Measuring The Impact of Post-Quantum Cryptography on Complex Applications: A Case Study on Federated Identity Management#

Ginevra Fabrizio, University of Twente

• Why: One of the few PQC-migration studies grounded in a real, complex identity stack (SAML + OIDC hub-and-spoke federation) rather than isolated TLS benchmarks — directly relevant to the identity side of the PM's portfolio.
• What: Benchmarks of the five NIST-finalized PQC algorithms against real-world load from SURF's SURFconext federation (25 days of data: authentication counts, HAProxy logs, TLS connection info, SAML request/response volumes), quantifying the computational and hardware-capacity toll of switching a production federated identity hub to PQC.
• How: The Hub'n'Spoke model is the worst case: the central hub (SURF.Engine) performs most cryptographic operations — each SAML flow involves validating the home IdP's response signature and signing a new response for the SP, and equivalents exist in the OIDC flow. Real authentication flows run from one second to several minutes, so added per-operation cost compounds visibly.
• Where applicable: Identity federation operators and anyone planning PQC migration of OAuth/OIDC/SAML infrastructure. Findings: the transition is fragmented, with many ecosystem components still unaccounted for. Specific to hub-and-spoke scale but the methodology transfers.