Study Finds Minimal Latency Overhead for Post‑Quantum IPsec in 5G O‑RAN Deployments

Global: Study Finds Minimal Latency Overhead for Post‑Quantum IPsec in 5G O‑RAN Deployments

Researchers evaluating quantum‑safe security for open radio access networks reported that integrating a NIST‑aligned module‑lattice key‑encapsulation mechanism (ML‑KEM, CRYSTALS‑Kyber) into IKEv2/IPsec adds only a modest delay to tunnel establishment on the critical E2 interface between 5G gNBs and Near‑Real‑Time RAN Intelligent Controllers. The experimental work, conducted on an open‑source testbed, measured an overhead of roughly 3–5 ms compared with classical elliptic‑curve Diffie‑Hellman (ECDH) IPsec, while maintaining stable operation of xApps running on the RIC.

Background and Motivation

As O‑RAN deployments expand, operators face growing concerns about future quantum attacks and the need to transition control‑plane communications to post‑quantum cryptography (PQC). Adversaries are increasingly adopting “store‑now, decrypt‑later” tactics, prompting a demand for empirical data on the performance impact of PQC migration.

Testbed Architecture

The study employed a composite platform built from srsRAN, Open5GS, FlexRIC, and strongSwan enhanced with the liboqs library. This configuration allowed the team to emulate realistic signaling workloads while swapping cryptographic modules within the IPsec tunnel.

Experimental Configurations

Three scenarios were compared: (1) unencrypted traffic without IPsec, (2) conventional IPsec using ECDH for key exchange, and (3) IPsec employing ML‑KEM for key exchange. Automated runs were repeated to capture consistent latency measurements and to observe the behavior of Near‑RT RIC xApps under each condition.

Key Findings

Latency analysis showed that the ML‑KEM‑based IPsec tunnel required an additional 3–5 ms to establish compared with the classical ECDH approach. Despite this slight increase, the overall runtime of xApps and the control loops within the RIC remained stable, indicating that the post‑quantum solution does not disrupt real‑time network functions.

Implications for Deployment

The results suggest that adopting ML‑KEM for securing the E2 interface is practically feasible, offering a pathway for operators to implement quantum‑resistant security without compromising performance. The modest overhead aligns with the latency budgets typical of 5G control‑plane operations.

Future Directions

Further research is recommended to assess long‑term reliability, scalability across larger network topologies, and the impact of alternative PQC algorithms. Such studies will help refine migration strategies as the telecommunications industry prepares for the post‑quantum era.

This report is based on information from arXiv, licensed under Academic Preprint / Open Access. Based on the abstract of the research paper. Full text available via ArXiv.