We already have recommendations on what PQCrypto to use: PDF (page 11)
Symmetric encryption Thoroughly analyzed, 256-bit keys:
- AES-256
- Salsa20 with a 256-bit key
Symmetric authentication Information-theoretic MACs:
- GCM using a 96-bit nonce and a 128-bit authenticator
- Poly1305
Public-key encryption McEliece with binary Goppa codes:
- length n = 6960, dimension k = 5413, t = 119 errors
Public-key signatures Hash-based (minimal assumptions):
- XMSS with any of the parameters specified in CFRG draft
- SPHINCS-256
What would it cost to upgrade to those recommendations?
We assume that the recommendations will survive further scrutiny and that upgrading software is for free. In practice it will happen as part of a software upgrade that will happen anyway.
What is the additional:
- Disk usage
- RAM usage
- CPU usage
- Bandwidth usage
for a normal user and for a normal website?
Since users mostly visit the same websites as they did the day before I am thinking that the key exchange may not be so scary after all. If the SSL certificate is only downloaded every few months, then it will be very little extra bandwidth.