Lattice-Based Cryptography vs Classical Cryptography for Post-Quantum Secure Aggregation

Classical Cryptography, specifically Diffie-Hellman-based masking protocols like the Bonawitz et al. scheme, currently dominates production secure aggregation deployments. This approach excels at computational efficiency, adding minimal latency to the federated learning training loop. For example, in a cross-device setting with 500 clients, the computational overhead of the classical pairwise masking is often measured in milliseconds, making it a pragmatic choice for bandwidth-constrained mobile devices where battery life and CPU cycles are at a premium.

Lattice-Based Cryptography takes a fundamentally different approach by basing its security on hard mathematical problems like Learning With Errors (LWE) and Ring-LWE, which are believed to be resistant to Shor's algorithm. This results in a significant trade-off: a dramatic increase in communication overhead. A typical lattice-based key exchange can require public keys that are 1-5 KB in size, compared to the 32-byte keys in elliptic-curve Diffie-Hellman, ballooning the total data exchanged during the setup phase of an aggregation round.

The key trade-off: If your priority is immediate deployment with minimal latency and bandwidth overhead in a trusted execution timeline, choose classical Diffie-Hellman-based secure aggregation. If you prioritize long-term data confidentiality and must guarantee that model updates aggregated today cannot be decrypted by a cryptographically relevant quantum computer in the next decade, choose a lattice-based scheme. The decision hinges on whether the 'harvest now, decrypt later' threat model is within your organization's risk tolerance.

Lattice-based cryptography excels at providing long-term confidentiality against quantum adversaries because its security relies on mathematically hard problems like Learning With Errors (LWE), for which no efficient quantum algorithm is known. For example, a Ring-LWE-based key encapsulation mechanism can replace a classical Diffie-Hellman exchange with a public key size of roughly 1-2 KB, compared to 32 bytes for an ECDH key, but it guarantees security against future CRQC (Cryptographically Relevant Quantum Computers).

Classical cryptography, specifically Diffie-Hellman-based masking in protocols like Bonawitz et al., takes a different approach by prioritizing extreme communication efficiency and low computational overhead. This results in a significant performance advantage today, with sub-millisecond key generation and minimal bandwidth consumption, but it introduces a catastrophic migration risk: all aggregated data protected today can be harvested now and decrypted later once a quantum computer exists.

The key trade-off: If your priority is immediate performance and minimizing the per-round latency for a cross-device FL system with thousands of mobile clients, choose classical ECDH-based secure aggregation. If you prioritize long-term data confidentiality and must guarantee that model updates remain secret for decades, choose a lattice-based post-quantum scheme. A pragmatic migration path involves deploying a hybrid scheme that combines both, using classical cryptography for efficiency and a lattice-based KEM to ensure post-quantum security, effectively doubling the handshake size but future-proofing the system against the quantum threat.