmark operations using the additional wrapped algorithms of interest; and
outputting, via the communications hardware, a summary of reports of the benchmark values and the additional benchmark values, wherein the summary comprises an evaluation and a comparison of the benchmark values and the additional benchmark values.
8. The method of claim 6 , wherein:
the driver circuitry causes execution of the sequence of benchmark operations on a separate host device; and
the benchmarking circuitry observes the benchmark values by receiving the benchmark values from the separate host device.
9. The method of claim 6 , wherein causing execution of the sequence of benchmark operations comprises:
accessing, via the driver circuitry, the standardized interface of the wrapped algorithm of interest; and
causing execution, via cryptographic algorithm circuitry, of functions of the algorithm of interest as directed by the standardized interface.
10. The method of claim 1 , further comprising:
computing, via the benchmarking circuitry, one or more benchmark scores, wherein the one or more benchmark scores are derived from the one or more metrics and reflect overall performance of the algorithm of interest in a system.
11. The method of claim 1 , further comprising:
selecting, via the benchmarking circuitry, the cryptographic algorithm for deployment in the PQC system based on the benchmark values reported.
12. An apparatus for measuring one or more metrics of a cryptographic algorithm in a post-quantum cryptography (PQC) system, the apparatus comprising:
communications hardware configured to:
obtain a set of operating parameters comprising an algorithm of interest, wherein the algorithm of interest is a PQC algorithm or a legacy cryptographic algorithm operating in a hybrid PQC system, and wherein the algorithm of interest is wrapped to present, via a wrapped algorithm of interest, a standardized interface to a sequence of benchmark operations; and
a benchmarking circuitry, interfaced to an isolated private network and configured to:
observe benchmark values of the one or more metrics for a designated benchmark operation from an execution of the sequence of benchmark operations, wherein the designated benchmark operation is performed in the isolated private network, and wherein the one or more metrics comprise:
a first duration of time taken to execute the designated benchmark operation,
a second duration of time taken to execute a subprocess of the designated benchmark operation,
volatile storage usage due to the execution of the designated benchmark operation,
non-volatile storage usage due to the execution of the designated benchmark operation,
processor usage due to the execution of the designated benchmark operation, or
a quantity derived from one or more of the above metrics; and
wherein the communications hardware is further configured to:
output a report comprising the benchmark values of the one or more metrics.
13. The apparatus of claim 12 , wherein the set of operating parameters further comprises:
the sequence of benchmark operations;
a payload descriptor specifying a payload of data being secured; and
a network address specifying a local or remote port where the payload is sent or received;
wherein execution of the sequence of benchmark operations utilizes the payload specified by the payload descriptor, and wherein transfer of the payload is directed to or from the network address.
14. The apparatus of claim 12 , wherein the sequence of benchmark operations comprises:
generating a cryptographic key pair;
encrypting a first message;
decrypting a second message;
signing a third message;
verifying a signed fourth message;
transferring a cryptographic payload; or
performing a composite operation integrating one or more of the above.
15. The apparatus of claim 12 , wherein the set of operating parameters comprises a list of algorithms of interest, and wherein the sequence of benchmark operations specifies a designated algorithm of interest from the list of algorithms of interest executing each benchmark operation from the sequence of benchmark operations.
16. The apparatus of claim 12 , further comprising:
a driver circuitry configured to:
cause execution of the sequence of benchmark operations using the wrapped algorithm of interest.
17. The apparatus of claim 16 ,
wherein the communications hardware is further configured to:
obtain additional sets of operating parameters comprising additional algorithms of interest wrapped to present, via additional wrapped algorithms of interest, standardized interfaces to the sequence of benchmark operations;
wherein the driver circuitry is further configured to:
cause execution of the sequence of benchmark operations using the additional wrapped algorithms of interest;
wherein the benchmarking circuitry is further configured to:
observe additional benchmark values of the one or more metrics for the designated benchmark operation from execution of the sequence of benchmark operations using the additional wrapped algorithms of interest; and
wherein the communications hardware is further configured to:
output a summary of reports of the benchmark values and the additional benchmark values, wherein the summary comprises an evaluation and a comparison of the benchmark values and the additional benchmark values.
18. The apparatus of claim 16 , wherein:
the driver circuitry is configured to cause execution of the sequence of benchmark operations on a separate host device; and
the benchmarking circuitry is configured to observes the benchmark values by receiving the benchmark values from the separate host device.
19. The apparatus of claim 16 ,
wherein the driver circuitry is configured to cause execution of the sequence of benchmark operations by accessing the standardized interface of the wrapped algorithm of interest; and
wherein the apparatus further comprises cryptographic algorithm circuitry configured to execute functions of the algorithm of interest as directed by the standardized interface.
20. The apparatus of claim 12 , wherein the benchmarking circuitry is further configured to:
compute one or more benchmark scores, wherein the one or more benchmark scores are derived from the one or more metrics and reflect overall performance of the algorithm of interest in a system.