Post-quantum encryption raises message size challenges for smart home devices
Post-Quantum Session Establishment for Matter over Thread: Message Size, Transport, and Protocol Options
Cryptography and SecurityNetworking and Internet Architecture
Summary
Quantum computers could someday break current secure connections in smart home devices, so the authors look at how to upgrade these connections using new quantum-resistant encryption. They find that fully quantum-secure methods make the messages much bigger, causing delays and failures in typical home wireless networks. By testing different options, they suggest combining classical and quantum methods and caching some data to keep messages smaller and connections fast. This work helps move smart home security toward being safe even against future quantum attacks.
What this means in practice
- •For home automation developers: Design secure device handshakes for Matter over Thread networks that anticipate quantum computer threats while respecting wireless message size limits.
- •For wireless protocol engineers: Optimize fragmentation and retransmission timers in wireless mesh networks to reduce failures in large post-quantum security handshake messages.
Authors
Daniel Commey
Abstract
Matter's first post-quantum change protects device attestation with ML-DSA, but its operational handshake, CASE, still derives session keys from P-256 ECDH, so recorded traffic can be decrypted once a quantum computer exists. We quantify the cost of moving CASE to ML-KEM and post-quantum signatures over Thread, where frames carry at most 127 bytes and a Matter message at most 1178 bytes. A byte-exact model of the CASE messages shows that a drop-in ML-KEM-768/ML-DSA-44 handshake grows from 1.6 kB to 22.8 kB and that no fully post-quantum configuration built from FIPS 203/204/205 algorithms fits the message limit. A Monte Carlo model of multi-hop Thread, calibrated to OpenThread and Matter source constants, shows that sending these messages as fragmented IPv6 datagrams causes spurious retransmissions whenever a message and its reply outlast Matter's retransmission timer. At three to four hops the drop-in handshake then takes 1.8 to 2.6 times longer than with a selective-repeat block transfer, with or without interference, and up to 33% of handshakes with sleepy devices fail; raising the timers does not remove the effect. Caching certificate chains and authenticating the device with a pre-distributed ML-KEM key reduce the handshake to 6.1 kB and 44 ms of device computation. As a first step, hybrid P-256+ML-KEM-512 key exchange with a cached device chain protects session keys against harvest-now, decrypt-later attacks while every message still fits the current limit.