[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2025-11-26)

["Bellebaum, Thomas" <[e-mail]>]

On Wed, 2025-11-26 at 12:35 +0000, D. J. Bernstein wrote:
> "Sending an 800-byte key and receiving a 768-byte ciphertext  
> for the smallest Kyber option, Kyber-512, costs roughly 2^-29 dollars.  
> Including X25519 adds roughly 7% to that."

While I think that costs from any reasonable (even quite low) rate of ML-KEM implementation failures will by far outweigh this,
I have a question about that 2^-29 number...

According to your blog post, this is roughly 2^-40 $/Byte * 2^11 Byte.
The 2^-40 $/Byte number then comes from section 3.2 of your 2024 paper (https://cr.yp.to/papers/pppqefs-20240327.pdf) in which you start from energy costs of 0.06 kWh/GByte * 0.1 $/kWh = 0.006 $/GByte in 2018, and halve that for each of three 2-year periods since. This seems to work out.

Now, the energy decay rate and energy per kWh in 2018 are attributed to https://onlinelibrary.wiley.com/doi/10.1111/jiec.12630 .
However, even just reading the summary, the main claim there is 0.06 kWh/GB for **2015** (the page also says "First published: 01 August 2017"). If we account for the five 2-year periods since 2015, the numbers from your blog overcount communication energy costs by a factor of roughly four when applied to 2025, turning the 7% into roughly 14%. [1]

If I misunderstood your calculation, can you please point me at the step I was missing?

Thanks in advance,

-- TBB

[1] For X25519, the other considered factor was CPU cycles. The cost per cycle in section 4.2 of your paper was estimated by looking at data from 2024, so unless there was a dramatic shift in the past year this number should be unaffected.