We Benchmarked Post-Quantum Crypto for AI Agents. Here Are the Numbers.

Everyone talks about post-quantum cryptography. Almost nobody publishes real benchmarks on production code.

Here are ours. No asterisks. No "up to" numbers. No proprietary hardware. One workstation, one core, one hundred timed samples per operation. If you don't trust us, run them yourself. The algorithms are public standards with open implementations.

Measurement basis. AMD Ryzen 9 9950X, single-threaded. ML-DSA, ML-KEM, and key-hierarchy figures from a run on 2026-07-27; BLAKE3 and XChaCha20 figures from 2026-05-07. Every number below is a per-core cost, not system capacity. Multiply by cores for aggregate throughput, and say so when you do.

Why This Matters

CNSA 2.0 mandates post-quantum cryptography for all new national security systems by January 2027. Every AI agent that carries an identity (signs actions, proves authorization, authenticates to other agents) needs signatures and key exchange that won't break when quantum computers arrive.

The common objection: "Post-quantum is too slow for production."

That objection is wrong. Here's the proof.

ML-DSA-65: Digital Signatures (NIST FIPS 204)

This is the algorithm that signs every agent credential, every tool invocation, every delegation approval in the Aethyr stack.

Verification is the hot path. It runs every time a credential is checked, a tool invocation is authorized, or a signed action is audited. At 9,671 verifications per second on a single core, the crypto is never the bottleneck. Your LLM inference takes 100x longer.

Key sizes: 1,952 bytes (public), 3,309 bytes (signature), 32 bytes (seed).

ML-KEM-768: Key Exchange (NIST FIPS 203)

This is the algorithm that establishes encrypted sessions between AiOS network nodes. Two machines perform a post-quantum key exchange and derive a shared secret, without trusting any third party.

Full key exchange (keygen, encapsulate, decapsulate) completes in 90.93 microseconds. That's the total cost of establishing a quantum-resistant encrypted channel between two agents on different machines.

BLAKE3: Hashing and Key Derivation

Every agent's DID is BLAKE3(ML-DSA-65 verifying key). Every derived key in the hierarchy uses BLAKE3-KDF. Every content-addressable memory operation uses BLAKE3.

At 6.6 million derivations per second, the identity layer adds zero perceptible overhead to any operation.

XChaCha20-Poly1305: Symmetric Encryption

Payload encryption for the AethyrWire Protocol and credential backup.

Key Hierarchy Derivation

Every agent's keys derive from a single 256-bit master seed. Same pattern as BIP32 in cryptocurrency wallets, adapted for post-quantum algorithms.

Master Seed (256-bit)
 ├── m/0' IDENTITY    (ML-DSA-65)
 ├── m/1' SIGNING     (ML-DSA-65)
 ├── m/2' DID         (ML-DSA-65)
 ├── m/3' BACKUP      (ML-KEM-768)
 └── m/4'/n SESSION   (ephemeral)

Context strings are identical across Rust, TypeScript, and Python implementations. Cross-language test vectors verify every implementation produces the same output from the same seed.

The "Too Slow" Myth

For context, here's what actually takes time in an AI agent system:

Post-quantum crypto is three to four orders of magnitude faster than the LLM call it's protecting. The "performance overhead" argument was valid for early PQC implementations. It is not valid for optimized Rust implementations on modern hardware.

Security Properties

• NIST Security Level 3: 192-bit classical, 128-bit quantum equivalent
• No private key export: SigningKey has no Clone, no Serialize, no to_bytes(). The key is trapped by Rust's type system.
• Auto-zeroize: All sensitive material wrapped in Zeroizing<T>, cleared on drop
• Deterministic keygen: Same seed always produces same keypair. Enables recovery from backup without storing private keys.

Methodology

Each operation was timed in isolation: 100 samples per operation, fully optimized production builds, statistical means reported. Hardware: AMD Ryzen workstation, Linux (x86_64), single core. The post-quantum primitives are audited, optimized open-source implementations of the NIST FIPS 203/204 standards; what's measured here is that foundation carrying Aethyr's key hierarchy, session management, and zeroization discipline on top.

Standards

The numbers are measured. The benchmarks are reproducible. The deadline is January 2027.

Stop issuing agent credentials on RSA.

Aethyr Research, Salt Lake City, UT