TLS 1.3 — the migration phases baseline → phase 0 (hybrid KEM, classical sig) → phase 2 (PQ sig)
◆ marker on latency bars = sum of the primitive-operation medians that one handshake performs (KEM keygen+encaps+decaps + sign + 2×verify, hybrids counting both components) — a derived figure, not a measured latency; the gap between the marker and the bar is protocol overhead. ×N labels are multipliers vs that platform's classical baseline.
Full handshake matrix colored by phase, banded by stack; ᵁ = rides unstable cargo features
Primitives — same algorithm, independent implementations
Only algorithms measured by ≥2 implementations appear here. Falcon, Classic McEliece and FrodoKEM exist only in liboqs (no mature pure-Rust implementation — itself a finding); see the security-level charts below. Solid bars = hand-written asm / native code path; hatched = portable code (secondary cue — the table is authoritative).