arXiv:2502.17202

Quantum-Safe integration of TLS in SDN networks

Jaime S. Buruaga, Méndez, Ruben B., Brito, Juan P., Vicente Martín

Published Feb 24, 2025• 0 citations

Abstract

Shor's algorithm efficiently solves factoring and discrete logarithm problems using quantum computers, compromising all public key schemes used today. These schemes rely on assumptions on their computational complexity, which quantum computers can easily bypass. The solutions have to come from new algorithms - called Post-Quantum Cryptography (PQC) - or from new methods, such as Quantum Key Distribution (QKD). The former replicate the computational security ideas of classical public key algorithms, while the latter recurs to use the quantum properties of nature, which also brings a mathematical security proof, potentially offering Information-Theoretic Security. To secure data in the future, we must adopt these paradigms. With the speed of quantum computing advancements, the transition to quantum-safe cryptography within the next decade is critical. Delays could expose long-lived confidential data, as current encryption may be broken before its value expires. However, the shift must balance the adoption of new technologies with maintaining proven systems to protect against present and future threats. In this work, we have selected Transport Layer Security, one of the most widely used protocols, as the foundation to hybridize classical, quantum, and post-quantum cryptography in a way suitable for broad adoption in Software-Defined Networking, the most flexible networking paradigm that has been used to deploy integrated quantum-classical networks. To this end, we use standards for QKD key extraction and SDN integration. The purposed implementation is based on the latest version of TLS and demonstrates advanced capabilities such as rekeying and key transport across a large QKD network, while supporting crypto-agility and maintaining backward compatibility through the use of ciphersuites. The performance of this approach has been demonstrated using a deployed production infrastructure.

DOI: 10.48550/arxiv.2502.17202

Related papers

Hybrid Quantum-Safe integration of TLS in SDN networks

Jaime S. Buruaga, Ruben B. Méndez, Juan P. Brito +1 more

Shor’s algorithm efficiently solves factoring and discrete logarithm problems using quantum computers, compromising all public key schemes used today. Algorithms such as RSA, DHKE, and ECC will not work in a world with quantum computers, since they can easily invert the functions that provide their computational strength in the classical world. These schemes rely on assumptions on their computational complexity, which quantum computers can easily bypass. The solutions have to come from new algorithms – called Post-Quantum Cryptography (PQC) – or from new methods, such as Quantum Key Distribution (QKD). The former replicate the computational security ideas of classical public key algorithms, while the latter recurs to use the quantum properties of nature, which also brings a mathematical security proof, potentially offering Information-Theoretic Security. To secure data in the future, we must adopt these paradigms. With the speed of quantum computing advancements, the transition to quantum-safe cryptography within the next decade is critical. Delays could expose long-lived confidential data, as current encryption may be broken before its value expires. However, the shift must balance the adoption of new technologies with maintaining proven systems to protect against present and future threats. In this work, we have selected Transport Layer Security (TLS), one of the most widely used protocols, as the foundation to hybridize classical, quantum, and post-quantum cryptography in a way suitable for broad adoption in Software-Defined Networking (SDN), the most flexible networking paradigm that has been used to deploy integrated quantum–classical networks. To this end, we use standards for QKD key extraction and SDN integration. The purposed implementation is based on the latest version of TLS (1.3) and demonstrates advanced capabilities such as rekeying and key transport across a large QKD network, while supporting crypto-agility and maintaining backward compatibility through the use of ciphersuites. The performance of this approach has been demonstrated using a deployed production infrastructure.

Computer NetworksMay 20, 202513 citations

Benchmarking hybrid quantum-safe cryptography over real-world infrastructures

Jaime S. Buruaga, Juan Pedro Brito Méndez, Vicente Martín Ayuso

Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.

May 15, 20260 citations

Benchmarking hybrid quantum-safe cryptography over real-world infrastructures

Jaime S. Buruaga, Juan P. Brito, Vicente Martín

Abstract Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.

EPJ Quantum TechnologyMay 15, 20260 citations

Quantum resistant software Defined-Networking IPsec, enabling ITS communication over IP networks on real telco infrastructures

Rubén B. Méndez, Jaime S. Buruaga, Juan Pedro Brito Méndez +3 more

The growing dependence on digital communications underscores the need to protect data as it travels through the network. Internet Protocol Security (IPsec) plays a central role, providing a robust framework to ensure the confidentiality, integrity, and authenticity of transmitted data. However, advances in Quantum Computing pose a significant threat to current public-key cryptographic schemes by enabling efficient solutions to factoring and discrete logarithm problems. A promising solution also arises from the quantum domain. Quantum Key Distribution (QKD) provides a security layer immune to any computational attacks, whether quantum or classical. While the rapid adoption of quantum-safe technologies is highly desirable, it is equally important to ensure the resilience of existing trusted infrastructures, as the introduction of novel technologies may also entail unforeseen challenges. Enabling an evolutionary path that brings our current security infrastructure to a quantum-safe one, protected against both present and future threats, is thus very important. This work proposes a solution that integrates emerging quantum technologies into the existing security and communications infrastructure to ensure long-term protection. We focus on IPsec —one of the most widely deployed security protocols— and combine it with Software-Defined Networking (SDN) and QKD to construct a novel network security infrastructure that is resilient against both classical and quantum computational threats. Building upon recent standardization initiatives and operational tools for QKD integration, we demonstrate advanced capabilities -including rekeying and secure key transport- on a field deployed QKD network operating within a shared quantum-classical production infrastructure.

Computer NetworksMar 4, 20262 citations

Quantum-resistant Transport Layer Security

Carlos Rubio García, Simon Rommel, Sofıane Takarabt +4 more

The reliance on asymmetric public key cryptography (PKC) and symmetric encryption for cyber-security in current telecommunication networks is threatened by the emergence of powerful quantum computing technology. This is due to the ability of quantum computers to efficiently solve problems such as factorization or discrete logarithms, which are the basis for classical PKC schemes. Thus, the assumption that communications networks are secure no longer holds true. Quantum Key Distribution (QKD) and post-quantum cryptography (PQC) are the first cyber-security technologies that allow communications to resist the attacks of a quantum computer. To achieve quantum-resistant communications, the aforementioned technologies need to be incorporated into a network security protocol such as Transport Layer Security (TLS). In this paper, we describe and implement two novel, hybrid solutions in which QKD and PQC are combined inside TLS for achieving quantum-resistant authenticated key exchange: Concatenation and Exclusively-OR (XOR). We present the results, in terms of complexity and security enhancement, of integrating state-of-the-art QKD and PQC technologies into a practical, industry-ready TLS implementation. Our findings demonstrate that the adoption of a PQC-only approach enhances the TLS handshake performance by approximately 9 % compared to classical methods. Furthermore, our hybrid PQC-QKD quantum-resistant TLS comes at a performance cost of approximately 117 % during the key establishment process. In return, we substantially augment the security of the handshake, paving the road for the development of future-proof quantum-resistant communication systems based on QKD and PQC.

Computer CommunicationsNov 11, 202366 citations

Beyond encryption: post-quantum cryptography and the future of quantum-safe networks

Radhakrishnan Delhibabu

Introduction The rapid advancement of quantum computing presents an existential threat to the mathematical foundations of modern internet security. Fault-tolerant quantum computers are projected to reach the logical qubit scale necessary to execute Shor's algorithm by 2030–2035, threatening currently deployed public-key cryptography infrastructures. Methods We evaluate the performance metrics of integrating post-quantum cryptography (PQC), specifically the newly finalized NIST standards (FIPS 203, 204, and 205), with quantum key distribution (QKD) across communication networks. Results Our analysis demonstrates that while hybrid PQC-QKD models reduce long-term key compromise probabilities to near 0%, they introduce a 15% to 40% increase in bandwidth overhead during initial cryptographic handshakes. Discussion Given that enterprise-wide cryptographic migrations historically require 7–10 years, organizations face an immediate vulnerability window against “harvest now, decrypt later” adversaries. Ultimately, we propose a phased, cryptographically agile framework to achieve a Zero-Trust, Quantum-Safe network architecture within a 5-year implementation timeline.

Frontiers in Computer ScienceAug 27, 20260 citations