Looma: A Low-Latency PQTLS Authentication Architecture for Cloud Applications

Looma: A Low-Latency PQTLS Authentication Architecture for Cloud Applications

Speakers: Xinshu Ma

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=R0sk7R0UCM0

Overview

Cloud applications built from microservices create many internal network connections, each requiring mutual TLS (mTLS) authentication. As the industry transitions to post-quantum cryptography, the heavier signing operations of post-quantum algorithms (2.5x-9x slower than ECDSA) amplify the handshake cost, creating a significant latency bottleneck for cloud workloads. This talk presents Looma, an architecture that reduces post-quantum mTLS handshake latency by 34% at P50 and 48% at P99 compared to Dilithium-2 (the fastest PQ signature algorithm) by splitting authentication into offline precomputation and fast online operations using an online/offline signature paradigm. Online signing completes in under 1 microsecond and verification in under 7 microseconds. The approach is general, applying to different PQ signature schemes and TLS-like protocols including QUIC and PSP, and will be presented at the IETF CFRG session.

Background

▶ Watch: Microservice architecture: one click, five services, five TLS handshakes (1:00)

Modern cloud applications decompose into microservices, each with its own IP address. A single user click can trigger multiple internal service-to-service connections. These connections require mTLS (both parties authenticate), creating handshake overhead at every hop. In data centers where round-trip times are 10-15 microseconds (vs. 10ms on the internet), cryptographic computation dominates handshake cost. Post-quantum signatures like Dilithium-2 (2.5x slower signing) and Falcon (9x slower) amplify this further. Existing acceleration approaches target hardware offloading (helps throughput, not latency), round-trip reduction (helps internet, not data center where crypto dominates), or faster key exchange (doesn't address authentication).

Key Findings

▶ Watch: Gap: no solution targeting PQ authentication latency under mTLS (5:30)

Online/offline signature paradigm suits data centers: Pre-generating one-time keys and constructing Merkle trees offline allows online signing and verification to be extremely fast. Data centers are ideal for this because services talk to a small, relatively stable set of peers, enabling key pre-distribution. A Key Distribution Service (KDS) handles background key material exchange.

34-48% handshake latency reduction: Looma reduces P50 mTLS latency by 34% and P99 by 48% compared to Dilithium-2, cutting both median and tail latency. Online signing completes in under 1 microsecond; verification in under 7 microseconds.

Scalable under concurrency: Under increasing load, Looma maintains the lowest latency and highest throughput compared to baselines, demonstrating good scalability.

Technical Deep Dive

▶ Watch: Online/offline signature paradigm: precompute heavy part, fast online ops (7:00)

Looma combines Dilithium-2 (for offline signing of Merkle tree roots) with WOTS+ (Winternitz One-Time Signature) for fast online operations. Three optimizations reduce online cost: caching intermediate hash results, selecting the fastest hash function through benchmarking, and choosing parameters that balance signature size and computational overhead. Background key generation runs asynchronously on a dedicated core, with batch key generation triggered when the count of valid keys drops below a threshold. The architecture integrates into TLS 1.3 via the picotls library with OpenSSL backend and liboqs for PQ algorithms.

Demo / Proof of Concept

▶ Watch: Performance: 34% P50, 48% P99 latency reduction over Dilithium-2 (11:30)

End-to-end benchmarks show Looma as the lowest-latency option across all test configurations. Under concurrent connections (many clients to one server), Looma stays lowest in latency and sustains the highest throughput.

Defensive Implications

▶ Watch: Scalability under concurrent connections and IETF presentation planned (13:30)

For cloud infrastructure teams planning PQ migration, Looma provides a practical path to post-quantum mTLS without the latency penalty. For protocol designers, the online/offline signature paradigm, previously used mainly for IoT, translates well to data center environments. The upcoming IETF CFRG presentation suggests potential standardization.

Key Takeaways

• Post-quantum mTLS handshake latency is a critical bottleneck for cloud microservice architectures
• Online/offline signature splits authentication into precomputation (offline) and fast operation (online)
• 34% P50 and 48% P99 latency reduction over Dilithium-2 baseline
• Online signing under 1 microsecond, verification under 7 microseconds
• General architecture applicable to different PQ signature schemes and protocols (TLS, QUIC, PSP)
• Being presented at IETF CFRG for potential standardization

About the Speaker(s)

Xinshu Ma is a researcher at the University of Edinburgh working on post-quantum cryptographic protocol optimization for cloud infrastructure. The work bridges applied cryptography with cloud systems performance engineering.