{
  "headline": "the PQC hybrid handshake adds ~2272 bytes of key-exchange material on the wire for ML-KEM-768 (1184 B encaps-key + 1088 B ciphertext) and ~3136 bytes for ML-KEM-1024 \u2014 protocol-independent (it is ML-KEM's key/ciphertext size), so the per-protocol on-air tax is essentially constant.",
  "honest_scope": "counts the KE-material bytes (ML-KEM encaps-key + ciphertext + classical shares); other handshake fields are unchanged and not counted. Real liboqs sizes (or identical FIPS-203 constants). A one-time per-handshake cost, not per-packet. No legal/FTO/price conclusion.",
  "mlkem_sizes": {
    "ML-KEM-1024": {
      "ciphertext": 1568,
      "public_key": 1568
    },
    "ML-KEM-768": {
      "ciphertext": 1088,
      "public_key": 1184
    }
  },
  "module": "pqc_handshake_onair_overhead",
  "protocols": [
    {
      "classical": 64,
      "hybrid": 2336,
      "hybrid_over_classical_x": 36.5,
      "kem": "ML-KEM-768",
      "note": "ClientHello key_share carries X25519 pub + ML-KEM encaps-key; ServerHello carries X25519 pub + ML-KEM ct",
      "pqc_tax_bytes": 2272,
      "protocol": "TLS 1.3 (X25519MLKEM768)",
      "trad": "X25519"
    },
    {
      "classical": 64,
      "hybrid": 2336,
      "hybrid_over_classical_x": 36.5,
      "kem": "ML-KEM-768",
      "note": "client KEXECINIT carries X25519 pub + ML-KEM encaps-key; server reply carries X25519 pub + ML-KEM ct",
      "pqc_tax_bytes": 2272,
      "protocol": "SSH (mlkem768x25519)",
      "trad": "X25519"
    },
    {
      "classical": 64,
      "hybrid": 2336,
      "hybrid_over_classical_x": 36.5,
      "kem": "ML-KEM-768",
      "note": "the additional-KE payloads (IKE_INTERMEDIATE) carry the ML-KEM encaps-key + ciphertext",
      "pqc_tax_bytes": 2272,
      "protocol": "IKEv2 (RFC 9370, ML-KEM-768+X25519)",
      "trad": "X25519"
    },
    {
      "classical": 64,
      "hybrid": 2336,
      "hybrid_over_classical_x": 36.5,
      "kem": "ML-KEM-768",
      "note": "the SAE/association exchange carries the ML-KEM encaps-key + ciphertext alongside the classical group",
      "pqc_tax_bytes": 2272,
      "protocol": "Wi-Fi PQC-SAE (WPA3, ML-KEM-768, ON-DOMAIN)",
      "trad": "X25519"
    },
    {
      "classical": 112,
      "hybrid": 3248,
      "hybrid_over_classical_x": 29.0,
      "kem": "ML-KEM-1024",
      "note": "PKESK carries the ML-KEM-1024 ciphertext; the recipient key carries the encaps-key",
      "pqc_tax_bytes": 3136,
      "protocol": "OpenPGP code point 36 (ML-KEM-1024+X448)",
      "trad": "X448"
    }
  ],
  "real_liboqs_sizes": true,
  "sprint": 140,
  "status": "performance/bandwidth data for the deployed PQC hybrids. No legal/novelty/FTO/price conclusion."
}