Facing the growing threat posed by quantum computers, post-quantum cryptography (PQC) is becoming essential for the security of Artificial Intelligence (AI) systems deployed in High-Performance Computing (HPC) environments. This article presents an in-depth performance analysis of the Kyber algorithm, a leading standard for post-quantum key exchange, crucial for safeguarding AI data and models. We investigate both the reference C implementation and the optimized AVX2 version, for multiple security levels (Kyber-512, Kyber-768, and Kyber-1024). Benchmarks focus on latency, bandwidth consumption, memory footprint, and CPU cost under realistic HPC conditions. Our results highlight the trade-ofs between security and computational performance, and provide recommendations for eficient and secure integration of Kyber into HPC applications, essential for the resilience of AI systems in the quantum era.
In summary, this article proposes: • a detailed characterization of Kyber’s performance profile (reference C implementation vs. optimized AVX2 version); • an analysis of security/performance trade-ofs based on NIST levels; • and concrete recommendations for optimized implementation, suitable for direct integration into modern HPC environments.
To provide a comprehensive evaluation of Kyber’s performance, the benchmarks are structured around several axes: analysis of the speed of primary cryptographic operations, network latency, bandwidth consumption, and resource utilization (CPU/memory). Each test follows measurement protocols adapted to HPC environments to ensure the relevance and reliability of the results.
Performance tests were conducted on a physical machine with the following characteristics: • Architecture: x86_64 (64-bit) • Processor: Intel(R) Core(TM) i5-6300U CPU @ 2.40GHz • Cores and Threads: 2 physical cores, 4 threads (2 threads per core) • Frequency: 2.40 GHz (base), up to 3.00 GHz (turbo) • Caches: – L1d: 64 KiB (2 instances) – L1i: 64 KiB (2 instances) – L2: 512 KiB (2 instances) – L3: 3 MiB (1 instance, shared) • Memory: 8 GB DDR4 • Operating System: Ubuntu 22.04 LTS (64-bit) • Compiler: GCC 11.4.0
Benchmarks were conducted using two variants of Kyber’s oficial C implementation, covering Kyber512, Kyber-768, and Kyber-1024 versions: • Reference Kyber Version: Oficial NIST implementation (Round 3 or FIPS 203 draft) • Optimized AVX2 Version: Optimized implementation leveraging AVX2 instructions to improve performance on compatible architectures • Compilation Options: -O3 -march=native • Complementary Libraries: MPICH for network tests, Python 3.x for vector analysis
The performance of cryptographic operations is measured by processor cycle counting, using architecture-specific high-resolution timers (RDTSC on x86, or clock_gettime with CLOCK_MONOTONIC for portability). Each operation is executed between 10,000 and 100,000 times to ensure statistical robustness. The median number of cycles is retained to limit the impact of system noise.
The tested operations include: Aspect Key Generation Encapsulation Decapsulation Secret Consistency Invalid Ciphertext Rejection Determinism ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Result 0 error 0 error 0 error 100% OK Yes • High-level KEM operations: key generation (crypto_kem_keypair), encapsulation (crypto_kem_encapsulate), decapsulation (crypto_kem_decapsulate) • Low-level polynomial operations: Number Theoretic Transform (NTT), Inverse NTT, polynomial multiplication, matrix generation, noise generation • Internal CPA-secure operations: CPA key generation, CPA encryption, CPA decryption
The validation of test vectors was performed to ensure implementation conformity and the cryptographic quality of the outputs. Vectors are generated via a deterministic PRNG based on SHAKE128, in accordance with the Kyber specification, ensuring result reproducibility.
Tests are automated by script, executing the test binaries for each Kyber parameter.
A comprehensive validation of the test vectors was carried out to ensure the implementation’s compliance and to analyze its cryptographic properties. The test vectors were generated using a deterministic PRNG based on SHAKE128, which ensures the reproducibility of results across diferent platforms.
Component Kyber-512
The measured sizes of keys and ciphertexts from the test vectors confirm the theoretical specifications for each Kyber parameterization, as detailed in Table 3.
A statistical analysis of the hexadecimal character distribution in the generated keys, ciphertexts, and shared secrets was performed to evaluate the quality of the randomness. The analysis, conducted by parameter size, shows: • Uniform Distribution: The coeficients are well distributed across the 16 hexadecimal characters (0-F), indicating a robust PRNG. • High Entropy: Entropy values consistently approach the theoretical maximum (4.0 bits per hexadecimal character), a sign of excellent randomness. • Absence of Bias: No statistical bias or recurring patterns were detected, which is crucial for cryptographic security. • Consistency Across Parameters: The quality of randomness is uniformly maintained for
Kyber-512, Kyber-768, and Kyber-1024. • Eficiency: The analysis confirms an eficiency exceeding 97% compared to the theoretical maximum entropy.
The detailed analysis by component is illustrated in Figures 1 to 4, presenting the entropy for each data type and parameterization.
The in-depth analysis of the test vectors conclusively demonstrates: • Perfect Implementation Compliance: No errors were detected during end-to-end tests across all parameters. • Excellent Randomness Quality: All generated data (keys, ciphertexts, shared secrets) exhibit the expected entropy properties, which are essential for security. • Standard Compliance: The reference Kyber implementation fully adheres to NIST PQC specifications for cryptographic outputs. • Deterministic Reproducibility: Identical seeds consistently produce the same outputs, regardless of the execution environment. • High Entropic Eficiency: All parameters achieve over 97% of the theoretical maximum hexadecimal character entropy, validating the quality of the internal PRNG. • Scalability of Quality: Cryptographic quality remains constant, with no loss of randomness, even as key and ciphertext sizes increase.
This section delves into a thorough analysis of the CRYSTALS-Kyber algorithm’s performance, measured in clock cycles. We’ll begin by examining the high-level Key Encapsulation Mechanism (KEM) operations for each Kyber parameterization (Kyber-512, Kyber-768, Kyber-1024), highlighting how increased security impacts computational cost.
Next, we’ll explore the security-performance trade-of by correlating NIST security levels with observed cycle costs. A detailed analysis of low-level operations, including scaling behavior and the performance of fundamental polynomial operations, will be presented to identify potential bottlenecks.
Finally, we’ll compare the performance of Kyber’s reference implementation with an AVX2-optimized version, quantifying the eficiency gains achieved through vectorization. Our goal is to provide a comprehensive understanding of Kyber’s performance characteristics across diferent levels of abstraction and optimization.
The exact median cycle counts for these high-level KEM operations are presented in Table 4, ofering precise numerical details that complement the visual trends.
Kyber’s fundamental polynomial operations exhibit varying scaling behaviors. Some, like NTT, are more eficient with larger parameters, suggesting optimization or cache efects, as illustrated in Figure 8.
The median cycle counts for these core polynomial operations across diferent Kyber parameterizations are detailed in Table 6.
Figure 10 presents the contribution of each operation category (polynomial arithmetic, sampling, compression, etc.) to the total cost, highlighting the dominant areas.
This section presents a comparative analysis of Kyber’s performance between the reference implementation and the version optimized with AVX2 instructions. Measurements are expressed in processor cycles, and performance gains are quantified as a percentage.
Low-level operations, such as NTT, polynomial multiplication, and compression/decompression functions, are particularly sensitive to vectorial optimizations. Table 9 details the gains observed for these
AVX2 117 100 2 338 2 340 9 580 10 088 11 836 2 134 784 598 112 5 540 4 310 77.28 % -48.50 % -46.32 % 96.53 % 96.71 % 96.16 % 98.22 % 93.88 % 91.64 % 67.86 % 92.99 % 95.92 %
AVX2 26 606 3 472 3 424 332 332 454 38 48 50 36 388 176 In summary, the integration of AVX2 optimizations yields considerable performance gains, particularly pronounced in fundamental polynomial operations (NTT, multiplication) and compression/decompression functions. These accelerations result in a drastic reduction in cycle cost for high-level KEM operations, making Kyber significantly more eficient for HPC applications. The gains are even more substantial as the security level increases, highlighting the relevance of these optimizations for large-scale deployments.
This section presents the communication latencies measured during Kyber key establishment operations in an MPI environment. These results quantify the actual impact of PQC on inter-process communication overhead, a crucial challenge for HPC applications. All measurements were conducted over 1000 iterations, with 10 warm-up rounds to stabilize the system.
The results show that increasing the Kyber security level primarily increases the latency of computational phases (key generation, encapsulation, decapsulation). Public key transfer remains negligible (<1 s), while ciphertext transfer becomes a significant factor, sometimes as important as the cryptographic operations themselves, especially for Kyber-768 and Kyber-1024. This highlights that, in MPI communications using Kyber, cryptographic processing and ciphertext transmission are the main contributors to total latency. The maximum RTT values (from 3.1 to 4.0 ms) reflect the influence of the system (scheduling, memory management) on extreme cases, particularly for Kyber-1024.
This section analyzes the impact of Kyber key and ciphertext sizes on bandwidth consumption within the MPI environment. Bandwidth measurements were conducted in parallel with latency benchmarks, providing a comprehensive view of efective throughput during KEM operations.
Efective throughput was measured from the perspective of both MPI ranks to account for potential network asymmetries and provide a comprehensive view of communication performance.
The bandwidth analysis reveals several key points: • Stable Throughput: Despite a significant increase in data volume (from 1.57 MB to 3.14 MB total), the efective throughput remains remarkably stable around 4.8–5.0 MB/s for all parameterizations. • Network Symmetry: The minimal diference between Rank 0 and Rank 1 perspectives (<0.1 • Scalable Eficiency: Eficiency (MB/s per KB of data) shows that higher parameterizations maintain proportional performance, demonstrating the good scalability of the communication infrastructure. • Practical Implications: The stability of the throughput suggests that the network infrastructure can absorb the increased volume associated with higher security levels without proportional degradation of throughput. 7. Network Latency Results (MPI) - Reference vs. AVX2 Comparison This section presents a comparison of communication latencies measured during Kyber key establishment operations in an MPI environment, highlighting the gains provided by AVX2 optimizations. All measurements were conducted over 1000 iterations, with 10 warm-up rounds.
AVX2
AVX2 optimizations have had a transformative impact on the latencies of Kyber operations. As shown in Tables 14 and 15, purely computational phases such as "key generation, encapsulation, and decapsulation saw their average latency dramatically reduced (between 73% and 83
Interestingly, "public key and ciphertext transfer times also showed notable reductions" (between 17% and 76%). While these operations are primarily network bandwidth-related, the reduction in intensive cryptographic processing time potentially frees up CPU resources faster, allowing for more eficient management of communication operations by MPI ranks. This could explain these unexpected gains in transfer phases, suggesting that even "network" operations were previously slightly CPU-bound.
It is important to note the behavior of maximum RTT values. For Kyber-512 and Kyber-1024, the maximum RTT was reduced, but for Kyber-768, it slightly increased (-49.7% gain actually means an increase of nearly 50%). This may indicate higher variability in certain executions or the influence of
AVX2 other system factors (scheduling, resource contention) that can have a more pronounced impact on extreme values, even with faster cryptographic operations. This warrants further investigation if these peaks are reproducible.
These results confirm that AVX2 optimizations are not only efective in terms of CPU cycles but also directly translate into tangible performance gains in a distributed communication context.
This section analyzes the impact of AVX2 optimizations on efective throughput within the MPI environment.
The bandwidth analysis, presented in Table 17, reveals a very substantial gain with the AVX2 implementation. Contrary to an initial expectation where bandwidth would be predominantly network-limited, AVX2 optimizations have significantly increased efective throughput: * For Kyber-512, bandwidth increased from approximately 4.68 MB/s to 21.80 MB/s, an increase of about 366%. * For Kyber-768, it increased from 5.00 MB/s to 18.36 MB/s, an increase of about 267%. * For Kyber-1024, it increased from 4.99 MB/s to 23.77 MB/s, an increase of about 376%.
These considerable gains indicate that, in the reference version, the bottleneck was not solely the network, but a combination of CPU-intensive operations and communication. The significant reduction in computation time due to AVX2 optimizations allowed the system to process cryptographic operations much faster, thereby freeing up the communication pipeline and enabling much higher throughputs that were likely limited by the speed of the cryptographic computations themselves in the reference version.
The throughput symmetry between Rank 0 and Rank 1 is maintained, which is a good indication of the robustness of the test environment and the implementation. These results demonstrate that AVX2 optimizations are essential for fully leveraging network capabilities in applications where post-quantum cryptographic operations are integrated into communications.
To identify the main computational bottlenecks in Kyber, a detailed CPU profiling was conducted using the Linux tool perf. This analysis highlights the most CPU-intensive functions and guides optimization eforts for HPC environments. 3.08 4.49 6.04
Profiling was performed with perf record on the speed benchmarks (test_speed512, test_speed768, test_speed1024) for each Kyber parameterization. Measurements focused on CPU cycles, with call trace recording for fine-grained function analysis.
The results show a strong concentration of CPU usage on a small number of main functions, consistently across all parameterizations. Table 18 summarizes the most resource-consuming functions. 9.3. Learnings and Recommendations • Keccak (SHAKE128/256) is the primary bottleneck (21–27% of CPU time), used for deterministic key generation, encapsulation, and internal hashing functions. • Montgomery and Barrett reduction together account for nearly 28% of CPU time, essential for modular arithmetic in polynomial operations. • NTT and invNTT (forward and inverse number theoretic transform) total 15–20% of CPU time, with a relative cost that decreases for larger parameterizations due to better cache utilization. • Priority Optimization: Accelerating Keccak (via vectorization, hardware SHA-3 instructions, or GPU ofload) and modular arithmetic (SIMD, assembly) would yield the most significant gain. • Algorithmic Stability: The cost distribution remains stable regardless of the security level, which facilitates large-scale optimization.
10. Performance Summary and Recommendations This section provides a synthesis of the experimental results and highlights key trends for deploying Kyber in HPC environments. 10.1. Overall Performance Summary The measurements performed show: • Latency (Average RTT, 1000 iterations): – Kyber-512: 319 s – Kyber-768: 434 s – Kyber-1024: 599 s • Efective Network Throughput: stable around 4.8–5.0 MB/s, regardless of parameter size. • Network Transfer: public key transfer time remains negligible (<1 s), while ciphertext transfer becomes significant for higher parameters. • Cryptographic Operation Overhead: almost all of the total latency is due to cryptographic computations (key generation, encapsulation, decapsulation). • Cryptographic Quality: perfect validation of test vectors, entropy greater than 97% of the theoretical value, full compliance with NIST PQC specifications. 10.2. Trends and Practical Implications Scalability and Overhead • Total latency increases predictably with the security level: +36% between Kyber-512 and Kyber-768, +38% between Kyber-768 and Kyber-1024. • Network throughput remains stable despite doubling the data volume between Kyber-512 and
Kyber-1024, demonstrating the robustness of the HPC infrastructure to PQC.
• Memory footprint increases linearly with the security level (3.2 kB to 6.3 kB per KEM operation). Identified Bottlenecks • Cryptographic operations dominate (95%+ of total time). • Ciphertext transfer becomes a non-negligible factor for higher security levels. • Some extreme latency values (observed in max RTTs) can be attributed to system factors, such as task scheduling or memory management, and should be considered for latency-sensitive applications. 10.3. Recommendations for HPC Deployment • Kyber-512 (NIST Level 1): To be preferred for HPC applications where performance is paramount and moderate security is suficient. Very low latency suitable for frequent exchanges. • Kyber-768 (NIST Level 3): Optimal security/performance compromise for most scientific and industrial uses. • Kyber-1024 (NIST Level 5): Reserved for use cases requiring maximum security, at the cost of increased latency and memory.
Practical Advice • Current HPC network infrastructure easily supports the data volumes generated by Kyber, even at the highest security levels. • Consider the linear growth of memory for massive deployments (thousands of simultaneous connections). • Budget 300 to 600 s per key establishment, depending on the security level. • To minimize latency outliers, optimize system management and process scheduling.
This study rigorously evaluated and profiled the performance of the Kyber post-quantum key exchange algorithm in a High-Performance Computing (HPC) environment, focusing on both reference and optimized (AVX2) implementations across its diferent security levels (Kyber-512, Kyber-768, Kyber-1024). Our in-depth analyses of metrics such as latency, bandwidth, and CPU footprint clearly demonstrated the inherent trade-ofs between security and cryptographic performance.
The obtained results highlight the critical importance of hardware optimizations, particularly the integration of AVX2 instructions, which yielded substantial performance gains, significantly reducing KEM operation latency and increasing efective throughput. This improvement is crucial for the adoption of post-quantum cryptography in demanding infrastructures like supercomputers, where eficiency is paramount. By identifying major CPU "hotspots," we provide concrete avenues for future specific optimizations.
Ultimately, this work ofers a detailed characterization of Kyber’s behavior under real HPC conditions, iflling an important gap in the literature. The information and recommendations stemming from this research are essential to guide system architects and developers in the transition to a post-quantum cryptographic era, ensuring both security against emerging quantum threats and the preservation of HPC system operational eficiency.
The authors have not employed any Generative AI tools.