EMPIRICAL PERFORMANCE EVALUATION OF NIST POST-QUANTUM CRYPTOGRAPHIC ALGORITHMS ML-KEM, ML-DSA, AND SLH-DSA ACROSS JDK VERSIONS

Abstract

The standardization of the ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) algorithms by NIST in 2024 marked the beginning of a practical transition to post-quantum cryptography in enterprise software systems. The Java platform remains one of the most widely used in corporate environments; however, developers face a practical choice: whether to use the BouncyCastle library, which supports the new algorithms across all current JDK versions, or the native capabilities introduced in JDK 25. The absence of systematic empirical data on the performance of these algorithms in the Java environment — across platform versions, security levels, and operation types — makes it difficult to justify this choice when planning the migration of enterprise Java systems to post-quantum standards. This paper presents a systematic comparative performance study of ML-KEM, ML-DSA, and SLH-DSA in the Java environment based on a reproducible experiment using the Java Microbenchmark Harness in a containerized setting across three platform versions — JDK 17, JDK 21, and JDK 25 — comparing BouncyCastle 1.83 and the native JDK 25 implementation. For each algorithm, three core operations were measured: key pair generation, encapsulation or signing, and decapsulation or verification. For signature algorithms, the message size was additionally varied across 256 bytes, 1024 bytes, and 65536 bytes. Statistical significance of observed differences was assessed using the Mann–Whitney and Kruskal–Wallis tests, with post-hoc analysis performed using Dunn's method with Bonferroni correction.
It is established that the native JDK 25 implementation consistently underperforms BouncyCastle across all algorithms and operations. A dedicated benchmark of provider initialization overhead confirmed that this gap is attributable to the algorithmic implementation rather than infrastructure costs. Upgrading from JDK 17 to JDK 25 yields a statistically significant performance improvement for BouncyCastle implementations. Based on the experimental results, practical recommendations are formulated for Java developers regarding the choice of implementation and platform version when migrating to post-quantum standards. The source code and Docker Compose configuration are published in an open GitHub repository to enable independent reproduction of the results.