OpenVPN with Hybrid Post-Quantum Cryptography on Constrained Devices

Nowadays, Quantum computing presents a greater threat to classical cryptography, pushing towards the need for post-quantum cryptographic (PQC) solutions. This study assesses the performance of hybrid (classical and PQC) and pure PQC algorithms-specifically ML-KEM (Kyber) and MLDSA (Dilithium)-in VPN deployments on resource-constrained devices. Benchmarks across NIST security levels 1, 3, and 5 assess per-phase cryptographic runtime (key generation, encapsulation/decapsulation, signing/verification), connectionestablishment latency under network impairments, and bandwidth during sustained transfer. Results show pure PQC algorithms offer superior computational runtime, while hybrid approaches provide dual-algorithm assurance and comparable steady-state bandwidth once tunnels are established. We report wall-clock runtime on the stated platform and refrain from energy or peak-memory claims; platform-specific energy/memory profiling is deferred to future work. We provide artifacts and methodology to enable reproduction.