The use of post-quantum cryptography in the automotive context

Post-Quantum Cryptography in Automotive Context

The use of post-quantum cryptography in the automotive context Mariana Gonçalves,

Valderi R. Q. Leithardt

Instituto Universitário de Lisboa (ISCTE-IUL), ISTAR, Lisboa, 1649-026, Portugal ORCID: Mariana Gonçalves: 0009-0002-9163-0587; Valderi R. Q. Leithardt: 0000-0003-0446-9271.

arXiv:2610.38632v1 [cs.CR] 28 Oct 2026

Abstract This study comparatively evaluates post-quantum cryptography (PQC) in automotive communication scenarios, considering the threat posed by quantum algorithms such as Shor’s and Grover’s algorithms. The simulations use OMNeT++, Veins, INET, and SUMO on two hardware platforms and examine ML-KEM/CRYSTALS-Kyber, ML-DSA/CRYSTALS-Dilithium, and FALCON. ML-KEM and ML-DSA are finalized NIST standards, whereas FALCON is a NIST-selected candidate pending final standardization. The evaluation considers a rural V2V scenario and an urban V2X scenario supported by a roadside unit. Kyber exhibits low key encapsulation mechanism (KEM)operation latency, Dilithium provides balanced signature performance, and FALCON has high key-generation and signing costs but efficient verification. The results are interpreted as a comparative assessment among the evaluated PQC schemes under the reported simulation conditions; a conventional ECDSA/ECDH baseline measured in the same simulation setup is also reported for reference.The resulting dataset can support future studies of cryptographic selection in automotive systems. Keywords: Automotive, Vehicle-to-Everything (V2X), Vehicle-to-Vehicle (V2V), NIST, Post-Quantum Cryptography (PQC)

1

Introduction

As time passes, everything around tends to evolve, becoming more intelligent, although it comes with its disadvantages. At this date, we are dealing with constant attacks to our communications, and now with new quantum era reaching its peak, it is only rational to come up with ways to defend ourselves. Intelligent devices that require cryptography, still operate with algorithms which depend on factorizing large numbers for example Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC) that depends on discrete logarithm problem. These algorithms are in serious danger, all because of the quantum era. Two quantum algorithms were developed, surpassing the traditional cryptographies: Shor’s algorithm and Grove’s algorithm [43]. In practical terms, Shor’s algorithm breaks the underlying hardness assumptions of RSA (integer factorization) and ECC (discrete logarithm) once sufficiently large fault-tolerant quantum computers exist. Grover’s algorithm provides a quadratic speedup for unstructured search, reducing the effective security of a k-bit symmetric primitive from O(2k ) to O(2k/2 ), which motivates longer symmetric keys and hash outputs in a quantum adversary model. These two algorithms are the main reason to start building up defenses agaisnt quantum era, with that Post-Quantum Cryptography (PQC) was created. Even though currently are very scarce on quantum computer power, with the most powerful ones being Magne from Denmark with exactly 1200 physical qubits [7], 50 logical qubits and ABCI-Q from Japan having 2020 NVIDIA H100 GPUs, it is an huge step in order to protecting us from quantum hazards. According to the media, “Quantum computing is witnessing rapid advance toward commercial and research uses” [41], many companies show an huge interest in quantum power making them invest billions in order to complete their company’s timeline objectives. For example, IBM has updated their road map and intends to reach a quantum-centric supercomputer by the end of 2025 with over 4000 qubits [46]. NIST announced the algorithms selected for its first PQC standardization set in 2022. In 2024, it finalized ML-KEM, ML-DSA, and SLH-DSA as FIPS 203, FIPS 204, and FIPS 205, respectively. FALCON was selected by NIST for standardization but remains pending final standardization as FN-DSA [31, 36]. 1

Post-Quantum Cryptography in Automotive Context

Since 1885, humans rely on vehicles to move around, with all the technological evolution, these vehicles tend to become smarter e.g, capable of making calls and open the doors with the key fob. But all of this, requires extensive communication between systems, and for our own privacy, these systems require extensive cryptographic algorithms as mentioned before (RSA and ECC) [27, 40]. The automotive PQC market explores different kinds of hardware, software and services idealized to defend components from quantum threats. These attacks can affect Vehicle-to-Everything (V2X) communications, Over-The-Air (OTA) updates, autonomous driving systems [4] and Electronic Control Unit (ECU) communication [46]. It’s expected that the market will continue to grow significantly until 2034, with the factors of growth being Electrification of vehicles and Advanced Driver Assistance Systems (ADAS) [46], [4]. V2X covers multiple types of communication such as V2V, Vehicle-to-Infrastructure (V2I), Vehicle-toNetwork (V2N), Vehicle-to-Device (V2D) and Vehicle-to-Pedestrian (V2P) [47]. V2X is an essential technology for full autonomous driving, boosting the vehicle’s situational awareness beyond the capabilities from sensors, camera and Light Detection and Ranging (LiDAR). A key advantage of V2X compared to purely onboard sensing is the possibility of receiving warnings and cooperative perception messages even without a direct line of sight. However, the safety-critical nature of V2X implies stringent requirements, namely low latency, high message rates, and robustness under contention and packet loss. Infrastructure developers are currently utilizing two kinds of V2X wireless communication technologies: Dedicated Short-Range Communications (DSRC) and Cellular-Vehicle-to-Everything (C-V2X). DSRC is an older technology that operates within the 5.9GHz spectrum for Wi-Fi communication, C-V2X is a more recent approach that leverages cellular networks, including 5G [47]. DSRC (IEEE 802.11p) was designed for low-latency broadcast safety messages, typically within a range of 300 to 1000 meters, whereas C-V2X supports both direct short-range communication (PC5) and long-range cellular communications (Uu) [47]. Because V2X systems may broadcast ten or more safety messages per second over shared spectrum, cryptographic choices must consider not only computational cost but also communication overhead and collision dynamics at the MAC layer. At this technological stage, integrating V2X with PQC is increasingly important because conventional public-key mechanisms are vulnerable to quantum attacks. NIST selected the first algorithms in 2022 and finalized ML-KEM, ML-DSA, and SLH-DSA in 2024; FALCON remains a selected candidate pending final standardization [31, 36]. This work motivation comes from a deep interest for cybersecurity and the desire to assemble two big concepts: PQC and V2X because there is a lack of comprehensive studies evaluating both performance and feasibility of PQC in automotive context. This study focuses on two different scenarios: a rural environment (V2V) and an urban one supported by a roadside unit (V2X). Three schemes were selected: Kyber, Dilithium, and FALCON. We evaluated metrics such as key generation time, key encapsulation mechanism (KEM) encapsulation/decapsulation, and signing/verification. We will examine whether there are differences between the scenarios and, in addition, we will also test them using different devices to obtain more accurate results. The broader context of adaptive and intelligent security systems [32, 33, 33] further motivates this work: as connected vehicles become increasingly autonomous and data-driven, the ability to monitor, adapt, and select cryptographic mechanisms dynamically based on network conditions and threat levels will be essential [17, 21, 30, 32]. The main scientific contributions of this paper are: (i) a comparative performance evaluation of MLKEM/CRYSTALS-Kyber, ML-DSA/CRYSTALS-Dilithium, and the NIST-selected FALCON candidate in rural V2V and urban V2X scenarios; (ii) an analysis of handshake-completion behavior under a broadcasttriggered response burst and a randomized response-interval mitigation; (iii) a cross-hardware performance study using two computing platforms; and (iv) a publicly available dataset of cryptographic operation timings that can support future research on adaptive and machine-learning-driven scheme selection in automotive security contexts [17, 21, 30, 32, 32, 33, 33]. The novelty of this study lies in testing these lattice-based algorithms in different scenarios (rural and urban) and, in this way, evaluating how they perform under different circumstances. Therefore, the novelty also extends to the dataset produced, as no dataset has yet been created that considers different types of scenarios. This paper is organized as follows. Section 1 introduces the problem, motivation, and contributions. Section II surveys related work on PQC in automotive systems, V2X security, and adaptive security approaches. Section III describes the methodology, including the simulation environment, cryptographic primitives, hardware platforms, and experimental scenarios. Section IV presents and analyzes the results for both V2V and V2X scenarios across all evaluated schemes. Finally, Section V discusses the findings, limitations, and directions for future work. 2

Post-Quantum Cryptography in Automotive Context

2

Related Work

The related work papers were selected through several academic search engines such IEEE Computer Society, IEEE Xplore, Springer and Cryptology ePrint Archive by using specific keywords, namely “Post-Quantum Cryptography”, “Vehicle-to-Everything”, “Performance optimization”, “Lattice-based Cryptography”. This section is complemented with table 1 with all works that were used. Table 1: Related Work papers Paper

Key Focus

Methodology

Advantages

Limitations

[44] [15] [26]

PQC PQC PQC for Automotive OTA Updates

High Security Optimization Falcon achieves better results than Dilithium

PQC

Low Failure Rate

Performance Performance PQC doesn’t have embedded hardware-accelerated hash function Performance

2020 2020 2021

[16] [45] [5]

V2X PQC for Automotive OTA Updates

Comprehensive High Security

Standards Performance

2023 2023

[38]

PQC

Security

Performance

2024

[42]

PQC for V2V

PQC on HSM ECC into PQC Implementing PQC Dilithium and Falcon on Hardware Implementing PQC on Hardware Survey Implementing PQC Dilithium for Secure OTA Updates Implementing PQC on Hardware Partially Hybrid Protocol

Slight Frame Loss

2024

[2]

PQC for V2X AI-PQC for V2X in Transportation

Doesn’t cover real-world effects (i.e. jitter) Little Explored

2025

[3]

[6]

PQC for in-vehicle security

Segmented-based CAN model with PQC Kyber

Reliable and LowLatency Promote further research Self-Adapting and Intelligence-driven Security Architecture Efficiency and Feasibility

2025

[9]

V2X Attacks

Simulation of Jamming attacks on NR-V2X

Alternatives like SIDH, BIKE or Saber were not feasible Lack of dynamic vehicular interactions

[10]

Key Agreement Protocol for V2X with PQC V2X Attacks

Protocol based on PQC Kyber and Saber

Experiment conducted in a virtual environment

2025

Developments with machine learning were not included Bandwidth and hardware

2025

[14]

[25]

[29]

This paper

PQC for Intelligent Transportation Systems PQC for V2X

PQC for V2X

Dataset Generation for PQC attacks Enhancing PQC with AI

Survey

Review on V2X and vulnerabilities Comprehensive Overview of PQC Dataset of PQC scheme’s performances on different environments

Proved that Jamming attacks degrade communication Low handshake latency and moderate resource consumption Compiled works to facilitate researchers’ studies Explicit priorities for the implementation roadmap Compiled state-of-art PQC in Automotive Context Viable for automotive use and promising for future protocols

Published

2021

2025

2025

2026

Necessity of lighter and faster PQC schemes

2026

Simulated on virtual environment

2026

Differently from the state of the art we propose in this paper evaluate different lattice-based PQC in different scenarios (Rural and Urban) which will each represent distinct types of communication (V2V and V2X).

2.1

PQC in automotive platforms (HSMs and OTA)

The authors of [44] aim to analyze the NIST final candidates in the PQC standardization process and to propose new sets of hardware accelerators for the next generation of automotive Hardware Secure Modules (HSM). This line of work is important because, beyond algorithmic feasibility, deployment in vehicles often depends on secure hardware roots-of-trust, cryptographic isolation, and predictable latency under constrained embedded conditions. The main limitation highlighted in this class of studies is the tension between security requirements and practical performance/area/power budgets. Paper [12] evaluates Kyber and Dilithium at both algorithm and TLS 1.3 protocol levels. The results show that AVX2-optimized implementations provide strong performance, with computational costs remaining 3

Post-Quantum Cryptography in Automotive Context

competitive with classical cryptographic methods. The main challenge in PQC deployment is not processing time, but the larger size of TLS handshake messages, which increase to around 8–15 kB. The study concludes that PQC is computationally feasible, but bandwidth requirements may be the main limitation. The work of [5] studies how to ensure that applications like secure boot and secure OTA update are not easily manipulated through software or firmware modification. It investigates the impact of Dilithium on OTA, working with a vehicle network processor (S32G) and comparing PQC signature verification in two settings: (i) an Arm Cortex-A53 based microprocessor and (ii) a micro controller integrated in the Hardware Security Engine (HSE) based on Arm Cortex-M7. The key take-away is that the OTA pipeline is sensitive not only to signature verification latency but also to memory footprints and integration constraints with existing secure-update chains. Complementarily, [26] explores multiple PQC algorithms on an automotive-oriented evaluation board (Xilinx Zynq Ultrascale+ ZCU102). It frames a threat model that includes Shor and Grover, and discusses attacks relevant to update systems (e.g., rollback and malicious update). The evaluation focuses on verification costs (RSA, ECDSA, Dilithium, Falcon), which is particularly relevant since OTA often performs many verifications (e.g., chunked images, manifest chains, metadata), making verification throughput a practical bottleneck.

2.2

Implementations, memory footprint, and feasibility across devices

The authors in [38] selected four PQC algorithms from NIST third-round finalists: Kyber and Saber as KEM schemes and Dilithium and FALCON as digital signature schemes, testing them on Aurix TC375, Renesas R7F7015032, Raspberry Pi 2 and 4. Beyond time measurements, the study emphasizes memory consumption: Kyber requires up to 1.3 times less memory than Saber for comparable security settings, while Falcon tends to require less memory than Dilithium. These results motivate careful scheme selection when targeting ECUs with limited RAM/flash and strict real-time constraints. The work in [6] studies in-vehicle security with segmentation and Kyber-based protection in a CANoriented model, contributing evidence that some alternatives may be infeasible in certain constraints. Although intra-vehicle networks differ from V2X, they share the core challenge of balancing security overhead with deterministic timing. In addition, [8] developed a modular framework to simulate the performance and overhead of PQC algorithms in embedded systems. They simulate the capabilities of an embedded systems and CAN bus bit rate constraints. Authors of [1] evaluates the performance of PQ) schemes across different computing environments, from high-performance servers to resource-constrained IoT devices. The results show that PQC is ready for practical deployment in modern systems, although limited-resource devices face higher computational, memory, and communication costs. The study proposes optimization strategies and a migration framework to support the transition to quantum-resistant security.

2.3

V2X protocols, attacks, and datasets

A broad survey on V2X security and privacy issues is provided in [45], framing the standards landscape, threat surfaces, and open challenges. Attacks such as jamming and their impact on NR-V2X are studied in [9], showing that physical-layer and MAC-layer disruptions can degrade communications even before cryptographic checks are applied. This is directly relevant to our urban scenario results, where contention and collisions affect handshake completion. From the perspective of PQC integration into V2X message flows, [42] presents a practical post-quantum authentication protocol for V2V communications that aims for reliability and low latency, while reporting frame loss under load. The dataset contribution in [2] provides structured data to support research on PQCrelated attacks and performance evaluation; however, it may not cover all real-world effects, such as jitter and dynamic channel variability. Additionally, [10] proposes a lightweight V2X key agreement protocol combining Kyber and Saber, reporting reduced handshake latency (relative to RSA) and lower resource consumption. This is aligned with our focus on KEM performance under contention, and it highlights that combining PQC primitives can yield practical protocols if carefully engineered. Authors from [13] also evaluate Kyber and Dilithium and demonstrate efficient execution times, obviously better than classical cryptography schemes such as RSA and ECDSA at equivalent security levels. The 4

Post-Quantum Cryptography in Automotive Context

authors also explore the idea of implementing PQC into nowadays systems, ilustrating how telecom operators are integrating PQC into 5G authenticaiton, subscriber identiy protection, and secure communications. Finally, [23] offers research challenges regarding the adoption of PQC in the automotive domain and the principal steps to achieve quantum safety.

2.4

AI and self-adaptive security directions

[3] focuses on an AI approach to implement PQC schemes into real-life scenarios, suggesting reinforcement learning agents to recognize congestion and CPU usage and to switch between schemes without human supervision. This direction connects with broader self-adaptation research in smart environments [33, 33] and reinforcement-learning-based adaptive quantum-safe cryptography [32].

3

Methodology

For this experiment we will test on two different hardwares represented in tables 2 and 3. Both simulations will be running on Windows 11 via WSL2. With different hardware, we will obtain a wider range of results, allowing us to analyze which option performs best, since the results will depend on the hardware. Table 2: Hardware 1 - Components used in the simulation Operative System CPU Memory GPU Motherboard

Windows 11 Home 64 bits Intel(R) Core(TM) i5-8400 @ 2.80GHz 16384MB RAM NVIDIA GeForce GTX 1060 3GB HP 84FD

Table 3: Hardware 2 - Components used in the simulation Operative System CPU Memory GPU Motherboard

3.1

Windows 11 Home 64 bits AMD Ryzen 5 5500U @ 2.10GHz 15769MB RAM AMD Radeon Graphics LNVNB161216

Cryptographic primitives and mathematical background

This experiment focuses exclusively on lattice-based schemes due to their strong performance in current post-quantum standardization efforts. After reviewing the literature, a selection was made among the most well-established candidates. In particular, we selected three widely recognized lattice-based schemes: Kyber, Dilithium and FALCON. ML-KEM and ML-DSA have been finalized by NIST; FALCON is a NIST-selected candidate pending final standardization. These schemes are therefore highly relevant for practical PQC evaluations. This decision was motivated by the fact that lattice-based schemes have emerged as the most widely studied in the literature, owing to their strong foundation of security. Kyber, Dilithium, and Falcon are among the most promising lattice-based schemes and have been extensively evaluated in other research’s, making them representative choices for this study. To enable a comparative analysis, it was included two digital signature schemes (Dilithium and FALCON), which exhibit different design trade-offs in terms of performance and signature size. Additionally, it was selected a single KEM scheme, Kyber due to its strong security guarantees consistent performance reported across multiple studies [38], [10].

5

Post-Quantum Cryptography in Automotive Context

3.1.1

Lattices, SVP/CVP, and LWE-type hardness assumptions

A lattice in Rn can be defined from a basis matrix B ∈ Rn×n as L(B) = {Bz | z ∈ Zn }.

(1)

Two fundamental computational problems are the Shortest Vector Problem (SVP) and the Closest Vector Problem (CVP). Informally, SVP asks to find a non-zero vector v ∈ L(B) minimizing ∥v∥, while CVP asks, given a target vector t ∈ Rn , to find v ∈ L(B) minimizing ∥t − v∥ [19, 34]. Many lattice-based cryptosystems rely on average-case hardness assumptions connected to Learning With Errors (LWE) and its structured variants. A common LWE formulation is: given (A, b) with b = As + e

(mod q),

(2)

recover the secret s (or distinguish samples from uniform), where e is a small “error” vector and computations are mod q. Module-LWE (MLWE) and Module-SIS (MSIS) use algebraic structure to improve performance while maintaining strong security arguments. 3.1.2

KEM and digital signature interfaces (what we measure)

Kyber is a key encapsulation mechanism (KEM), as introduced in Section I. At a high level, a KEM is defined by the algorithms: (pk, sk) ← KeyGen(),

(3)

(ct, ss) ← Encaps(pk),

(4)

ss ← Decaps(sk, ct).

(5)

Here, pk denotes the public key, which is distributed openly to any party that wishes to establish a shared secret with its owner, and sk denotes the corresponding secret (private) key, which is kept exclusively by its owner and is never transmitted.The encapsulation returns a ciphertext ct and a shared secret ss, which is then used with symmetric encryption (e.g., AES-256) to protect application data. Fig. 1 illustrates how these three operations are mapped onto the rural V2V message flow used in this study. During the initial setup, Vehicle A and Vehicle B each run KeyGen and exchange their public keys. Each vehicle then executes Encaps with the public key received from the other party and returns the resulting ciphertext. After the ciphertexts are exchanged, each vehicle executes Decaps with its own secret key to recover the shared secret. When an accident occurs, Vehicle A encrypts the accident information with the shared secret (AES-256) and sends it to Vehicle B, which decrypts the message and changes lane to avoid the accident. Dilithium and Falcon are digital signature schemes with: (pk, sk) ← KeyGen(),

(6)

sig ← Sign(sk, m),

(7)

{0, 1} ← Verify(pk, m, sig),

(8)

where m is the message, pk and sk are, respectively, the public verification key and the secret signing key of the sender, and sig is the digital signature computed over m with sk. The output of Verify is 1 if sig is a valid signature on m under pk and 0 otherwise. In V2X, verification is typically executed more frequently than signing, since one sender may broadcast to many receivers. This is one reason why verification cost becomes a key metric when evaluating signature schemes for safety messaging. Fig. 2 depicts the corresponding message flow for the signature schemes. After the initial setup (key generation and distribution of the public key), Vehicle A detects an accident, signs the accident information with its secret key, and broadcasts the message together with its signature. Vehicle B verifies the signature with Vehicle A’s public key: if the message is valid, Vehicle B changes lane to avoid the accident; otherwise, the message is dropped. Unlike the KEM flow in Fig. 1, no interactive exchange is required before the safety message is sent, which is why signing and verification latency directly affect the time-to-react of the receiving vehicle. The three schemes evaluated in this work instantiate these interfaces as follows. 6

Post-Quantum Cryptography in Automotive Context

ML-KEM/CRYSTALS-Kyber. Kyber is an IND-CCA2-secure KEM whose security relies on the hardness of the MLWE problem over the polynomial ring Rq = Zq [X]/(X n + 1) with n = 256 and q = 3329. Secrets and errors are small polynomials sampled from a centered binomial distribution, and the public matrix A ∈ Rqk×k is expanded pseudo-randomly from a short seed, which keeps public keys compact. The module rank k ∈ {2, 3, 4} defines the three parameter sets Kyber-512, Kyber-768, and Kyber-1024, which target NIST security levels 1, 3, and 5, respectively. Internally, Kyber first builds an IND-CPA-secure public-key encryption scheme in which a ciphertext is essentially an MLWE sample carrying a compressed encoding of a random 32-byte message; the KEM is then obtained by applying a variant of the Fujisaki– Okamoto transform, so that Decaps re-encrypts the recovered message and compares the result with the received ciphertext, returning a pseudo-random value in case of mismatch (implicit rejection). Polynomial multiplications are performed with the number-theoretic transform (NTT), and all operations involve only small integer arithmetic, which explains the low and nearly constant execution times observed for all three Kyber operations. ML-DSA/CRYSTALS-Dilithium. Dilithium is a signature scheme based on the hardness of MLWE and MSIS over Rq with n = 256 and q = 8380417. It follows the “Fiat–Shamir with aborts” paradigm: the public key is t = As1 + s2 , where s1 , s2 are short secret vectors. To sign, the signer samples a masking vector y, computes the high-order bits w1 of Ay, derives a sparse challenge polynomial c by hashing w1 together with the message, and outputs z = y + c s1 . Rejection sampling discards and restarts any attempt for which z (or the associated hint) could leak information about the secret key, so signing time is probabilistic and varies across executions. Verification recomputes w1 from Az−c t using the hint and checks the challenge, requiring only a fixed number of NTT-based multiplications. Dilithium uses exclusively uniform and small-coefficient sampling and integer arithmetic, which makes it simple to implement in constant time; the parameter sets Dilithium-44, Dilithium-65, and Dilithium-87 (ML-DSA-44/65/87) correspond to NIST levels 2, 3, and 5. FALCON. FALCON (Fast-Fourier lattice-based compact signatures over NTRU) instantiates the GPV hash-and-sign framework over NTRU lattices with q = 12289 and n ∈ {512, 1024} (Falcon-512 and Falcon1024, NIST levels 1 and 5). The public key is h = g f −1 mod q, where f and g are short polynomials; the secret key is a short basis of the NTRU lattice obtained by additionally solving the NTRU equation f G − gF = q. To sign, the message is hashed together with a random salt to a point c, and the signer uses its trapdoor basis to sample, by means of fast Fourier sampling, a short lattice vector (s1 , s2 ) such that s1 +s2 h = c mod q; only the compressed s2 is transmitted. Verification simply recomputes s1 = c−s2 h mod q and checks that ∥(s1 , s2 )∥ is below a bound, which costs a single polynomial multiplication. Key generation (which solves the NTRU equation) and signing (which performs discrete Gaussian sampling with doubleprecision floating-point arithmetic) are considerably more complex, which explains the high key-generation and signing costs and the very efficient verification reported in Section IV, as well as the compact signatures listed in Table 5.

7

Post-Quantum Cryptography in Automotive Context

Figure 1: Key Encapsulation Mechanism Message Scheme

8

Post-Quantum Cryptography in Automotive Context

Figure 2: Digital Signature Message Scheme

3.2

Software stack and PQC implementation

After evaluating the available libraries, PQClean [20] was selected as the most suitable library for this experiment. This choice is motivated by its comprehensive collection of post-quantum cryptographic schemes, including implementations of the algorithms selected and standardized by NIST, as well as other candidates. Another important advantage of PQClean is its focus on clean, portable, and well-documented C implementations, which facilitates integration into simulation environments. Objective Modular Network Testbed in C++, is an object-oriented simulator of abundant types of network, like V2X. It was developed solely for academic and educational purposes. There multiple frameworks compatible with OMNeT++, like Veins, it includes a comprehensive suite of models to recreate vehicular network as real as possible. Road traffic simulation is performed by SUMO which is well-established in traffic engineering. Recently the OMNet++ developers created a new way to setup more easily OMNeT++ with oppenv. This avoids dealing with manually installing the dependencies and compatibility issues, it also comes with extensive model library and it is cross-platform. To incorporate PQClean into OMNeT++, only a wrapper layer is required, as PQClean is implemented in C, whereas OMNeT++ is based on C++. This interoperability allows seamless use of the cryptographic primitives within the simulation framework. And not only that, but also multiple works reviewed in Related Work section utilized PQClean, for example [5], [10]. For cryptographic operation benchmarks, only the cryptographic layer is included, however, for full latency measurements, all layers are included (application, MAC, network, transport, and physical). The software versions used for this project were: • OMNeT++-6.3.0 • Veins-5.3 • INET-4.5.4 • PQClean (latest version) • SUMO 1.22.0 9

Post-Quantum Cryptography in Automotive Context

The various simulations were executed five times for each scenario. The simulation durations were set at 60 and 200 seconds for the V2V and V2X scenarios, respectively. However, for V2X, this time was longer than expected due to retransmissions and network congestion all of this compiled with GCC since it’s the standard compiler of C++.

3.3

Key material size and communication overhead

The selected PQC schemes differ significantly in the size of their key material and ciphertexts, which directly impacts performance and communication overhead. In the PQClean implementations, Kyber, Dilithium, and Falcon exhibit different trade-offs. Kyber, optimized for balanced performance, offering relatively small public keys and ciphertexts along with a fixed shared secret size. Dilithium, designed for digital signatures, prioritizes simplicity resulting in larger public and secret keys as well as sizable signatures, but with efficient verification. Falcon, also a signature scheme, achieves much smaller signature sizes compared to Dilithium, though at the cost of more complex arithmetic. Kyber is a KEM: its encapsulation operation produces a ciphertext and a shared secret. Dilithium and FALCON are signature schemes: they produce signatures and do not produce shared secrets. To avoid mixing these distinct interfaces, the key-material sizes are reported in separate tables. Table 4: ML-KEM/CRYSTALS-Kyber sizes (bytes) Scheme

Secret Key

Public Key

Shared Secret

Ciphertext

1632 2400 3168

800 1184 1568

32 32 32

768 1088 1568

Kyber-512 Kyber-768 Kyber-1024

Table 5: ML-DSA/CRYSTALS-Dilithium and FALCON sizes (bytes) Scheme

3.4

Secret Key

Public Key

Signature

Dilithium-44 Dilithium-65 Dilithium-87

2560 4032 4896

1312 1952 2592

2420 3309 4627

Falcon-512 Falcon-1024

1281 2305

897 1793

752 1462

Communication overhead, channel metrics, and classical-baseline scope

At the configured 6 Mbps bitrate, payload-only airtime is computed as Tair = 8L/R, where L is the transmitted payload size in bytes and R = 6 × 106 bit/s. Accordingly, a Kyber-512 public key (800 bytes) requires approximately 1.07 ms, a Kyber-512 ciphertext (768 bytes) approximately 1.02 ms, a Dilithium-44 public key (1312 bytes) approximately 1.75 ms, a Dilithium-44 signature (2420 bytes) approximately 3.23 ms, a Falcon512 public key (897 bytes) approximately 1.20 ms, and a Falcon-512 signature (752 bytes) approximately 1.00 ms. These estimates exclude MAC/PHY headers, contention, backoff, retransmissions, fragmentation, and certificate material. The observed urban handshake-completion counts were 15 of 65 vehicles (23.07%) before randomized response timing and 41 of 65 vehicles (63.07%) after the randomized interval was introduced. These values are handshake-completion rates, not packet delivery ratios (PDRs), and they must not be interpreted as direct measurements of PDR or collision probability. The current model transmits raw cryptographic material and does not implement IEEE 1609.2 or ETSI TS 103 097 certificate chains, certificate digests, or pseudonymcertificate management. Consequently, certificate-related communication overhead is outside the present scope. Channel Busy Ratio (CBR), standalone PDR, and MAC-layer collision probability are reported in Table 6 for the final measured dataset. A controlled ECDSA/ECDH baseline using the same OMNeT++/Veins/INET/WSL2 configuration is also included as a required comparison point.The conventional baseline uses ECDSA and ECDH over the NIST P-256 curve, which provides a classical security level comparable to NIST PQC level 10

Post-Quantum Cryptography in Automotive Context

1, and each value in Table 6 is the mean over all operations executed during the corresponding simulation run. In the V2V scenario, the low vehicle density yields a low channel load (CBR of 4.8%) and an almost loss-free channel (PDR of 98.6%). In the V2X scenario, the higher density and the broadcast-triggered response burst raise the CBR to 37.4% and the collision probability to 11.7%, reducing the PDR to 81.3%. The classical primitives show the same slight V2X increase observed for the PQC timings, which is consistent with the host-load effect discussed in Section V. Compared with this baseline, the Kyber-512 encapsulation and decapsulation operations are of the same order of magnitude as, or faster than, an ECDH shared-secret computation, Falcon verification is faster than ECDSA verification, and Dilithium signing and Falcon signing are slower than ECDSA signing. Table 6: Channel and conventional-baseline metrics for the final measured dataset

3.5

Metric

V2V

V2X

CBR (%) PDR (%) Collision probability (%)

4.8 98.6 0.9

37.4 81.3 11.7

ECDSA P-256 Sign (µs) ECDSA P-256 Verify (µs) ECDH P-256 KeyGen (µs) ECDH P-256 Shared Secret (µs)

38.4 44.9 112.6 127.3 36.1 41.7 103.8 118.5

Scenarios and architecture

To achieve meaningful results, it is necessary to define the scenarios and the PQC schemes to be evaluated. In order to analyze different conditions, two distinct scenarios are considered: an urban environment (characterized by high vehicle density) and a rural environment (with low vehicle density), both of which are implemented and available online. This approach aims to assess how PQC algorithms perform under varying levels of network stress. The Veins-Inet example consists of three vehicles. One of them is involved in an accident and subsequently broadcasts a warning message to the others. Upon receiving this message, the remaining vehicles adjust their trajectories accordingly. As for the Veins example scenario, 65 vehicles are considered during the reported experimental window, along with a single Road Side Unit (RSU). Following the same logic as in the V2V scenario, when a vehicle is involved in an accident, it broadcasts an alert message to nearby vehicles and the RSU. Upon receiving the message, the RSU relays it over a wider range, allowing vehicles that were outside the initial broadcast coverage to also receive the alert. In the rural scenario, for Kyber, the entire encapsulation and decapsulation process was carried out, and finally, to verify its functionality, accident messages were encrypted using AES-256 with the shared secret key obtained through the process. However, in the V2X scenario, this encryption was not performed because this study aims solely to evaluate the execution times of post-quantum encryption operations, therefore, the accident messages were not encrypted. As for the digital signature schemes, all sent packets were signed. In both scenarios, we have two different types of packets to demonstrate their functionality: signed and unsigned. The scenario begins by sending an unsigned packet, after it is rejected by all network entities, the car that causes the accident sends its signed packet. The other vehicles receive and successfully validate the packet, and consequently change the lane in which they were traveling.

11

Post-Quantum Cryptography in Automotive Context

Table 7: Parameters used for each scenario Parameters V2V V2X Transmitted power 20mW 20mW Bandwidth 10MHz 10MHz Number of channels 3 Standard type "p", IEEE 802.11p "p", IEEE 802.11p Update interval 0.1s 1s Select module type VeinsInetCar TraCIDemo11p Acceleration 2.6 2.6 Deceleration 4.5 4.5 Sigma 0.5 0.5 Maximum speed 14 14 Number of vehicles 3 65 Starting number of vehicles 0 0 Number of accidents 1 1 Accident timestamp 20s 73s Accident duration 3s 20s Simulation time 60s 200s Application layer type TraCIDemo11p Header length 80 bits 80 bits Maximum interference distance 2600m Bitrate 6Mbps Minimum power -110dBm Noise floor -98dBm The reported urban experiments consider 65 effective vehicles. The road topology can support up to 195 vehicles during a longer simulation period.

12

Post-Quantum Cryptography in Automotive Context

(a) Urban environment (V2X) with RSU support

(b) Rural environment (V2V) with low vehicle density

Figure 3: Developed simulation scenarios: (a) urban environment (V2X) with RSU support; (b) rural environment (V2V) with low vehicle density. Fig. 3 shows screenshots of the two simulation scenarios developed in this work, captured from the OMNeT++/Qtenv graphical environment during execution. Fig. 3a depicts the urban V2X scenario (Veins RSU example): the road network and buildings are drawn as polygons, vehicles appear as numbered nodes (node[3] to node[17] in the captured instant), and the RSU (rsu[0]) is shown on the left; the dashed blue lines represent IEEE 802.11p frames (AirFrame11p) being broadcast simultaneously by many vehicles, which illustrates the synchronized transmission burst that causes the contention discussed in Section IV. Fig. 3b depicts the rural V2V scenario (Veins–INET example) with only three vehicles (node[0], node[1], and node[2]) on a single road and no infrastructure; the red lines show a fragmented Kyber ciphertext (kyber-ct-frag0) being transmitted directly between vehicles. The contrast between the two panels highlights the difference in vehicle density and network topology that drives the different channel loads reported in Table 6. 13

Post-Quantum Cryptography in Automotive Context

Figure 4 provides a clearer overview of the architecture of this work, summarizing all the details described in this section.

Figure 4: Architecture of the experimental simulation

3.6

Measurement perspective and end-to-end latency decomposition

To interpret results, it is useful to separate cryptographic computation from network effects. For a generic exchange, we can write an approximate decomposition: Te2e ≈ Tcrypto + TMAC + Tprop + Tqueue/backoff ,

(9)

where Tcrypto aggregates the application-layer primitive timings (KeyGen/Encap/Decap or KeyGen/Sign/Verify), and the remaining terms capture contention, propagation, and medium access delays. In high-density scenarios, Tqueue/backoff and collision-induced retransmissions/loss can dominate the probability of completing a handshake within a limited simulation time window. The Rural Scenario uses Packet (VEINS+INET), while the Urban Scenario uses TraCIDemo11pMessage (VEINS), which inherits from BaseFrame1609-4. INET Packet: The container for the payload and the central header, designed to be transmitted across virtually all layers of the OSI model (from the application layer to the physical layer, including the network layer). TraCIDemo11pMessage: A message strictly at the application layer (representing a short WAVE message). It is encapsulated in VEINS MAC-layer frames, such as BaseFrame1609-4 and AirFrame11p, for wireless transmission. We observed that, in the rural scenario, the heavier schemes such as Kyber-1024, Dilithium-88, and FALCON-1024 needed to fragment their packets, since the packet size exceeded the transmission capacity. In contrast, the fragmentation process in Airframe is performed at the MAC layer before reaching the physical layer. The packet sizes (accident information size, signature size, public key size) for Dilithium-44, 65, and 87 are 3740, 5269, and 7227, respectively. Those for Falcon-512 and 1024 are 1561 and 3074.

4

Results

This section presents and analyzes the experimental results obtained from ML-KEM/CRYSTALS-Kyber, ML-DSA/CRYSTALS-Dilithium, and the NIST-selected FALCON candidate across two vehicular communication scenarios: a rural V2V environment and an urban V2X environment. All measurements were collected 14

Post-Quantum Cryptography in Automotive Context

on two distinct hardware platforms (described in Section III), allowing a cross-device comparison. The results are organized by scheme type: first the KEM scheme (Kyber), then the digital signature schemes (Dilithium and Falcon). For each scheme, we analyze primitive-level timings (in microseconds), scenario-level behavior, and the interplay between cryptographic cost and network dynamics. The goal is to assess not only raw computational performance but also the practical feasibility of each scheme in safety-critical vehicular communication. We also evaluated metrics such as median, standard deviation and confidence intervals (95%), all reported in https://github.com/MarianaCGoncalves/V2X-PQC-Tese-Results.

4.1

Overview of measured operations

We report microsecond-level timings for primitive operations (KeyGen, Encap, Decap, Sign, Verify) and relate them to scenario-level behavior. In practice, even if cryptographic operations are fast, the communication pattern (broadcast vs point-to-point, number of participants, synchronized transmissions) can substantially affect the success rate of key establishment and message delivery. It is important to note that the timings reported here reflect the execution of cryptographic primitives within the simulation environment, running on top of the host operating system via WSL2. As such, they are influenced by OS scheduling, memory access patterns, and CPU micro architecture, rather than representing bare-metal embedded performance. Nevertheless, they provide a meaningful relative comparison between schemes and hardware platforms, and serve as an upper-bound estimate for the cryptographic overhead in a realistic vehicular deployment.

4.2

Kyber (KEM) results: rural (V2V) vs urban (V2X)

In V2V, every vehicle acts like trust center, they send each other the public key and ciphertext. The vehicle which sends the accident alert, encrypts the message with AES-256 with the now shared secret. The next tables present Hardware 1 (above) and 2 (under) results. Table 8: Kyber Rural Scenario Scheme

Key Gen (µs)

Encap (µs)

Decap (µs)

Kyber-512 Kyber-768 Kyber-1024

46.33 76.56 106.56

53.28 75.89 119.11

62.33 92.11 133.33

Kyber-512 Kyber-768 Kyber-1024

39.66 61.11 99

49 70.44 106.11

63.22 88.72 130.72

The rural scenario exhibits the expected scaling with the security level: higher parameter sets (e.g., Kyber-1024) increase KeyGen/Encap/Decap time. Nevertheless, these operations remain at the order of tens to hundreds of microseconds, suggesting that the cryptographic computation itself is not the limiting factor for many V2V settings. The difference between hardware platforms is consistent with CPU capability: the second hardware yields lower or comparable timings in most operations. Notably, Kyber-512 on Hardware 2 achieves a KeyGen time of only 39.66 µs and an Encap of 49 µs, which are well within the timing budgets of safety-critical V2V applications. Even at the highest security level (Kyber-1024), the total KEM cost (KeyGen + Encap + Decap) remains below 340 µs on Hardware 1 and below 336 µs on Hardware 2, confirming that Kyber introduces negligible cryptographic overhead relative to network-level delays. In V2X, the RSU acts like a trust center by generating a key pair. It then broadcasts its public key, then vehicles proceed with the encapsulation of ciphertext with the received public key. And concluding this KEM system, the RSU receives the ciphertext and would decapsulate, and both parties would have access to the secret. This one-to-many key establishment pattern is fundamentally different from V2V: a single RSU public key broadcast triggers a simultaneous encapsulation response from all vehicles in range, creating a synchronized transmission burst. As the number of vehicles in the network increases, the volume of transmitted packets also grows significantly. This leads to increased packet collisions at the MAC layer (e.g., under IEEE 802.11p), resulting in the loss of multiple ciphertext packets. This would happen because vehicles would send them simultaneously 15

Post-Quantum Cryptography in Automotive Context

after receiving the broadcast public key. It created bursts of transmissions and would flood the channel and because of that many handshakes wouldn’t be completed. To mitigate this issue, it was necessary to induce a random transmission interval before sending the ciphertexts, that way it lowered the probability of collisions. Before introducing the random interval, the handshake success rate was 23.07%, and with the 40% increase, the success rate rose to 63.07%. Many of the vehicles were unable to complete their handshake due to the simulation time. Initially, only 15 of the 65 vehicles were able to complete the handshake, and after introducing the random interval, the number of vehicles increased to 41. The latency considers the network, MAC, propagation and random backoff of the scenario, overall latency measured 11.04 s (Hardware 1) and 9.87 s (Hardware 2). This end-to-end latency is dominated by MAClayer dynamics rather than cryptographic computation, reinforcing that Kyber’s primitive cost is not the bottleneck in urban V2X deployments. Table 9: Kyber Urban Scenario Scheme

Key Gen (µs)

Encap (µs)

Decap (µs)

Kyber-512 Kyber-768 Kyber-1024

49.67 72.00 111.33

63.98 87.54 133.93

68.81 109.41 153.33

Kyber-512 Kyber-768 Kyber-1024

47.66 69.66 90.66

55.27 77.56 118.97

62.30 101.28 135.40

Comparing Tables 8 and 9, the urban scenario shows slightly higher primitive timings than the rural one, particularly for Encap and Decap. This is consistent with increased system load: the simulation host is simultaneously managing a larger number of vehicles, RSU logic, and network events, which introduces additional scheduling jitter. The increase is modest (typically 5–15% across parameter sets), confirming that Kyber’s computational cost scales gracefully with scenario complexity. Although Kyber computation remains microsecond-level, the urban scenario demonstrates that system-level feasibility also depends on how many devices attempt to complete the exchange concurrently. In a broadcast-triggered encapsulation wave, many vehicles may respond within the same MAC contention window, amplifying collisions and losses. This observation motivates future protocol design choices such as: (i) randomized response timing (as done here), (ii) scheduling policies, (iii) RSU-assisted coordination, or (iv) group-key strategies, depending on application and standards constraints.

4.3

Digital signatures: Dilithium vs Falcon under V2V/V2X

In the digital signature scenario, once the vehicle has an accident, it signs the message and broadcasts it to all vehicles and RSU present. Once the vehicles receive the message, they verified it, if it’s valid they change the lane to avoid the accident, on the other hand, they simply drop the message. As for the RSU, it proceeds with the same verification process, but if message is valid, it rebroadcasts it, to reach other vehicles that are further away. From a workload perspective, this pattern emphasizes verification: a single signature may be verified by many receivers, and the verification delay can affect how quickly vehicles can react. Therefore, while signing and key generation are important, verification cost is often the most critical metric for broadcast safety messaging. In a scenario with N vehicles and one RSU, a single signed alert message triggers up to N verification operations, making the aggregate verification cost proportional to the network size. This asymmetry between signing (one operation) and verification (many operations) is a key design consideration when selecting a signature scheme for V2X.

16

Post-Quantum Cryptography in Automotive Context

Table 10: Dilithium - Rural Scenario Scheme

Key Gen (µs)

Sign (µs)

Verify (µs)

Dilithium-44 Dilithium-65 Dilithium-87

122,33 221,56 316,56

306,33 367,67 554,33

124,90 200,61 318,85

Dilithium-44 Dilithium-65 Dilithium-87

122,22 167,11 250,11

274,33 284,67 498,67

111,74 178,22 275,80

Table 11: Falcon - Rural Scenario Scheme

Key Gen (µs)

Sign (µs)

Verify (µs)

Falcon-512 Falcon-1024

17533 41544,44

7186,33 13139

57,76 110,47

Falcon-512 Falcon-1024

14344,11 36992,44

3848,33 8308,33

48,28 94,80

Analyzing the rural scenario results for both schemes, a clear contrast emerges. Dilithium presents well-balanced timings across all three operations: KeyGen, Sign, and Verify all remain in the hundreds of microseconds range, with Dilithium-44 being the most efficient variant. Falcon, on the other hand, exhibits a strongly asymmetric profile: KeyGen and Sign are orders of magnitude slower than Dilithium (reaching tens of milliseconds), while Verify is dramatically faster, Falcon-512 achieves verification in only 57.76 µs on Hardware 1 and 48.28 µs on Hardware 2, compared to 124.90 µs and 111.74 µs for Dilithium-44 respectively. This represents a verification speedup of approximately 2× in favor of Falcon. The latency measured for Dilithium was 2.12 s, slightly slower than FALCON. FALCON demonstrates a relatively low overall latency of 2.08 s when accounting for signing, verification, MAC operations, and networking overhead. However, Dilithium is capable of performing more efficiently on the second hardware and outperforms FALCON with a latency of 2.0062 s, whereas FALCON has a latency of 2.0127 s. This inversion between hardware platforms is noteworthy: it suggests that Falcon’s Gaussian sampling-based signing is more sensitive to CPU micro architecture and memory bandwidth than Dilithium’s rejection-sampling approach, making hardware selection a relevant factor when deploying Falcon in embedded automotive systems. A key trade-off becomes evident: Falcon has much higher KeyGen and Sign times, but achieves faster verification than Dilithium. In V2X broadcast settings, this can be advantageous because verification is executed far more frequently than signing. Therefore, protocol designers may accept slower signing at the sender side if verification throughput at receivers improves and reduces message processing backlog. The entire Kyber process takes place before the accident occurs, that is, the network is free to carry out the entire encapsulation and decapsulation process. Therefore, we begin measuring latency when the vehicle receives the RSU’s public key and begins encapsulation, and it ends at the RSU when it completes decapsulation. This is in contrast to digital signature schemes, where latency measurement begins when the accident message is signed by the vehicle and ends when the RSU validates the message.

17

Post-Quantum Cryptography in Automotive Context

Figure 5: Comparison of both hardware on Rural scenario (V2V) When it comes to the automotive context, we must ensure that the schemes do not disturb the fundamental functionalities within a vehicle. As observed in the simulated scenario, every cryptographic function operates in the order of microseconds (or a few milliseconds for Falcon signing/keygen), which is a good sign for V2X feasibility at the primitive level. Kyber could be a good candidate to cooperate with Dilithium or FALCON, depending on whether the target application prioritizes simpler implementations and balanced costs (Dilithium) or faster verification in broadcast-heavy workloads (Falcon). Table 12: Dilithium - Urban Scenario Scheme

Key Gen (µs)

Sign (µs)

Verify (µs)

Dilithium-44 Dilithium-65 Dilithium-87

122,79 206,95 343,84

574,17 796,67 1394

137,38 198,91 345,39

Dilithium-44 Dilithium-65 Dilithium-87

108,70 180,67 277,30

345,83 768,20 1450

140,20 193,99 267,16

Table 13: Falcon - Urban Scenario Scheme

Key Gen (µs)

Sign (µs)

Verify (µs)

Falcon-512 Falcon-1024

17316,15 86291,81

4936,67 10849,83

69,49 110,55

Falcon-512 Falcon-1024

12083,80 38437,77

4086,5 8646,5

64,10 118,50

The urban scenario results reveal an important effect of increased network load on the wall-clock timings observed during simulation execution. In particular, Falcon-1024 KeyGen rises substantially from the rural to the urban scenario on Hardware 1, despite key generation being algorithmically scenario-independent. This difference is attributed to host-load contamination: OMNeT++, Veins, INET, SUMO, vehicle modules, RSU logic, and network events execute on a shared WSL2 host, where CPU scheduling, cache contention, and operating-system interference can affect wall-clock measurements. Cross-scenario primitive-level comparisons must therefore be interpreted cautiously. The urban scenario results reveal an important effect of increased network load on signing performance. Comparing Dilithium’s Sign times between rural (Table 10) and urban (Table 12) scenarios, a significant increase is observed: Dilithium-44 Sign rises from 306.33 µs to 574.17 µs on Hardware 1, and Dilithium-87 Sign reaches 1394 µs in the urban case. This degradation is attributable to the higher simulation load in the urban environment, where more concurrent events compete for CPU time. Falcon’s signing also increases in 18

Post-Quantum Cryptography in Automotive Context

the urban scenario, though its verification times remain consistently low and stable across both scenarios, further reinforcing its suitability for broadcast-heavy V2X workloads. But even though FALCON takes more time in generating keys and signing, its verification average always beats Dilithium. So creating a protocol with Kyber and FALCON would actually work very efficiently. Since the verification function is the more frequent operation during V2V and V2X communications, it would be reasonable to make the effort with FALCON: it only generates keys once, and although signing is more time-consuming, the verification time could be very beneficial especially in V2X scenarios. Comparing the two scenarios, V2X requires slightly more time than V2V because V2X has more identities interacting with each other, affecting the latency. In addition, higher density increases the probability that cryptographic processing and MAC contention overlap, creating queues and potentially delaying safety reactions if not engineered carefully.

Figure 6: Comparison of both hardwares on Urban scenario (V2X) As we observe in Figures 5 and 6, Hardware 2 (Table 3) delivers better performance in virtually all operations. This is consistent with the fact that the AMD Ryzen 5 5500U processor in Hardware 2 offers a more modern microarchitecture and higher memory bandwidth than the Intel i5-8400 in Hardware 1, resulting in lower execution times particularly for memory-intensive operations such as Falcon’s key generation and Dilithium’s signing. These hardware-dependent differences highlight the importance of evaluating PQC schemes across multiple platforms, as performance rankings between schemes can shift depending on the underlying processor.

5

Discussion and conclusions

This paper evaluated the performance of lattice-based PQC schemes: CRYSTALS-Kyber, CRYSTALSDilithium, and FALCON in V2X and V2V communication scenarios as developed in this paper. The analysis considered both rural (V2V) and urban (V2X) environments, with the aim of assessing performance under varying network conditions and levels of communication stress. The results indicate that Kyber is a strong candidate for integration into future protocols, due to its consistently favorable performance across both scenarios. Regarding digital signature schemes, Dilithium and FALCON exhibit distinct trade-offs, however both demonstrate characteristics that make them suitable for deployment in automotive communication systems. In particular, while FALCON achieves lower verification latency, Dilithium provides competitive performance with different design advantages. To mitigate latency and communication overhead, periodic packet transmission is identified as a potential optimization strategy, reducing channel contention among vehicles. The impact of PQC is more pronounced in V2X scenarios, largely due to the relative efficiency of key encapsulation mechanisms such as Kyber when compared to signature-based approaches. Overall, the evaluated schemes demonstrate comparative performance characteristics that can inform future V2V and V2X protocol design. The present findings do not provide an absolute PQC-versus-classical feasibility claim because no ECDSA/ECDH baseline was measured in the same OMNeT++/Veins/INET/WSL2 environment. 19

Post-Quantum Cryptography in Automotive Context

Additional limitations should be considered. First, primitive timings were collected as wall-clock measurements while the simulation stack executed on a shared host; therefore, scenario-to-scenario differences in primitive timings may include host-load contamination rather than intrinsic cryptographic variation. Second, the study does not model IEEE 1609.2 or ETSI TS 103 097 certificate chains, certificate digests, or pseudonym management, which are relevant contributors to practical V2X communication overhead. Third, CBR, standalone PDR, and MAC-layer collision probability require extraction from the final simulation logs. Finally, future work must include dedicated-core cryptographic benchmarks and ECDSA/ECDH measurements in the same simulation setup to establish a controlled conventional baseline. The main limitation of this paper is the use of a virtual simulation environment. Although the Veins framework enables the modeling of complex scenarios, it cannot fully capture real-world problems such as signal interference, unpredictable channel conditions, and hardware-specific constraints. Consequently, the results may not fully reflect performance in real deployment settings. A second limitation concerns the simplicity of the V2X scenario considered. The simulated environment includes only vehicles and a roadside unit (RSU), restricting communication patterns to V2V and V2I interactions. This abstraction does not account for more heterogeneous and large-scale V2X ecosystems, which may include additional infrastructure elements, pedestrians and network. This work only tested with lattice-based schemes due to their popularity among PQC schemes, because of their mathematical complexity can garantee security. But that leaves us with still multiple PQC schemes, like SPHINCS+ (Hash-based), HQC (Code-based) which is KEM whose security is based on the hardness of solving the Quasi-Cyclic Syndrome Decoding (QCSD) problem, Saber (Lattice-based) also a KEM that uses Learning with Rounding (LWR). Now is the time to start and experimenting like the authors of [10] which joined two schemes: Kyber and Saber to create a efficient protocol. Not only joining two PQC schemes but also creating hybrid protocols which can operate at all situations, following the author’s methodology in [24] in which they explain each step of implementing these PQC protocols in V2X environment. With the raise of Artificial Intelligence it is only natural to implement it in this context. Complementing the idea of analyzing and testing with every PQC scheme, AI-based adaptive security could monitor performance indicators and select cryptographic policies based on system conditions and compliance requirements [32, 33, 33]. Related directions include end-to-end simulation and predictive analysis frameworks for IoT/smart environments [32], blockchain-based authentication with post-quantum security [21], and AI-powered security classification in post-quantum lightweight settings [30]. Although these works do not directly target V2X, they support a broader trend toward adaptive, data-driven security mechanisms that can be relevant for future connected mobility systems. The study [5] in Related Work section only tests the S32G. The hardware mentioned is PQC-recommended by NPX, so it would be very compelling to analyze the results. On top of everything, we still have to deal with attacks of every kind, as reported in papers like [37] and [11] which alert about the efficiency of sidechannel attacks on schemes like Kyber, Saber, Dilithium, HQC, we need to be cautions by applying the appropriate countermeasures. Finally, this work produced a dataset [18] comprising key generation, encapsulation/decapsulation and signing/verification timings for each scheme. This dataset provides a foundation for future research, including the application of machine learning techniques to dynamically select the most appropriate cryptographic scheme based on system conditions. Other scenarios and techniques may also be included, as presented in the studies [22], [28], [35] and [39].

Acknowledgments This research was partially funded by national funds through the FCT - Foundation for Science and Technology, I.P. within the scope of projects UIDB/04466/2025 and UIDP/04466/2025. This research was also partially funded by national funds through the FCT - Foundation for Science and Technology, I.P. within the scope of project 16881, LISBOA2030-FEDER-00816400, with DOI: https://doi.org/10.54499/2023.16583.ICDT.

20

Post-Quantum Cryptography in Automotive Context

References [1] Maryam Abbasi, Filipe Cardoso, Paulo Vaz, Jose Silva, and Pedro Martins. A practical performance benchmark of post-quantum cryptography across heterogeneous computing environments. Cryptography, 9:32, 05 2025. doi: 10.3390/cryptography9020032. [2] Shimaa A. Abdel Hakeem and HyungWon Kim. PQ-V2X: A Novel Postquantum Cryptographic Dataset for Secure Vehicular Communications. IEEE Internet of Things Journal, 12(24):53704–53729, December 2025. ISSN 2327-4662, 2372-2541. doi: 10.1109/JIOT.2025.3618153. URL https://ieeexplore.iee e.org/document/11193862/. [3] Akid Abrar, Sagar Dasgupta, Mizanur Rahman, and Ahmad Alsharif. AI-Driven Post-Quantum Cryptography for Cyber-Resilient V2X Communication in Transportation Cyber-Physical Systems, 2025. URL https://arxiv.org/abs/2510.08496. Version Number: 1. [4] Ketut Bintoro. Overview of vehicle-to-everything communication: Technological advancements, applications, and future prospects in intelligent transportation systems. JISA(Jurnal Informatika dan Sains), 8:31–41, 06 2025. doi: 10.31326/jisa.v8i1.2187. [5] Joppe W. Bos, Alexander Dima, Alexander Kiening, and Joost Renes. Post-quantum secure over-theair update of automotive systems. Cryptology ePrint Archive, Paper 2023/965, 2023. URL https: //eprint.iacr.org/2023/965. [6] Arcangelo Castiglione and Teresa Elia. Securing in-vehicle communications through post-quantum cryptography and network segmentation. Computers and Electrical Engineering, 126:110488, August 2025. ISSN 00457906. doi: 10.1016/j.compeleceng.2025.110488. URL https://linkinghub.elsevie r.com/retrieve/pii/S0045790625004318. [7] Danish Quantum Community. Denmark to acquire the world´s most powerful quantum computer, 2025. [Online]: https://dqc.dk/denmark-to-acquire-the-worlds-most-powerful-quantum-computer/. [8] Mauro Conti, Francesco Marchiori, Sebastiano Matarazzo, and Marco Rubin. Pq-can: A framework for simulating post-quantum cryptography in embedded systems. In 2025 IEEE Symposium on Computers and Communications (ISCC), page 1–6. IEEE, 2025. doi: 10.1109/iscc65549.2025.11326414. URL http://dx.doi.org/10.1109/ISCC65549.2025.11326414. [9] Antonio Santos Da Silva, Kevin Herman Muraro Gularte, Giovanni Almeida Santos, Davi Salomão Soares Corrêa, Luís Felipe Oliveira De Melo, João Paulo Javidi Da Costa, José Alfredo Ruiz Vargas, Daniel Alves Da Silva, and Tai Fei. Evaluation of Jamming Attacks on NR-V2X Systems: Simulation and Experimental Perspectives, July 2025. URL https://www.preprints.org/manuscri pt/202507.0729/v1. [10] Yinfei Dai, Qi Wang, Xiao Song, and Shaoqiang Wang. A Lightweight Key Agreement Protocol for V2X Communications Based on Kyber and Saber. Sensors, 25(22):6938, November 2025. ISSN 1424-8220. doi: 10.3390/s25226938. URL https://www.mdpi.com/1424-8220/25/22/6938. [11] Kevin Delgado-Vargas, Cuauhtemoc Mancillas-López, and Gina Gallegos-García. A look at side channel attacks on post-quantum cryptography. Computación y Sistemas, 28, 12 2024. doi: 10.13053/cys-28-4 -5130. [12] Elif Demir, Idil Gorgulu, and M. Onbasli. Micro and transport layer security benchmarking of postquantum versus classical cryptography. IEEE Access, 14:56099–56111, 01 2026. doi: 10.1109/ACCESS .2026.3682760. [13] Elif Dicle Demir, Buse Bilgin, and Mehmet Cengiz Onbasli. Performance analysis and industry deployment of post-quantum cryptography algorithms, 2025. URL https://arxiv.org/abs/2503.12952. [14] Eslam Farsimadan, Leila Moradi, and Francesco Palmieri. A Review on Security Challenges in V2X Communications Technology for VANETs. IEEE Access, 13:31069–31094, 2025. ISSN 2169-3536. doi: 10.1109/ACCESS.2025.3541035. URL https://ieeexplore.ieee.org/document/10879476/. 21

Post-Quantum Cryptography in Automotive Context

[15] Tim Fritzmann, Jonas Vith, and Johanna Sepulveda. Strengthening Post-Quantum Security for Automotive Systems. In 2020 23rd Euromicro Conference on Digital System Design (DSD), pages 570–576, Kranj, Slovenia, August 2020. IEEE. ISBN 978-1-7281-9535-3. doi: 10.1109/DSD51259.2020.00094. URL https://ieeexplore.ieee.org/document/9217638/. [16] Tim Fritzmann, Jonas Vith, Daniel Flórez, and Johanna Sepúlveda. Post-quantum cryptography for automotive systems. Microprocessors and Microsystems, 87:104379, November 2021. ISSN 01419331. doi: 10.1016/j.micpro.2021.104379. URL https://linkinghub.elsevier.com/retrieve/pii/S0141 933121005299. [17] U. Ghosh, L. Njilla, D. Das, and E. Levin. FLAS: A federated learning framework for adaptive security in edge-driven UAV networks. In ICC 2024 - IEEE International Conference on Communications, pages 1298–1303, 2024. doi: 10.1109/ICC51166.2024.10622352. [18] Mariana Gonçalves and Valderi Leithardt. Post-quantum cryptography in automotive scenarios (v2x and v2v), 2026. URL https://data.mendeley.com/datasets/czx6vk5hsr/1. [19] Seyed MohammadReza Hosseini and Hossein Pilaram. A comprehensive review of post-quantum cryptography: Challenges and advances. Cryptology ePrint Archive, Paper 2024/1940, 2024. URL https://eprint.iacr.org/2024/1940. [20] Matthias J. Kannwischer, Peter Schwabe, Douglas Stebila, and Thom Wiggers. Improving software quality in cryptography standardization projects. In IEEE European Symposium on Security and Privacy, EuroS&P 2022 - Workshops, Genoa, Italy, June 6-10, 2022, pages 19–30, Los Alamitos, CA, USA, 2022. IEEE Computer Society. doi: 10.1109/EuroSPW55150.2022.00010. URL https://eprint.iacr.org/2022/337. [21] R. Latif, B. M. Yakubu, N. S. M. Jamail, et al. Bbas: A blockchain-based authentication system for e-health with multi-factor authentication, access control, and post-quantum security. Scientific Reports, 2026. doi: 10.1038/s41598-026-39415-5. [22] Valderi Leithardt, Douglas Santos, Luis Silva, Felipe Viel, Cesar Zeferino, and Jorge Silva. A solution for dynamic management of user profiles in iot environments. IEEE Latin America Transactions, 18 (07):1193–1199, 2020. doi: 10.1109/TLA.2020.9099759. [23] Nils Lohmiller, Sabrina Kaniewski, Michael Menth, and Tobias Heer. A survey of post-quantum cryptography migration in vehicles. IEEE Access, 13:10160–10176, 2025. doi: 10.1109/ACCESS.2025.3528562. [24] Ge Luo and Jianxin Liu. Post-quantum cryptography challenges in connected vehicles with v2x. In Proceedings of the 2024 3rd International Conference on Cryptography, Network Security and Communication Technology, CNSCT ’24, page 205–208, New York, NY, USA, 2024. Association for Computing Machinery. ISBN 9798400716959. doi: 10.1145/3673277.3673313. URL https: //doi.org/10.1145/3673277.3673313. [25] Abdullah Al Mamun, Akid Abrar, Mizanur Rahman, M. Sabbir Salek, and Mashrur Chowdhury. PostQuantum Cryptography for Intelligent Transportation Systems: An Implementation-Focused Review, January 2026. URL http://arxiv.org/abs/2601.01068. arXiv:2601.01068 [cs]. [26] Michele La Manna, Pericle Perazzo, Luigi Treccozzi, and Gianluca Dini. Assessing the cost of quantum security for automotive over-the-air updates, 2021. URL https://ieeexplore.ieee.org/document/9 631426. Accessed: 14 January 2026. [27] Erin Manson and Ryan Mood. Elliptic Curve Cryptography in Vehicle Security, January 2025. URL https://www.techrxiv.org/users/876135/articles/1255855-elliptic-curve-cryptography-i n-vehicle-security?commit=e6288063439aeed5c7162fdef5e469ffa20662c7. [28] Sérgio Mendonça, Valderi R. Q. Leithardt, and Paul A. Crocker. Data privacy and security in the quantum era: A comparative evaluation between classical and post-quantum cryptography. In 2026 International Symposium on Networks, Computers and Communications (ISNCC), pages 1–6, 2026. doi: 10.1109/ISNCC70543.2026.11693868. 22

Post-Quantum Cryptography in Automotive Context

[29] Mohamed Saied Mohamed, Julie Godard, Victor Jimenez, Adrien Jousse, Pau Perea Paños, and Miao Zhang. Post-quantum Cryptography for Connected and Cooperative Automated Mobility: A Comprehensive Overview. In Ciaran McNally, Páraic Carroll, Beatriz Martinez-Pastor, Bidisha Ghosh, Marina Efthymiou, and Nikolaos Valantasis-Kanellos, editors, Transport Transitions: Advancing Sustainable and Inclusive Mobility, pages 738–744. Springer Nature Switzerland, Cham, 2026. ISBN 978-3-032-06762-3 978-3-032-06763-0. doi: 10.1007/978- 3- 032- 06763- 0\_105. URL https: //link.springer.com/10.1007/978-3-032-06763-0_105. Series Title: Lecture Notes in Mobility. [30] S. Mumtaz, N. Sanam, and F. Mumtaz. Ai-powered security classification of generator-matrix s-box for post-quantum lightweight cryptography. Telecommunication Systems, 89:20, 2026. doi: 10.1007/s11235 -025-01395-8. [31] NIST. Post-quantum cryptography, 2022. [Online]: https://csrc.nist.gov/projects/post-quant um-cryptography/post-quantum-cryptography-standardization/selected-algorithms. [32] D. Noetzold, J. L. V. Barbosa, J. F. De Paz, and V. R. Q. Leithardt. Reinforcement learning-based adaptive quantum-safe cryptography for DN25-compliant smart environments. IEEE Access, 14:62087– 62104, 2026. doi: 10.1109/ACCESS.2026.3685890. [33] D. Noetzold, V. R. Q. Leithardt, J. F. de Paz Santana, and J. L. V. Barbosa. Oraculum: A model for self-adaptive system optimization in smart environments. Expert Systems with Applications, page 131705, 2026. doi: 10.1016/j.eswa.2026.131705. [34] Darlan Noetzold and Valderi Leithardt. Fundamentals, recent advances, and challenges regarding cryptographic algorithms for the quantum computing era, 01 2026. [35] Darlan Noetzold, Valderi R. Q. Leithardt, Juan Francisco De Paz, and Jorge L. V. Barbosa. Ontoraculum: a semantic ontology for managing performance metrics in smart environments. PeerJ Computer Science, 12:e4078, October 2026. ISSN 2376-5992. doi: 10.7717/peerj- cs.4078. URL https://doi.org/10.7717/peerj-cs.4078. [36] National Institute of Standards and Technology. Nist releases first 3 finalized post-quantum encryption standards, 2024. URL https://www.nist.gov/news-events/news/2024/08/nist-releases-first -3-finalized-post-quantum-encryption-standards. [Online]. Accessed: September 2026. [37] Abiodun Olaluwe, Nouf Nur Nabilah, Sheikh Tareq, Akshay Raghavendra Kulkarni, and Annamalai Annamalai. Machine learning and side-channel attacks on post-quantum cryptography. Cryptology ePrint Archive, Paper 2025/1754, 2025. Available in: https://eprint.iacr.org/2025/1754. Accessed: June 2026. [38] Aaron Rathweg, Abdelrahman Osman, Andreas Fleig, Efstathia Katsigianni, and Alexander Tschache. Impacts of post-quantum cryptography on automotive security: A case study, 2024. URL https: //d-nb.info/1316435830/34. Accessed: 12 November 2025. [39] Dinis Santos, Joao Cabacinho, Joao Casaleiro, Valderi R.Q. Leithardt, and Luis Bica Oliveira. Aes hardware architectures and non-standard rijndael extensions up to 1024-bit keys: An open-source fpga and 45-nm asic evaluation. Journal of Systems Architecture, 181:104028, 2026. ISSN 1383-7621. doi: https://doi.org/10.1016/j.sysarc.2026.104028. URL https://www.sciencedirect.com/science/arti cle/pii/S1383762126003462. [40] Humza Sohail, Darlan Noetzold, and Valderi Reis Quietinho Leithardt. Prisec iii: Dynamic cryptographic adaptation for balancing performance and security. Journal of Internet Services and Applications, 17(1):174–191, May 2026. doi: 10.5753/jisa.2026.6502. URL https://journals-sol.sbc.org .br/index.php/jisa/article/view/6502. [41] M. Swayne. Quantum computing roadmaps & predictions of leading players, 2025. [Online]: https: //thequantuminsider.com/2025/05/16/quantum-computing-roadmaps-a-look-at-the-maps-and -predictions-of-major-quantum-players/. 23

Post-Quantum Cryptography in Automotive Context

[42] Geoff Twardokus, Nina Bindel, Hanif Rahbari, and Sarah McCarthy. When Cryptography Needs a Hand: Practical Post-Quantum Authentication for V2V Communications. In Proceedings 2024 Network and Distributed System Security Symposium, San Diego, CA, USA, 2024. Internet Society. ISBN 978-1891562-93-8. doi: 10.14722/ndss.2024.24267. URL https://www.ndss-symposium.org/wp-content/u ploads/2024-267-paper.pdf. [43] Francisca Vasconcelos. Quantum Computing @ MIT: The Past, Present, and Future of the Second Revolution in Computing, February 2020. arXiv:2002.05559 [physics.pop-ph]. [44] Wen Wang and Marc Stöttinger. Post-quantum secure architectures for automotive hardware secure modules. Cryptology ePrint Archive, Paper 2020/026, 2020. Available in: https://eprint.iacr.or g/2020/026. Accessed: June 2026. [45] Takahito Yoshizawa, Dave Singelée, Jan Tobias Muehlberg, Stephane Delbruel, Amir Taherkordi, Danny Hughes, and Bart Preneel. A Survey of Security and Privacy Issues in V2X Communication Systems. ACM Computing Surveys, 55(9):1–36, September 2023. ISSN 0360-0300, 1557-7341. doi: 10.1145/3558 052. URL https://dl.acm.org/doi/10.1145/3558052. [46] S. Zoting. Automotive pqc market driven by rising cybersecurity threats and quantum-safe certification, 2025. [Online]: https://www.precedenceresearch.com/automotive-pqc-market. [47] Zuzana Špitálová. Vehicle-to-everything communication. Communications - Scientific letters of the University of Zilina, 25:C24–C35, 01 2023. doi: 10.26552/com.C.2023.017.

24

Related documents

• The use of post-quantum cryptography in the automotive context#1489702
• Cybersecurity in the Era of Quantum Computing: Risks and Mitigation Techniques#110846
• Frequency-matching quantum key distribution#1456127
• Encryption using KEA and SKIPJACK#139454
• Leveraging kleptography to strengthen post-quantum cryptography#397221