| Internet-Draft | PQC Key Fragmentation | September 2026 |
| Trimananda, et al. | Expires 8 March 2027 | [Page] |
Cryptographic protocols deployed on low‑power and constrained devices increasingly need to accommodate the larger key sizes introduced by modern and post‑quantum cryptographic (PQC) algorithms. Many constrained network technologies (such as 6LoWPAN, SCHC, and similar adaptation‑layer protocols) use explicit fragmentation mechanisms to transport messages that exceed link‑layer frame sizes. As a result, cryptographic keying material and key‑establishment messages may be segmented across multiple fragments during transmission.¶
This document analyzes the security and operational implications of such fragmentation. It identifies common fragmentation patterns and examines risks including fragment loss, reordering, duplication, and partial exposure. It further discusses fragment-level integrity, replay resistance, and correct binding of fragments to cryptographic session state. This document does not define new cryptographic algorithms or fragmentation mechanisms.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 8 March 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Emerging post-quantum cryptographic (PQC) algorithms introduce significantly larger public keys, ciphertexts, and signatures than those used in classical elliptic-curve or finite-field cryptography. In many constrained‑node environments, as defined in [RFC7228], these objects exceed the maximum transmission unit (MTU) of the underlying link layer or adaptation layer. As a consequence, PQC key establishment and authentication messages frequently require fragmentation at one or more layers of the protocol stack.¶
Fragmentation occurs in a wide range of low‑power device protocols, including link-layer mechanisms (e.g., IEEE 802.15.4), adaptation layers such as 6LoWPAN and SCHC, and application‑layer mechanisms such as CoAP Block-Wise Transfer or protocol-internal message segmentation in EDHOC or DTLS. These mechanisms vary in reliability, ordering guarantees, and security properties. Many offer no cryptographic protection for fragments, leaving portions of PQC keying material observable or modifiable in transit.¶
The introduction of PQC exacerbates existing fragmentation challenges: KEM ciphertexts and PQC signatures may be several kilobytes in size. Fragmentation forces endpoints to buffer partial messages, tolerate reordering, and detect malformed or tampered fragments. Without careful design, these behaviors weaken end-to-end cryptographic guarantees and create new opportunities for denial-of-service, replay, or side-channel attacks.¶
This document analyzes the security and operational risks that arise when PQC keying material is fragmented in constrained networks. It surveys common fragmentation mechanisms, identifies failure modes such as fragment loss, reordering, replay, duplication, and corruption, and highlights cases where incremental parsing introduces side-channel or state-exhaustion risks. The document provides best-practice recommendations for protocol designers and implementers to ensure PQC key transport remains secure across fragmented paths.¶
This document does not define new cryptographic algorithms, new fragmentation mechanisms, or modifications to existing link-layer or adaptation-layer specifications. Instead, it provides informational guidance applicable to both hybrid and pure PQC deployments across constrained environments.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
The goals of this document are:¶
This document does not specify wire formats or introduce new protocol mechanisms. Its recommendations apply across protocols used in constrained environments, including CoAP, EDHOC, DTLS, OSCORE, and others.¶
Protocols such as CoAP, MQTT-SN, Thread, and Bluetooth Low Energy operate atop link layers with limited and highly variable Maximum Transmission Units (MTUs). Typical MTU sizes range from 40 to 127 bytes for IEEE 802.15.4-based networks and may be even smaller in certain Low-Power Wide-Area Network (LPWAN) environments. These constraints result in routine fragmentation of application payloads that exceed a single frame, including post-quantum public keys, ciphertexts, and signatures, which commonly span from several hundred bytes to multiple kilobytes.¶
Post-quantum cryptographic (PQC) mechanisms, such as ML-KEM, ML-DSA, and hash-based signature schemes, therefore often require transmission using multiple link-layer frames or adaptation-layer blocks. Even in networks that previously accommodated classical cryptographic messages without fragmentation, the introduction of PQC objects can trigger fragmentation behavior for the first time. This increase in message size can also amplify channel utilization, contention, and energy consumption on constrained devices, making efficient fragmentation and reassembly mechanisms essential to overall system performance.¶
In multi-hop topologies, especially those using RPL or mesh routing, each hop may independently apply fragmentation or reassembly policies. This further increases the probability of fragment loss, duplication, or delay, all of which can negatively impact the reliability of PQC handshake protocols and authenticated exchanges.¶
Fragmentation may occur at various points within the protocol stack, depending on deployment architecture, link type, and adaptation technology. The following layers and mechanisms are commonly relevant in constrained deployments transporting PQC objects:¶
Across these layers, fragmentation may be applied cumulatively, potentially resulting in multiple nested fragmentation headers, increased overhead, and intricate reassembly behavior.¶
Fragmentation exposes PQC structures to partial observation and manipulation that would not arise if the object were transmitted as a single, atomic unit. Although most PQC mechanisms remain cryptographically secure even when ciphertexts, signatures, or public keys are fully visible, fragmentation introduces operational risks that require careful mitigation.¶
First, fragmentation increases sensitivity to loss and reordering. PQC schemes generally lack internal redundancy; the loss of a single fragment often invalidates the entire ciphertext or signature, triggering retransmissions or handshake failure. In environments with high loss rates, this can significantly degrade handshake performance and increase energy consumption.¶
Second, fragmentation creates new vectors for replay, truncation, and reassembly tampering. Adversaries may attempt to replay individual fragments, reorder them, or selectively drop fragments to influence endpoint behavior. Without appropriate integrity protection at the correct layer, such attacks may cause denial-of-service conditions or misbinding risks in multi-step cryptographic exchanges.¶
Third, partial visibility into structured PQC artifacts, such as polynomial or lattice coefficient blocks, may inadvertently reveal structural boundaries or encoding details that aid traffic analysis. While such exposure typically does not compromise the security guarantees of the underlying PQC scheme, it may reveal implementation-specific behaviors or facilitate fingerprinting of device classes.¶
Finally, excessive fragmentation increases the attack surface for side- channel timing effects, as reassembly time, missing-fragment handling, and recovery behaviors may leak information about system state or processing load on constrained devices.¶
These impacts collectively underscore the need for robust integrity protection, deterministic reassembly rules, and well-defined retransmission strategies when deploying PQC in constrained or lossy environments.¶
Post-quantum key-encapsulation mechanisms (KEMs) and digital signature schemes generally produce keying materials like public keys, ciphertexts, signatures, and auxiliary values that are significantly larger than those used in classical cryptography. Depending on the algorithm and parameter set, these objects often range from 1–3 kB or more, with some signature schemes exceeding several kilobytes. Such sizes far exceed the MTUs commonly available in constrained, namely node networks, where link-layer payload limits may be as small as 40–100 bytes.¶
The increased object size directly affects transport behavior: PQC messages frequently cannot be carried within a single frame or packet and thus require fragmentation at one or multiple layers of the protocol stack. This characteristic is intrinsic to many PQC schemes and must be considered in protocol design and deployment.¶
Fragmentation and reassembly impose non-trivial costs on constrained devices. Each fragment must be buffered, validated, and mapped to the correct reassembly context. These operations consume RAM, CPU cycles, and energy, namely resources that are often highly constrained in low-power embedded platforms.¶
PQC keying materials intensify these demands for two reasons. First, transporting larger objects requires a greater number of fragments, increasing both memory footprint and reassembly complexity. Second, the loss or corruption of even a single fragment often invalidates the entire PQC object, necessitating retransmission and further exacerbating energy consumption and latency. As a result, the interaction between PQC object size and device resource limitations becomes a primary consideration in constrained deployments.¶
Different PQC schemes exhibit structural and encoding properties that influence their sensitivity to fragmentation. For example, lattice-based schemes such as ML-KEM and ML-DSA encode polynomial or vector-based objects whose internal boundaries may align imperfectly with fragment boundaries. This may expose partial structure or create operational challenges when fragments are lost or reordered.¶
Hash-based signature schemes such as SLH-DSA may involve multi-part signature components rooted in Merkle-tree constructions. Although these components remain secure when fragmented, their size and internal structure can lead to a high fragment count, increasing susceptibility to loss, reassembly timeout, or replay of individual fragments.¶
In all cases, the lack of internal redundancy within PQC objects means that partial or malformed fragments cannot be meaningfully interpreted until reassembly completes. Protocol designers therefore SHOULD assume that fragment handling, buffering, and validation will be critical performance and security factors when transporting PQC materials in constrained environments.¶
Fragmentation of PQC keying materials in constrained environments introduces a broad set of security and operational challenges. Unlike classical cryptographic objects that often fit within common link-layer MTUs, PQC public keys, ciphertexts, and signatures commonly span from hundreds of bytes to several kilobytes. As described in earlier sections, this size expansion forces fragmentation at multiple layers: link-layer, adaptation-layer (e.g., 6LoWPAN, SCHC), transport (e.g., DTLS), or application-layer (e.g., CoAP Block-Wise). Because these layers differ in integrity guarantees, reliability properties, and reassembly semantics, the resulting fragmentation can expose metadata, enable tampering, and complicate correct cryptographic processing.¶
The following subsections describe the primary classes of risks that arise from fragmentation and apply across PQC handshake messages, authentication tokens, and other cryptographic payloads. These issues stem from both the intrinsic properties of PQC objects and the operational constraints of low-power networks.¶
Fragmentation increases the surface over which PQC objects become observable. When large keys or ciphertexts are split into many small fragments. More specifically, in networks where link-layer or adaptation- layer fragmentation provides no confidentiality, adversaries may inspect portions of the object incrementally as fragments traverse the network. While PQC schemes remain secure under full exposure of public keys and ciphertexts, partial visibility can still reveal structure, encoding boundaries, or algorithm identifiers that assist in traffic classification or fingerprinting.¶
In environments employing multi-level fragmentation (e.g., CoAP blockwise segmentation atop 6LoWPAN fragmentation), the repetition of headers, indices, or block identifiers may further expose device behavior, congestion conditions, or protocol roles. Such metadata leakage may be particularly sensitive in deployments where traffic analysis is a concern, such as battery-powered sensor nodes or industrial automation networks.¶
PQC objects generally lack internal redundancy: the loss of a single fragment renders the entire reassembled object invalid. As a result, constrained networks with high natural loss rates (e.g., IEEE 802.15.4 or LPWAN links) experience disproportionate failure rates when transporting PQC materials. Endpoints may be forced into repeated retransmissions, increasing energy consumption, latency, and channel occupancy.¶
From a security standpoint, adversaries may exploit selective loss to induce denial-of-service (DoS). By targeting specific fragments of a KEM ciphertext or signature, an attacker can repeatedly prevent successful handshake completion. Because PQC objects require many more fragments than their classical counterparts, this attack surface is significantly expanded in PQC deployments.¶
Many low-power multi-hop topologies introduce non-deterministic delivery patterns where fragments may arrive out of order or be duplicated. PQC reassembly MUST therefore tolerate out-of-order arrival without creating ambiguity or allowing unintended cross-fragment correlations.¶
In layered fragmentation scenarios, reordering at one layer may interact poorly with reassembly expectations at another layer. For example, blockwise transfers at the CoAP layer may assume strictly increasing block numbers, while underlying 6LoWPAN fragments may be delayed or reordered. These interactions can induce premature timeout behavior, excessive buffer usage, or reassembly aborts, all of which increase handshake failure rates.¶
Many fragmentation mechanisms, notably 6LoWPAN fragmentation and certain SCHC modes, do not provide per-fragment integrity protection. This allows adversaries to modify fragments in transit, potentially corrupting PQC objects before they reach the endpoint.¶
Even if the reassembled PQC object is later authenticated (for example, via signature verification or MAC validation at a higher layer), endpoints incur processing costs and buffer usage on malicious fragments. On severely resource-constrained devices, repeated processing of corrupted fragments may become a viable resource-exhaustion vector. Moreover, some protocols may parse or act upon partial message structure before full authentication occurs, increasing the risk of state inconsistencies.¶
Because fragments often lack unique per-fragment cryptographic binding, adversaries may replay individual fragments out of context. This can poison reassembly state, create malformed PQC objects, or induce failures that resemble natural packet loss. Replay of a single fragment in a multi-fragment PQC ciphertext may force repeated handshake restarts or block‑wise retransmissions.¶
In multi-session or long-lived deployments, replayed fragments may also cause cross-session confusion if fragment identifiers are reused or insufficiently scoped. This risk is amplified for protocols with short-lived or lightweight session state, such as bootstrapping exchanges in IoT devices.¶
Fragmentation introduces attack surfaces where fragments from different messages or sessions could be mixed and incorrectly reassembled. To prevent such mix-and-match attacks, fragments MUST be uniquely bound to the cryptographic session, handshake step, or message sequence to which they belong.¶
Failure to enforce such binding may lead to misassociation of PQC ciphertexts or signatures with incorrect protocol state. This may produce catastrophic misbinding vulnerabilities where an endpoint believes it processed authenticated material when, in reality, fragments originated from another exchange or attacker-crafted sequence.¶
The reassembly of PQC objects, especially those spanning dozens of fragments, can introduce observable timing differences. For example, the amount of time required to detect missing fragments, verify fragment indices, or handle corrupted headers may vary depending on protocol state, network conditions, or partial buffer contents. Attackers observing these timing patterns may infer device load, message sizes, or attempts to reconstruct specific PQC objects.¶
Memory-access patterns during incremental parsing can also leak information. On devices with tight memory constraints, buffer exhaustion or reallocation events may be externally observable through timing or power analysis. While such side channels typically do not reveal secret values within PQC structures, they may reveal enough metadata to support broader traffic analysis or fingerprinting efforts.¶
The introduction of PQC keying materials into constrained networks requires mitigation strategies that preserve security, robustness, and energy efficiency. Because PQC objects frequently exceed available MTUs, fragmentation becomes unavoidable in many deployments. Protocol designers and implementers MUST account for the security and operational issues identified in Section Section 5. The following subsections provide best-practice guidance to reduce the risks associated with fragmented PQC messages.¶
Fragments SHOULD be authenticated or protected by integrity mechanisms whenever feasible. Per-fragment integrity prevents tampering, ensures early rejection of corrupted data, and reduces adversarial influence on endpoint reassembly behavior. This recommendation is especially important for technologies such as 6LoWPAN, where fragmentation occurs without cryptographic protections at the adaptation layer.¶
When per-fragment authentication is not possible, implementations MUST verify the full reassembled object before processing any PQC keying material. Protocols MUST NOT perform incremental parsing that influences state transitions, allocation behavior, or cryptographic decisions before final authentication is complete.¶
PQC objects SHOULD be encrypted or encapsulated at an inner layer prior to fragmentation. Inner encryption conceals the structure, encoding boundaries, and content of PQC artifacts, limiting metadata exposure even when fragment headers remain visible at outer layers.¶
If plaintext PQC structures must be transported, implementers SHOULD minimize the required number of fragments whenever possible, for example through compression, efficient encoding, or choosing PQC parameter sets with smaller public keys, ciphertexts, or signatures suited to constrained networks.¶
Fragments MUST be uniquely bound to the cryptographic session, message sequence, or handshake step to prevent mix-and-match attacks, replay misuse, or cross-session confusion. Identifiers such as message counters, session identifiers, or fragment indices MUST provide unambiguous association with the correct PQC object.¶
Protocols SHOULD limit the size or number of fragments generated for any PQC object. Excessive fragmentation amplifies the likelihood of loss, reordering, duplication, and resource exhaustion. Endpoints SHOULD enforce bounded buffer sizes, strict reassembly timeouts, and deterministic failure behavior when reassembly cannot complete.¶
In deployments involving multi-layer fragmentation (e.g., CoAP blockwise segmentation atop 6LoWPAN fragmentation), implementations SHOULD ensure that retransmission logic, timers, and loss-handling behaviors do not conflict across layers. Coordinated timeout strategies and end-to-end acknowledgments can reduce redundant retransmissions and improve overall energy efficiency.¶
In protocols such as 6LoWPAN, fragmentation is explicitly indicated on the wire using FRAG1 and FRAGN headers. Because PQC objects are significantly larger than typical constrained-network MTUs, their transmission may consistently generate long sequences of FRAGMENT frames, enabling adversaries to correlate large fragmented traffic bursts with key-establishment events. The following techniques mitigate this leakage.¶
These mitigation techniques help ensure that fragmentation events do not become a reliable side channel for detecting PQC key exchanges. This is especially critical in low-power, event-driven deployments where sensitive cryptographic messages occur infrequently and might otherwise stand out in the traffic profile.¶
Because PQC objects can span many fragments, constrained devices MUST manage memory allocation carefully during reassembly. Implementations SHOULD minimize buffer lifetimes, use incremental validation where compatible with protocol semantics, and avoid allocating unnecessarily large contiguous memory regions.¶
Endpoints SHOULD apply backpressure or rate-limiting mechanisms when reassembly buffers are close to exhaustion. This protects devices from resource-exhaustion attacks triggered by intentionally fragmented or malformed PQC payloads.¶
Implementations SHOULD minimize data-dependent timing variations during fragment processing. This includes uniform handling of missing fragments, constant-time index validation, and predictable memory-access patterns where feasible.¶
Endpoints SHOULD avoid emitting highly granular reassembly diagnostics, retransmission signals, or fragment-level error codes that reveal reassembly progress or internal buffer state. Aggregated or delayed signaling can reduce the amount of timing and behavioral information available to observers.¶
Protocol designers SHOULD consider the fragmentation implications of their selected PQC schemes and parameter sets. Larger PQC signatures, ciphertexts, and public keys introduce overhead that may be prohibitive for networks with very small MTUs.¶
When equivalent security levels are available, systems operating across lossy or fragmentation-prone paths SHOULD prefer parameter sets producing smaller PQC objects. This reduces fragment count, minimizes transmission overhead, and lowers exposure to the traffic-analysis and denial-of-service risks described above.¶
This document analyzes the security and operational risks associated with fragmenting post-quantum cryptographic (PQC) keying materials in constrained environments. All identified risks—including fragment loss, reordering, replay, tampering, observability, side-channel exposure, and misbinding—are discussed in detail in Section Section 5.¶
The recommendations in Section Section 6 describe mitigation techniques to reduce these risks across link-layer, adaptation-layer, transport-layer, and application-layer fragmentation mechanisms. Implementers and protocol designers MUST consider these risks when deploying PQC schemes in environments where fragmentation may occur.¶
This document does not define new cryptographic primitives, new fragmentation mechanisms, or modifications to existing security protocols. It introduces no new on-the-wire protocol elements and therefore does not create additional attack vectors beyond those inherent in existing fragmentation procedures.¶
This document has no IANA actions.¶
No registries are created or modified by this document, and no new protocol identifiers, option values, SCHC rule IDs, CoAP options, or DTLS codepoints are requested.¶