Post-Quantum Cryptography Recommendations for Key Fragmentation in Low-Power Device Protocols

Introduction Emerging post-quantum cryptographic (PQC) algorithms introduce significantly larger public keys, ciphertexts, and signatures than those used in classical elliptic-curve or finite-field cryptography. In many constrained‑node environments, as defined in , these objects exceed the maximum transmission unit (MTU) of the underlying link layer or adaptation layer. As a consequence, PQC key establishment and authentication messages frequently require fragmentation at one or more layers of the protocol stack. Fragmentation occurs in a wide range of low‑power device protocols, including link-layer mechanisms (e.g., IEEE 802.15.4), adaptation layers such as 6LoWPAN and SCHC, and application‑layer mechanisms such as CoAP Block-Wise Transfer or protocol-internal message segmentation in EDHOC or DTLS. These mechanisms vary in reliability, ordering guarantees, and security properties. Many offer no cryptographic protection for fragments, leaving portions of PQC keying material observable or modifiable in transit. The introduction of PQC exacerbates existing fragmentation challenges: KEM ciphertexts and PQC signatures may be several kilobytes in size. Fragmentation forces endpoints to buffer partial messages, tolerate reordering, and detect malformed or tampered fragments. Without careful design, these behaviors weaken end-to-end cryptographic guarantees and create new opportunities for denial-of-service, replay, or side-channel attacks. This document analyzes the security and operational risks that arise when PQC keying material is fragmented in constrained networks. It surveys common fragmentation mechanisms, identifies failure modes such as fragment loss, reordering, replay, duplication, and corruption, and highlights cases where incremental parsing introduces side-channel or state-exhaustion risks. The document provides best-practice recommendations for protocol designers and implementers to ensure PQC key transport remains secure across fragmented paths. This document does not define new cryptographic algorithms, new fragmentation mechanisms, or modifications to existing link-layer or adaptation-layer specifications. Instead, it provides informational guidance applicable to both hybrid and pure PQC deployments across constrained environments.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Scope and Goals The goals of this document are:

To identify where fragmentation of PQC keying material occurs.
To analyze associated security and operational risks.
To provide recommendations for safe handling of fragmented PQC messages.

This document does not specify wire formats or introduce new protocol mechanisms. Its recommendations apply across protocols used in constrained environments, including CoAP, EDHOC, DTLS, OSCORE, and others.

Terminology

Fragment: A piece of a message transmitted independently due to MTU limits.
Reassembly: The process of reconstructing a message from fragments.
PQC Keying Material: PQC public keys, ciphertexts, signatures, and related values.
Constrained Device: Device class defined in .

Protocols and Environments Where Fragmentation Occurs

Low-Power Device Protocols (e.g., CoAP, MQTT, BLE) Protocols such as CoAP, MQTT-SN, Thread, and Bluetooth Low Energy operate atop link layers with limited and highly variable Maximum Transmission Units (MTUs). Typical MTU sizes range from 40 to 127 bytes for IEEE 802.15.4-based networks and may be even smaller in certain Low-Power Wide-Area Network (LPWAN) environments. These constraints result in routine fragmentation of application payloads that exceed a single frame, including post-quantum public keys, ciphertexts, and signatures, which commonly span from several hundred bytes to multiple kilobytes. Post-quantum cryptographic (PQC) mechanisms, such as ML-KEM, ML-DSA, and hash-based signature schemes, therefore often require transmission using multiple link-layer frames or adaptation-layer blocks. Even in networks that previously accommodated classical cryptographic messages without fragmentation, the introduction of PQC objects can trigger fragmentation behavior for the first time. This increase in message size can also amplify channel utilization, contention, and energy consumption on constrained devices, making efficient fragmentation and reassembly mechanisms essential to overall system performance. In multi-hop topologies, especially those using RPL or mesh routing, each hop may independently apply fragmentation or reassembly policies. This further increases the probability of fragment loss, duplication, or delay, all of which can negatively impact the reliability of PQC handshake protocols and authenticated exchanges.

Existing Fragmentation Mechanisms Fragmentation may occur at various points within the protocol stack, depending on deployment architecture, link type, and adaptation technology. The following layers and mechanisms are commonly relevant in constrained deployments transporting PQC objects:

IPv6 Fragmentation: IPv6 supports fragmentation through the Fragment Header when required by upper-layer packets exceeding the path MTU. While generally discouraged, this mechanism remains active in many constrained deployments where link-layer MTUs are particularly small.
6LoWPAN Adaptation Layer: The 6LoWPAN layer (RFC 4944, RFC 6282) performs fragmentation and header compression for IPv6 packets traversing low-power wireless networks. 6LoWPAN fragmentation operates independently of IPv6 fragmentation and can be applied even when path MTU discovery is in use. Fragmentation units must be reassembled at the final 6LoWPAN endpoint, and intermediate losses often lead to reassembly timeout behavior.
SCHC Fragmentation: SCHC (RFC 8724) combines static compression with a specialized fragmentation and retransmission framework optimized for LPWAN environments. SCHC fragmentation rules support both No-ACK and ACK-on-Error operational modes and may introduce additional latencies or retransmission events when transporting large PQC objects.
DTLS Record Layer Fragmentation: DTLS permits fragmentation of handshake messages into multiple records. With PQC-based handshakes, individual key exchange messages or certificate objects often exceed the DTLS record size, requiring record-layer fragmentation and reassembly. Loss, duplication, or reordering of DTLS records can significantly impact handshake completion time.
CoAP Block1/Block2 Transfer: CoAP blockwise transfer (RFC 7959) offers application-layer segmentation of large payloads into manageable blocks. When used for transporting PQC objects, such as public-key material in an EDHOC or OSCORE interaction, blockwise operations may interact with underlying link-layer or adaptation-layer fragmentation, producing multi-level fragmentation that implementers must consider.

Across these layers, fragmentation may be applied cumulatively, potentially resulting in multiple nested fragmentation headers, increased overhead, and intricate reassembly behavior.

Impact of Fragmentation on Cryptographic Materials Fragmentation exposes PQC structures to partial observation and manipulation that would not arise if the object were transmitted as a single, atomic unit. Although most PQC mechanisms remain cryptographically secure even when ciphertexts, signatures, or public keys are fully visible, fragmentation introduces operational risks that require careful mitigation. First, fragmentation increases sensitivity to loss and reordering. PQC schemes generally lack internal redundancy; the loss of a single fragment often invalidates the entire ciphertext or signature, triggering retransmissions or handshake failure. In environments with high loss rates, this can significantly degrade handshake performance and increase energy consumption. Second, fragmentation creates new vectors for replay, truncation, and reassembly tampering. Adversaries may attempt to replay individual fragments, reorder them, or selectively drop fragments to influence endpoint behavior. Without appropriate integrity protection at the correct layer, such attacks may cause denial-of-service conditions or misbinding risks in multi-step cryptographic exchanges. Third, partial visibility into structured PQC artifacts, such as polynomial or lattice coefficient blocks, may inadvertently reveal structural boundaries or encoding details that aid traffic analysis. While such exposure typically does not compromise the security guarantees of the underlying PQC scheme, it may reveal implementation-specific behaviors or facilitate fingerprinting of device classes. Finally, excessive fragmentation increases the attack surface for side- channel timing effects, as reassembly time, missing-fragment handling, and recovery behaviors may leak information about system state or processing load on constrained devices. These impacts collectively underscore the need for robust integrity protection, deterministic reassembly rules, and well-defined retransmission strategies when deploying PQC in constrained or lossy environments.

Fragmentation of PQC Keying Material

Characteristics of PQC Keying Materials Post-quantum key-encapsulation mechanisms (KEMs) and digital signature schemes generally produce keying materials like public keys, ciphertexts, signatures, and auxiliary values that are significantly larger than those used in classical cryptography. Depending on the algorithm and parameter set, these objects often range from 1–3 kB or more, with some signature schemes exceeding several kilobytes. Such sizes far exceed the MTUs commonly available in constrained, namely node networks, where link-layer payload limits may be as small as 40–100 bytes. The increased object size directly affects transport behavior: PQC messages frequently cannot be carried within a single frame or packet and thus require fragmentation at one or multiple layers of the protocol stack. This characteristic is intrinsic to many PQC schemes and must be considered in protocol design and deployment.

Fragmentation in Constrained Devices Fragmentation and reassembly impose non-trivial costs on constrained devices. Each fragment must be buffered, validated, and mapped to the correct reassembly context. These operations consume RAM, CPU cycles, and energy, namely resources that are often highly constrained in low-power embedded platforms. PQC keying materials intensify these demands for two reasons. First, transporting larger objects requires a greater number of fragments, increasing both memory footprint and reassembly complexity. Second, the loss or corruption of even a single fragment often invalidates the entire PQC object, necessitating retransmission and further exacerbating energy consumption and latency. As a result, the interaction between PQC object size and device resource limitations becomes a primary consideration in constrained deployments.

PQC Scheme-Specific Considerations Different PQC schemes exhibit structural and encoding properties that influence their sensitivity to fragmentation. For example, lattice-based schemes such as ML-KEM and ML-DSA encode polynomial or vector-based objects whose internal boundaries may align imperfectly with fragment boundaries. This may expose partial structure or create operational challenges when fragments are lost or reordered. Hash-based signature schemes such as SLH-DSA may involve multi-part signature components rooted in Merkle-tree constructions. Although these components remain secure when fragmented, their size and internal structure can lead to a high fragment count, increasing susceptibility to loss, reassembly timeout, or replay of individual fragments. In all cases, the lack of internal redundancy within PQC objects means that partial or malformed fragments cannot be meaningfully interpreted until reassembly completes. Protocol designers therefore SHOULD assume that fragment handling, buffering, and validation will be critical performance and security factors when transporting PQC materials in constrained environments.

Security and Operational Issues Introduced by Fragmentation Fragmentation of PQC keying materials in constrained environments introduces a broad set of security and operational challenges. Unlike classical cryptographic objects that often fit within common link-layer MTUs, PQC public keys, ciphertexts, and signatures commonly span from hundreds of bytes to several kilobytes. As described in earlier sections, this size expansion forces fragmentation at multiple layers: link-layer, adaptation-layer (e.g., 6LoWPAN, SCHC), transport (e.g., DTLS), or application-layer (e.g., CoAP Block-Wise). Because these layers differ in integrity guarantees, reliability properties, and reassembly semantics, the resulting fragmentation can expose metadata, enable tampering, and complicate correct cryptographic processing. The following subsections describe the primary classes of risks that arise from fragmentation and apply across PQC handshake messages, authentication tokens, and other cryptographic payloads. These issues stem from both the intrinsic properties of PQC objects and the operational constraints of low-power networks.

Observability of Keying Materials Fragmentation increases the surface over which PQC objects become observable. When large keys or ciphertexts are split into many small fragments. More specifically, in networks where link-layer or adaptation- layer fragmentation provides no confidentiality, adversaries may inspect portions of the object incrementally as fragments traverse the network. While PQC schemes remain secure under full exposure of public keys and ciphertexts, partial visibility can still reveal structure, encoding boundaries, or algorithm identifiers that assist in traffic classification or fingerprinting. In environments employing multi-level fragmentation (e.g., CoAP blockwise segmentation atop 6LoWPAN fragmentation), the repetition of headers, indices, or block identifiers may further expose device behavior, congestion conditions, or protocol roles. Such metadata leakage may be particularly sensitive in deployments where traffic analysis is a concern, such as battery-powered sensor nodes or industrial automation networks.

Fragment Loss PQC objects generally lack internal redundancy: the loss of a single fragment renders the entire reassembled object invalid. As a result, constrained networks with high natural loss rates (e.g., IEEE 802.15.4 or LPWAN links) experience disproportionate failure rates when transporting PQC materials. Endpoints may be forced into repeated retransmissions, increasing energy consumption, latency, and channel occupancy. From a security standpoint, adversaries may exploit selective loss to induce denial-of-service (DoS). By targeting specific fragments of a KEM ciphertext or signature, an attacker can repeatedly prevent successful handshake completion. Because PQC objects require many more fragments than their classical counterparts, this attack surface is significantly expanded in PQC deployments.

Fragment Reordering and Duplication Many low-power multi-hop topologies introduce non-deterministic delivery patterns where fragments may arrive out of order or be duplicated. PQC reassembly MUST therefore tolerate out-of-order arrival without creating ambiguity or allowing unintended cross-fragment correlations. In layered fragmentation scenarios, reordering at one layer may interact poorly with reassembly expectations at another layer. For example, blockwise transfers at the CoAP layer may assume strictly increasing block numbers, while underlying 6LoWPAN fragments may be delayed or reordered. These interactions can induce premature timeout behavior, excessive buffer usage, or reassembly aborts, all of which increase handshake failure rates.

Fragment Integrity and Authenticity Many fragmentation mechanisms, notably 6LoWPAN fragmentation and certain SCHC modes, do not provide per-fragment integrity protection. This allows adversaries to modify fragments in transit, potentially corrupting PQC objects before they reach the endpoint. Even if the reassembled PQC object is later authenticated (for example, via signature verification or MAC validation at a higher layer), endpoints incur processing costs and buffer usage on malicious fragments. On severely resource-constrained devices, repeated processing of corrupted fragments may become a viable resource-exhaustion vector. Moreover, some protocols may parse or act upon partial message structure before full authentication occurs, increasing the risk of state inconsistencies.

Replay of Individual Fragments Because fragments often lack unique per-fragment cryptographic binding, adversaries may replay individual fragments out of context. This can poison reassembly state, create malformed PQC objects, or induce failures that resemble natural packet loss. Replay of a single fragment in a multi-fragment PQC ciphertext may force repeated handshake restarts or block‑wise retransmissions. In multi-session or long-lived deployments, replayed fragments may also cause cross-session confusion if fragment identifiers are reused or insufficiently scoped. This risk is amplified for protocols with short-lived or lightweight session state, such as bootstrapping exchanges in IoT devices.

Fragment Binding to Cryptographic Context Fragmentation introduces attack surfaces where fragments from different messages or sessions could be mixed and incorrectly reassembled. To prevent such mix-and-match attacks, fragments MUST be uniquely bound to the cryptographic session, handshake step, or message sequence to which they belong. Failure to enforce such binding may lead to misassociation of PQC ciphertexts or signatures with incorrect protocol state. This may produce catastrophic misbinding vulnerabilities where an endpoint believes it processed authenticated material when, in reality, fragments originated from another exchange or attacker-crafted sequence.

Side-Channel Risks During Reassembly The reassembly of PQC objects, especially those spanning dozens of fragments, can introduce observable timing differences. For example, the amount of time required to detect missing fragments, verify fragment indices, or handle corrupted headers may vary depending on protocol state, network conditions, or partial buffer contents. Attackers observing these timing patterns may infer device load, message sizes, or attempts to reconstruct specific PQC objects. Memory-access patterns during incremental parsing can also leak information. On devices with tight memory constraints, buffer exhaustion or reallocation events may be externally observable through timing or power analysis. While such side channels typically do not reveal secret values within PQC structures, they may reveal enough metadata to support broader traffic analysis or fingerprinting efforts.

Recommendations for Handling Fragmentation The introduction of PQC keying materials into constrained networks requires mitigation strategies that preserve security, robustness, and energy efficiency. Because PQC objects frequently exceed available MTUs, fragmentation becomes unavoidable in many deployments. Protocol designers and implementers MUST account for the security and operational issues identified in Section . The following subsections provide best-practice guidance to reduce the risks associated with fragmented PQC messages.

Use of Fragment Authentication Fragments SHOULD be authenticated or protected by integrity mechanisms whenever feasible. Per-fragment integrity prevents tampering, ensures early rejection of corrupted data, and reduces adversarial influence on endpoint reassembly behavior. This recommendation is especially important for technologies such as 6LoWPAN, where fragmentation occurs without cryptographic protections at the adaptation layer. When per-fragment authentication is not possible, implementations MUST verify the full reassembled object before processing any PQC keying material. Protocols MUST NOT perform incremental parsing that influences state transitions, allocation behavior, or cryptographic decisions before final authentication is complete.

Minimizing Fragment Exposure PQC objects SHOULD be encrypted or encapsulated at an inner layer prior to fragmentation. Inner encryption conceals the structure, encoding boundaries, and content of PQC artifacts, limiting metadata exposure even when fragment headers remain visible at outer layers. If plaintext PQC structures must be transported, implementers SHOULD minimize the required number of fragments whenever possible, for example through compression, efficient encoding, or choosing PQC parameter sets with smaller public keys, ciphertexts, or signatures suited to constrained networks.

Protocol-Level Mitigations Fragments MUST be uniquely bound to the cryptographic session, message sequence, or handshake step to prevent mix-and-match attacks, replay misuse, or cross-session confusion. Identifiers such as message counters, session identifiers, or fragment indices MUST provide unambiguous association with the correct PQC object. Protocols SHOULD limit the size or number of fragments generated for any PQC object. Excessive fragmentation amplifies the likelihood of loss, reordering, duplication, and resource exhaustion. Endpoints SHOULD enforce bounded buffer sizes, strict reassembly timeouts, and deterministic failure behavior when reassembly cannot complete. In deployments involving multi-layer fragmentation (e.g., CoAP blockwise segmentation atop 6LoWPAN fragmentation), implementations SHOULD ensure that retransmission logic, timers, and loss-handling behaviors do not conflict across layers. Coordinated timeout strategies and end-to-end acknowledgments can reduce redundant retransmissions and improve overall energy efficiency.

Mitigating Fragmentation Visibility and Sensitivity In protocols such as 6LoWPAN, fragmentation is explicitly indicated on the wire using FRAG1 and FRAGN headers. Because PQC objects are significantly larger than typical constrained-network MTUs, their transmission may consistently generate long sequences of FRAGMENT frames, enabling adversaries to correlate large fragmented traffic bursts with key-establishment events. The following techniques mitigate this leakage.

Normalization via Padding or Traffic Shaping: Endpoints MAY pad or otherwise normalize outgoing traffic so that fragmented packets occur for a broader set of message types. Normalization reduces the correlation between FRAGMENT frames and PQC operations, diminishing the effectiveness of traffic-analysis attacks that rely on detecting unusually large or frequent fragmentation.
Aggregation of Multiple Logical Messages: Implementations MAY aggregate several smaller messages into a single packet before fragmentation occurs. By ensuring that fragmentation is not triggered exclusively by PQC ciphertexts or signatures, the resulting traffic pattern is less distinguishable from routine network activity.
Use of Encrypted or Encapsulating Inner Layers: Encapsulating PQC objects inside encrypted or authenticated containers (e.g., OSCORE or EDHOC-protected messages) prior to fragmentation conceals the internal structure of PQC objects. Although FRAGMENT headers remain visible, observers cannot identify whether the payload corresponds to PQC materials, application data, or operational messages.
Minimizing Predictable Fragmentation Patterns: PQC algorithms and parameter sets often produce highly predictable ciphertext, key, or signature sizes. Implementers SHOULD introduce small variations (e.g., selective padding or grouping) to prevent attackers from recognizing consistent fragmentation patterns that uniquely identify a PQC algorithm, parameter set, or device profile.
Choosing Adaptation Layers with Opaque Fragmentation: When deployment conditions permit, adaptation layers that support more opaque fragmentation semantics (e.g., SCHC operating in ACK-on-Error mode) SHOULD be preferred over layers such as raw 6LoWPAN FRAG1/FRAGN, where fragmentation headers are explicitly exposed and predictable.
Reducing Fragment Count via PQC Parameter Selection: When multiple PQC parameter sets offer equivalent security levels, implementers SHOULD select those producing smaller PQC objects, especially when running over networks with small MTUs. Reducing fragment count lowers traffic visibility and decreases the likelihood that fragmentation serves as a reliable indicator of sensitive cryptographic operations.

These mitigation techniques help ensure that fragmentation events do not become a reliable side channel for detecting PQC key exchanges. This is especially critical in low-power, event-driven deployments where sensitive cryptographic messages occur infrequently and might otherwise stand out in the traffic profile.

Resource-Aware Handling Because PQC objects can span many fragments, constrained devices MUST manage memory allocation carefully during reassembly. Implementations SHOULD minimize buffer lifetimes, use incremental validation where compatible with protocol semantics, and avoid allocating unnecessarily large contiguous memory regions. Endpoints SHOULD apply backpressure or rate-limiting mechanisms when reassembly buffers are close to exhaustion. This protects devices from resource-exhaustion attacks triggered by intentionally fragmented or malformed PQC payloads.

Side-Channel Mitigations Implementations SHOULD minimize data-dependent timing variations during fragment processing. This includes uniform handling of missing fragments, constant-time index validation, and predictable memory-access patterns where feasible. Endpoints SHOULD avoid emitting highly granular reassembly diagnostics, retransmission signals, or fragment-level error codes that reveal reassembly progress or internal buffer state. Aggregated or delayed signaling can reduce the amount of timing and behavioral information available to observers.

Algorithm and Parameter Awareness Protocol designers SHOULD consider the fragmentation implications of their selected PQC schemes and parameter sets. Larger PQC signatures, ciphertexts, and public keys introduce overhead that may be prohibitive for networks with very small MTUs. When equivalent security levels are available, systems operating across lossy or fragmentation-prone paths SHOULD prefer parameter sets producing smaller PQC objects. This reduces fragment count, minimizes transmission overhead, and lowers exposure to the traffic-analysis and denial-of-service risks described above.

Security Considerations This document analyzes the security and operational risks associated with fragmenting post-quantum cryptographic (PQC) keying materials in constrained environments. All identified risks—including fragment loss, reordering, replay, tampering, observability, side-channel exposure, and misbinding—are discussed in detail in Section . The recommendations in Section describe mitigation techniques to reduce these risks across link-layer, adaptation-layer, transport-layer, and application-layer fragmentation mechanisms. Implementers and protocol designers MUST consider these risks when deploying PQC schemes in environments where fragmentation may occur. This document does not define new cryptographic primitives, new fragmentation mechanisms, or modifications to existing security protocols. It introduces no new on-the-wire protocol elements and therefore does not create additional attack vectors beyond those inherent in existing fragmentation procedures.

IANA Considerations This document has no IANA actions. No registries are created or modified by this document, and no new protocol identifiers, option values, SCHC rule IDs, CoAP options, or DTLS codepoints are requested.