Post-Quantum VPN Performance: How to Measure It Fairly

Separate setup from ongoing traffic

Connection time includes more than cryptography: name resolution, network round trips, server response, certificate checks and interface setup can all contribute. A short file transfer that starts before connection completion can blur setup cost and transfer speed.

Once the tunnel is established, distance, packet loss, transport, server load, routing and the data-channel cipher affect useful throughput. Rekeying and reconnects introduce additional events worth measuring separately. The hybrid group name alone does not predict a speed result.

Record a reproducible environment

Before comparing runs, record OS and CPU architecture, client package, OpenVPN and library versions, server hardware/location, transport, data cipher, group policy, network type, approximate RTT and test endpoint. Use a controlled environment rather than changing your production protection policy for a speed test.

For a baseline comparison, keep the environment and data cipher constant while changing only the intended key-agreement policy. State every remaining difference, including offload availability and concurrent server load. Do not describe two unrelated provider speed tests as a measurement of ML-KEM overhead.

Collect useful measurements

Choose a sample count before testing, alternate comparison runs to reduce time-of-day bias, and retain failed runs. Sanitize diagnostics and packet captures before sharing them. Never publish private keys, full customer profiles or identifying traffic payloads.

Read results with their limits

A useful report supplies raw summary data, exact versions, test dates and enough detail for another person to reproduce the method. A single average without variability or a platform label without a build identifier is weak evidence.

Until such results are available, no numerical ALightVPN post-quantum overhead or throughput improvement is established by this page. Use the general speed guide to troubleshoot your connection and the compatibility checklist to record the configuration being measured.

For observed connection-event timings and byte counters, see three route-isolated diagnostic runs. That case study is not a throughput comparison or a measurement of isolated ML-KEM overhead.

Common questions

Does this page contain ALightVPN benchmark results?

No. It supplies a reproducible method. No measured performance figures or comparative speed claims are presented.

Does a larger handshake imply slower browsing throughout a session?

Not directly. Setup costs and steady-state throughput are different measurements affected by different conditions.

Should I disable post-quantum settings to troubleshoot production speed?

Use the supported troubleshooting path. Controlled baseline experiments should use an approved test environment and clearly recorded policies.