Post-Quantum Session Establishment for Matter over Thread: Message Size, Transport, and Protocol Options
Drop-in post-quantum CASE for Matter over Thread exceeds the 1178-byte limit and slows handshakes.
Matter already uses ML-DSA for attestation, but its CASE handshake still derives keys with P-256 ECDH, leaving recorded sessions exposed to a future quantum computer. A byte-exact model shows ML-KEM-768/ML-DSA-44 grows the handshake from 1.6 kB to 22.8 kB, and no FIPS 203/204/205 configuration fits Matter's 1178-byte message limit on Thread. Fragmented multi-hop delivery triggers spurious retransmissions: at three to four hops the drop-in handshake takes 1.8–2.6 times longer, and up to 33% of sleepy-device handshakes fail. Caching certificate chains and using hybrid P-256+ML-KEM-512 keeps messages within today's limit while protecting session keys against harvest-now, decrypt-later attacks; a cached pre-distributed ML-KEM key reduces the handshake to 6.1 kB and 44 ms of device computation.
- ML-KEM-768 with ML-DSA-44 grows CASE from 1.6 kB to 22.8 kB.
- No full FIPS 203, 204, or 205 setup fits the 1178-byte limit.
- At three to four hops, drop-in handshake is 1.8 to 2.6 times slower.
- Up to 33 percent of sleepy-device handshakes fail from fragmentation.
- Hybrid P-256 plus ML-KEM-512 still fits and resists later decryption.
From the original article
1 min read at arxiv.orgMatter's first post-quantum change protects device attestation with ML-DSA, but its operational handshake, CASE, still derives session keys from P-256 ECDH, so recorded traffic can be decrypted once a quantum computer exists. We quantify the cost of moving CASE to ML-KEM and post-quantum signatures over Thread, where frames carry at most 127 bytes and a Matter message at most 1178 bytes.
By Daniel Commey · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.