Experimental evaluation of PQ-WireGuard and PQ-IPsec over LEO satellite networks

Satellite networks must establish secure channels that remain safe against large-scale quantum adversaries. Achieving post-quantum security requires post-quantum key exchange. However, most post-quantum cryptographic schemes have larger public key, ciphertext, and signature sizes than classical ones. Over satellite links with high propagation delay and non-negligible loss, larger messages are more likely to exceed the path MTU, causing fragmentation or retransmissions that degrade handshake performance. We empirically compare the handshake performance of two virtual private network protocols: WireGuard and IPsec modified with post-quantum key exchange algorithms under a simulated satellite network. Our experiments quantify the impact of message size on handshake latency and reliability, and provide practical guidance for designing quantum-secure key exchange for satellite systems.