# Post-Quantum (ML-DSA) Certificate Comparison
## Parse Only
(`post_quantum_comparison` Criterion group)
```bash
cargo bench -p synta-bench --bench comparison --features bench-compare -- post_quantum_comparison
```
| ML-DSA-44 | 3,992 B | 462.52 ns | 1237.0 ns | 1720.8 ns | 2610.9 ns | 7118.6 ns |
| ML-DSA-65 | 5,521 B | 462.37 ns | 1238.3 ns | 1698.1 ns | 2658.0 ns | 7168.1 ns |
| ML-DSA-87 | 7,479 B | 463.95 ns | 1236.6 ns | 1707.0 ns | 2678.0 ns | 7263.5 ns |
| **Average** | | **463 ns** | **1237 ns** | **1709 ns** | **2649 ns** | **7183 ns**|
rust-openssl and ossl ranged from 13.9–17.0 µs and 14.5–17.8 µs respectively, growing with
certificate size.
**Parse time is size-independent for synta**: the large ML-DSA signature BIT STRING
(2,420–4,627 bytes) is stored as a `BitStringRef<'a>` — a borrowed pointer+length into the
input buffer — with no copying and no content decoding. synta reads the same tag+length
fields regardless of the payload size, so a 7 KB ML-DSA-87 certificate parses as fast as a
900 B traditional one.
Comparison libraries that decode content eagerly (x509-parser, x509-cert, rust-openssl, ossl)
grow roughly linearly with the size of the payload they process. cryptography-x509 is
similarly size-independent because it also defers content decoding. NSS copies the full DER
buffer into its arena even though it doesn't decode the signature content, so it grows
slightly with certificate size.
## Parse + All Fields
(`post_quantum_comparison_fields` Criterion group)
| ML-DSA-44 | 1030.9 ns | 1256.4 ns | 1732.2 ns | 2666.0 ns | 7286.9 ns |
| ML-DSA-65 | 1124.9 ns | 1237.5 ns | 1690.5 ns | 2664.2 ns | 7222.1 ns |
| ML-DSA-87 | 1102.6 ns | 1226.5 ns | 1727.2 ns | 2696.6 ns | 7284.6 ns |
| **Average** | **1086 ns** | **1240 ns** | **1717 ns** | **2675 ns** | **7265 ns** |
synta's ML-DSA parse+fields (1.09 µs) is faster than its traditional parse+fields (1.32 µs)
because ML-DSA test certificates have shorter Distinguished Names (one attribute each in
issuer and subject vs multiple attributes in PKITS certs). The signature BIT STRING — which
is 2,420–4,627 bytes for ML-DSA — is accessed as a zero-copy slice with no size-dependent
cost. cryptography-x509 leads by only 14% here, down from its parity position in parse-only.
## Field-Level String Formatting
Parse + format the same five fields as strings on ML-DSA certificates:
| **synta** | **1.32 µs** | **1.29 µs** | **1.31 µs** | baseline |
| x509-parser | 3.34 µs | 3.22 µs | 3.40 µs | ~2.5× slower |
| NSS | 7.62 µs | 7.80 µs | 7.75 µs | ~5.9× slower |
| x509-cert | 8.22 µs | 8.10 µs | 8.25 µs | ~6.3× slower |
| rust-openssl | 15.87 µs | 17.25 µs | 18.75 µs | ~13.5× slower |
synta's field-formatting time is *size-independent* (~1.29–1.32 µs for ML-DSA vs ~1.50–1.60 µs
for traditional), because DN formatting depends only on the name bytes, not the large public key.
Other libraries parse the full certificate eagerly before accessing any field, so their cost scales
with certificate size.