Post-Quantum Security Has to Survive the Radio
A tracking tag wakes on a remote container, finds a narrow radio channel and begins to authenticate. Every transmitted bit draws from a coin-cell battery. Every lost packet consumes part of a short contact window. By the time the cryptographic handshake ends, the satellite may have moved, the gateway may have changed or the device may have spent more energy proving its identity than reporting the temperature of the cargo.
Cryptography often appears in policy as mathematics with no mass. Radio systems correct that illusion. Keys become bytes, bytes become packets, packets become airtime, and airtime becomes energy. A July 25 preprint from Elliot Eichen, Sylvia Llosa, Yueqi Chen and Sangtae Ha at the University of Colorado Boulder asks what happens when post-quantum authentication enters networks that cannot treat bandwidth and power as abundant. Its answer is uncomfortable: post-quantum authentication has a physical cost.
A certificate becomes a packet train
The preprint compares classical elliptic-curve authentication, certificate-based post-quantum authentication and a proposed shared-secret design. Its model uses an NB-IoT connection with 200-byte packets, including 80 bytes of overhead, at 20 kilobits per second. The device is a Cortex-M33-based system-on-chip running at 133 MHz. Energy calculations use a CR2032 battery model and account for weak-signal radio retransmission.
Under those assumptions, the paper pairs ML-DSA-44 authentication with ML-KEM-512 key establishment for its security Category 1 post-quantum case. The cryptographic payload is 5,300 bytes. The authors estimate 46 NB-IoT packets before real-world radio effects and 334 after incorporating transport inefficiency and retransmission. Transmission and reception consume an estimated 10,688 millijoules. The handshake uses 32 to 80 kilobytes of cryptographic RAM and 55 milliseconds of device compute time.
The authors’ alternative uses pre-shared-key authentication with ephemeral ML-KEM-512. Its modeled payload is 1,568 bytes, producing 14 base packets and 112 real-world packets. Estimated radio energy falls to 3,584 millijoules, RAM to 16 to 40 kilobytes and compute time to eight milliseconds. The paper summarizes the comparison as roughly 70 percent less bandwidth, half the RAM, one-third the handshake energy and one-tenth the compute time.
Practical takeaway. A migration plan for satellites, IoT and embedded devices needs a radio-and-power profile alongside its algorithm inventory. Packet count, loss behavior, memory and key-distribution architecture can decide whether authentication completes.
The radio turns overhead into failure
The satellite example gives the model its sharpest result. The paper assumes a 10 percent chance of losing any packet, independently, on an NTN NB-IoT link. With 46 packets in the certificate-based security Category 1 exchange, the modeled chance of completing one attempt is 0.8 percent. With 14 packets in the shared-secret exchange, it is 23 percent. Under a restart-after-loss assumption, the expected number of attempts falls from about 125 to five. Completion time falls from roughly six minutes to seven seconds.
These figures are model outputs. Bursty loss, link adaptation and protocol recovery can move them in either direction. The authors say their first-order calculation may overestimate success when fading is correlated and may underestimate it when implementations recover without restarting the whole exchange. The numerical result therefore deserves testing on real hardware and real links.
The mechanism is sound enough to matter now. More packets create more opportunities for loss. Longer exchanges face more beam handoffs, periods of intermittent visibility and satellite movement. Packet count becomes part of the security property when a failed handshake leaves a device unauthenticated or forces it to fall back.
Shared secrets shift the burden
The proposed architecture avoids post-quantum signature certificates at the endpoint. A 5G or 6G shared-secret ecosystem supplies the initial trust relationship. A Kerberos-style key distribution center supports scalable mutual authentication. The endpoint and application server then use a DTLS 1.3 pre-shared-key handshake with ephemeral ML-KEM for post-quantum key establishment and forward secrecy.
This approach draws on infrastructure that already stores long-term secrets in SIMs, integrated SIMs and network databases. It also changes the concentration of responsibility. Enrollment must be dependable. Secrets need protection across their lifecycle. The key distribution center becomes critical infrastructure, and its availability matters to every device that depends on it. A certificate-heavy design distributes some trust into public-key infrastructure; the proposed route relies more heavily on controlled secret distribution.
That is a governance choice as well as an engineering one. A procurement team can specify NIST FIPS 203 and still leave the trust architecture unsettled. Operators need to know who provisions the initial secret, who can rotate it, how roaming works, what happens when the distribution service is unavailable and which parties can recover from a compromise. Key management moves to the center of the migration.
The smallest devices carry the largest constraint
The paper’s use cases include supply-chain tags, UAV command-and-control systems, embedded medical sensors and non-terrestrial key-management services. These are very different systems, yet each lives with a tight physical budget. A tracking tag may need years from a coin cell. An implanted monitor cannot invite frequent charging because heat and surgery matter. A satellite terminal has contact windows and handovers. A fielded UAV cannot spend an open-ended interval authenticating during a contested operation.
The human stakes are clearest in medicine. A sensor under the skin may monitor heart rhythm, glucose or drug delivery. Stronger cryptography protects intimate data and device control over a long service life. The battery and radio are also part of safety. A protocol that exhausts the device before it serves the patient has failed its mission.
There is a civic dimension too. Constrained links often serve places and people at the edge of richer infrastructure: remote clinics, rural logistics, emergency systems and field workers. A uniform security baseline can improve trust, but a baseline written around data-center resources can also make small endpoints impractical. Security policy needs enough engineering detail to avoid turning protection into exclusion.
How Quentir Reads It
Quentir has previously asked which part of a network is actually quantum-resilient. This preprint adds a material answer. The standardized primitive can be sound while authentication remains unreliable because the certificate chain, radio protocol and device budget were treated as separate concerns.
The strategic implication is a shift from algorithm lists toward operating profiles. A satellite profile, medical-device profile or asset-tracking profile may use the same NIST primitive and still require different authentication, loss, memory and lifecycle choices. Migration deadlines need deployment profiles that make those constraints visible before contracts freeze the architecture.
Quentir’s Signature Brief adds fixed scope, an executive summary, a checklist, refresh triggers, a dated source spine and an internal-use license for a bounded decision. This public post stays with one preprint’s model and the institutional question it opens; it does not provide a complete PQC migration sequence.
A correct standard can still miss the device
The paper is an early proposal, not a field-validated verdict. Its shared-secret architecture carries serious dependencies, and its radio model needs independent testing across devices, networks and loss conditions. Those limits do not erase its central contribution. They locate the work that standardized algorithms leave unfinished.
Over the next migration cycle, the hardest exceptions may come from machines with the least room to negotiate: sensors in bodies, tags in cargo, radios under weak coverage and terminals that see a satellite for minutes. Their constraint is measurable. If security requirements ignore it, operators will seek waivers, postpone migration or deploy brittle workarounds. The radio will expose every gap between cryptographic policy and operating reality.
Sources: Elliot Eichen, Sylvia Llosa, Yueqi Chen and Sangtae Ha, “Practical Post-Quantum Cryptography for Bandwidth Constrained or Non-Terrestrial Networks, and Power Constrained Devices”, arXiv:2607.23007v1 (submitted July 25, 2026); National Institute of Standards and Technology, FIPS 203, “Module-Lattice-Based Key-Encapsulation Mechanism Standard” (August 13, 2024); Internet Engineering Task Force, RFC 9147, “The Datagram Transport Layer Security (DTLS) Protocol Version 1.3” (April 2022). Public-source snapshot: July 28, 2026.
Published intelligence, built to inform your own decisions. Published: July 28, 2026.