Lattice-based schemes like Kyber (standardized as ML-KEM) offer strong post-quantum security guarantees, but they come with larger key and ciphertext sizes than the RSA and ECC schemes they're replacing. For legacy hardware with tight memory and bandwidth constraints, this is a real engineering problem, not just a theoretical one.
The Core Tradeoff
Kyber's security rests on the hardness of the Module Learning With Errors (MLWE) problem. This gives strong theoretical guarantees against quantum attacks, but the larger key sizes mean protocol overhead increases — particularly noticeable in embedded and IoT contexts.
Where Teams Are Getting Stuck
- TLS handshake size increases can trip up middleboxes and legacy load balancers that assume smaller packet sizes.
- Embedded devices with limited RAM struggle to hold Kyber's larger key material alongside existing firmware.
- HSM vendors are still rolling out hardware-accelerated Kyber support, leaving many deployments running it in software for now.
None of these are blockers — they're solvable engineering problems — but they do mean migration timelines should account for hardware refresh cycles, not just software updates.