Paper 2026/1414 Original: eprint.iacr.org/2026/1414 ↗

Evaluating Hybrid KEM/DSA for KpqC and NIST PQC on ARM Cortex-M4

Abstract

Primitive-only PQC benchmarks are insufficient for attributing composed hybrid costs on Cortex-M4 because shared hash backends, randomized-signature behavior, and fixed classical/wrapper work affect measured performance. We implement a common bare-metal Cortex-M4 harness for representative KpqC/NIST families, measuring uniform Hash-CT hybrid KEM benchmark rows with X25519 and Bindel et al. hybrid-signature AND-combiner rows. The goal is composed-cost attribution under a uniform benchmark transcript rather than primitive-only ranking. Our measurements show three attribution effects. First, replacing only Keccak-f[1600] changes SHAKE-heavy signing by up to 2.16×, while SPHINCS⁺-SHA2 and FN-DSA control rows remain at 1.00×. Second, median-only signature tables can change deployment conclusions. In the nominal level-5 signing rows, HAETAE5 beats FN-DSA-1024 by median and mean latency, but its observed maximum reaches 4.53× its median while FN-DSA-1024 remains essentially flat. Third, a local SMAUG-T backend improves standalone SMAUG-T by 1.79–1.82×, but the visible gain drops to 1.42–1.65× inside SMAUG-T+X25519 hybrids. Supporting KEM rows place lattice hybrids at 3.7–8.8 M cycles and HQC hybrids at 19.6–74.5 M cycles. Together, the results motivate reporting composed-cost attribution, backend provenance, and variance alongside primitive timings.