Setting up Isolated Experimental Environments

Need for Isolated PQC Experimental Environments

To protect existing public-key cryptography (RSA, ECDH, etc.) from quantum computer threats, NIST has standardized post-quantum algorithms such as ML-KEM (based on Kyber) and ML-DSA (based on Dilithium). To evaluate the performance and security of these algorithms in a local environment, a reproducible environment with Crypto-agility is essential [S2].

1. Key Components

• liboqs: A C-language implementation of PQC algorithms, providing a foundation to test various KEM and signature algorithms.
• oqs-provider: An interface that uses the OpenSSL 3 provider architecture to allow integrating PQC algorithms into existing TLS infrastructure.
• Hybrid Mode: A transitional strategy that combines existing classical cryptography (ECDH) with PQC algorithms to maintain existing security levels despite potential vulnerabilities in PQC libraries [S2].

2. The Core of Experimental Environments: Isolation and Reproducibility

Experiments must be completely separated from operational environments. By locking dependency versions using container technologies like Docker, one can reduce differences in execution results between researchers and accurately measure the effects of algorithm optimization (e.g., utilizing AVX-512) [S2]. When evaluating handshake performance, one should use fixed hardware and an isolated network to minimize latency uncertainty.