Research

Paper

TESTING March 10, 2026

Post-Quantum Entropy as a Service for Embedded Systems

Authors

Javier Blanco-Romero, Yuri Melissa Garcia-Niño, Florina Almenares Mendoza, Daniel Díaz-Sánchez, Carlos García-Rubio, Celeste Campo

Abstract

Embedded cryptography stands or falls on entropy quality, yet small devices have few trustworthy sources and little tolerance for heavyweight protocols. We build a Quantum Entropy as a Service (QEaaS) system that moves QRNG-derived entropy from a Quantis device to ESP32-class clients over post-quantum-secured channels. On the server side, the design exposes two paths: direct quantum entropy through a custom OpenSSL provider and mixed entropy through the Linux system pool. On the client side, we extend libcoap's Zephyr support, integrate wolfSSL-based DTLS 1.3 into the CoAP stack, and add a BLAKE2s entropy pool that preserves the standard Zephyr extraction interface while introducing an injection API for server-provided entropy. Benchmarks on ESP32 hardware, targeting 100 iterations per configuration, show that ML-KEM-512 completes a DTLS 1.3 handshake in 313 ms on average without certificate verification, 35% faster than ECDHE P-256. Pairing ML-KEM-512 with ML-DSA-44 lowers the mean to 225 ms. Certificate verification adds roughly 194 ms for ECDSA but only 17 ms for ML-DSA-44, so the fully post-quantum configuration remains 63% faster than classical ECDHE P-256 with ECDSA even under full verification. Local BLAKE2s pool operations stay below 0.1 ms combined. On this platform, post-quantum key exchange and authentication are not only feasible; they are faster than the classical baseline.

Metadata

arXiv ID: 2603.10274
Provider: ARXIV
Primary Category: cs.CR
Published: 2026-03-10
Fetched: 2026-03-12 04:21

Related papers

Raw Data (Debug)
{
  "raw_xml": "<entry>\n    <id>http://arxiv.org/abs/2603.10274v1</id>\n    <title>Post-Quantum Entropy as a Service for Embedded Systems</title>\n    <updated>2026-03-10T23:09:55Z</updated>\n    <link href='https://arxiv.org/abs/2603.10274v1' rel='alternate' type='text/html'/>\n    <link href='https://arxiv.org/pdf/2603.10274v1' rel='related' title='pdf' type='application/pdf'/>\n    <summary>Embedded cryptography stands or falls on entropy quality, yet small devices have few trustworthy sources and little tolerance for heavyweight protocols. We build a Quantum Entropy as a Service (QEaaS) system that moves QRNG-derived entropy from a Quantis device to ESP32-class clients over post-quantum-secured channels. On the server side, the design exposes two paths: direct quantum entropy through a custom OpenSSL provider and mixed entropy through the Linux system pool. On the client side, we extend libcoap's Zephyr support, integrate wolfSSL-based DTLS 1.3 into the CoAP stack, and add a BLAKE2s entropy pool that preserves the standard Zephyr extraction interface while introducing an injection API for server-provided entropy. Benchmarks on ESP32 hardware, targeting 100 iterations per configuration, show that ML-KEM-512 completes a DTLS 1.3 handshake in 313 ms on average without certificate verification, 35% faster than ECDHE P-256. Pairing ML-KEM-512 with ML-DSA-44 lowers the mean to 225 ms. Certificate verification adds roughly 194 ms for ECDSA but only 17 ms for ML-DSA-44, so the fully post-quantum configuration remains 63% faster than classical ECDHE P-256 with ECDSA even under full verification. Local BLAKE2s pool operations stay below 0.1 ms combined. On this platform, post-quantum key exchange and authentication are not only feasible; they are faster than the classical baseline.</summary>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.CR'/>\n    <published>2026-03-10T23:09:55Z</published>\n    <arxiv:primary_category term='cs.CR'/>\n    <author>\n      <name>Javier Blanco-Romero</name>\n    </author>\n    <author>\n      <name>Yuri Melissa Garcia-Niño</name>\n    </author>\n    <author>\n      <name>Florina Almenares Mendoza</name>\n    </author>\n    <author>\n      <name>Daniel Díaz-Sánchez</name>\n    </author>\n    <author>\n      <name>Carlos García-Rubio</name>\n    </author>\n    <author>\n      <name>Celeste Campo</name>\n    </author>\n  </entry>"
}