Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2505.14162 · EPJ Quantum Technology

Versatile quantum-safe hybrid key exchange and its application to MACsec

Jaime S. Buruaga, Augustine Bugler, Juan P. Brito, Vicente Martín, Christoph Striecks

Published Jul 4, 2025• 12 citations
arXivHTMLPDF

Abstract

Advancements in quantum computing pose a significant threat to most of the cryptography currently deployed in our communication networks. Fortunately, cryptographic building blocks to mitigate this threat are already available; mostly based on Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD), but also on symmetric cryptography techniques. Notably, those building blocks must be deployed as soon as possible in communication networks due to the “harvest-now decrypt-later” attack scenario, which is already challenging our sensitive and encrypted data today. Following an agile and defense-in-depth approach, Hybrid Authenticated Key-Exchange (HAKE) protocols have recently been gaining significant attention. Such protocols have the benefit of modularly combining classical (symmetric) cryptography, PQC, and QKD to achieve strong confidentiality, authenticity, and integrity guarantees for network channels. Unfortunately, only a few protocols have yet been proposed (mainly Muckle and Muckle+) with different flexibility guarantees. Looking at available standards in the network domain – especially at the Media Access Control Security (MACsec) standard – we believe that HAKE protocols could already bring strong security benefits to MACsec today. MACsec is a standard designed to secure communication at the data link layer in Ethernet networks by providing confidentiality, authenticity, and integrity for all traffic between trusted nodes. In addition, it establishes secure channels within a Local Area Network (LAN), ensuring that data remain protected from eavesdropping, tampering, and unauthorized access, while operating transparently to higher layer protocols. Currently, MACsec does not offer enough protection against the aforementioned threats. In this work, we tackle the challenge and propose a new versatile HAKE protocol, dubbed VMuckle, which is sufficiently flexible for use in MACsec. The use of VMuckle in MACsec provides LAN participants with quantum-safe hybrid key material to ensure secure communication even in the event of cryptographically relevant quantum computers.

DOI
10.1140/epjqt/s40507-025-00382-x

Related papers

Using QKD in MACsec for secure Ethernet networks

Joo Yeon Cho, Andrew Sergeev

Abstract Media access control security (MACsec) is an IEEE 802.1AE standard for secure communication on Ethernet links. MACsec ensures the confidentiality, integrity and origin authenticity of Ethernet frames. The secrecy of MACsec stems from a root key that is either configured as a pre‐shared key or derived from a mutual authentication protocol. However, both methods are not ideal because such a root key may be disclosed due to human errors or broken by quantum attacks. Here, the authors investigate the quantum key distribution (QKD) as an alternative source of trust for MACsec. QKD can be used as either a root key provider or a session key generator. The authors develop a new key exchange protocol based on QKD for Ethernet networks. Furthermore, it is verified by the experiment that QKD could be well integrated into MACsec without performance degradation.

IET Quantum Communication•Apr 16, 2021•15 citations

Quantum secure communication using hybrid post-quantum cryptography and quantum key distribution

Nick Aquina, Simon Rommel, Idelfonso Tafur Monroy

Once a cryptographically relevant quantum computer is built, confidential information that is communicated today can be decrypted and exposed. Key exchange methods currently used can then be broken and the key used to protect the data can be recovered. Depending on the duration for which information needs to remain confidential, quantum-safe solutions have to be used now to protect data transmitted today. In this paper, we review recent advances in integrating the combination of two different quantum-safe solutions, Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC), in existing protocols. We also combine classical cryptography, PQC and QKD to securely exchange a key that remains secure even if only one of the three key exchange methods is secure. This is one of the first steps to update existing communication methods such that they remain secure even if only one of PQC, QKD or classical cryptography is secure.

International Conference on Transparent Optical Networks•Jul 14, 2024•17 citations

Combining Post-Quantum Cryptography and Quantum Key Distribution: Taxonomy, Constructions, Proofs, Standards, Deployments and Open Problems

Mona Alotaibi, Noora Fetais, Saif M. Al-Kuwari

Post-quantum cryptography (PQC) and quantum key distribution (QKD) address the quantum threat from opposite directions: PQC replaces vulnerable public-key algorithms with schemes believed to resist quantum cryptanalysis, while QKD derives keys whose secrecy rests on physical assumptions rather than computational ones. Because each approach has a distinct failure mode, a growing body of work combines them so that a session key remains secure if either component holds. We first establish the deployed baseline, hybrid classical-plus-PQC key exchange, against which QKD-augmented designs must be judged. We then propose a taxonomy of hybrid PQC-QKD designs along eight dimensions (integration layer, combiner construction, authentication scope and source, QKD topology, trusted entities, key-delivery interface, classical component, and evidence type), and use it to compare published protocols, including Muckle and its successors, MACsec and TLS integrations, and IKEv2 mechanisms standardised in RFCs 8784, 9370, and 9867. We examine key-combiner constructions in light of the KEM-combiner literature and of NIST, ETSI, and ITU-T guidance, and map the security arguments for hybrid PQC-QKD protocols onto a common grid of security model, assumptions, permitted compromise, established guarantee, and limitations. We synthesise deployment evidence from metropolitan and national QKD networks, distinguishing the few testbeds that have run PQC in the key path from pure-QKD deployments, and summarise the standards and policy landscape, including the positions of national security agencies that recommend against relying on QKD alone. We close with open problems: authentication of the QKD classical channel, shared-infrastructure threat models, device certification versus formal proofs, formal verification of hybrid handshakes, and the lack of peer-reviewed deployment economics.

arXiv:2610.19039•Oct 13, 2026•0 citations

Quantum-safe hybrid key exchanges with KEM-based authentication

Christopher Battarbee, Christoph Striecks, Ludovic Perret +2 more

AKE (HAKE) protocol dubbed Muckle+, which is particularly useful in large quantum-safe networks consisting of a large number of nodes. The Muckle+ protocol is of a hybrid nature, in that it facilitates the incorporation of key material from conventional, post-quantum, and quantum cryptography primitives into a unified authenticated shared key. To achieve the desired authentication properties, Muckle+ utilizes post-quantum digital signatures. However, the efficiency of available instantiations of such signature schemes is not yet comparable to that of their post-quantum key-encapsulation mechanism (KEM) counterparts, particularly in large networks with potentially several connections in a short period of time. In order to address this discrepancy, the present work proposes Muckle#, a protocol that aims to expand the existing boundaries of efficiency within the HAKE framework. Muckle# utilizes post-quantum KEMs for implicit authentication, drawing inspiration from recent advancements in the domain of Transport Layer Security (TLS) protocols, particularly in KEMTLS (CCS'20). Our KEM-based approach results in a slightly different message flow compared to prior work and we developed novel proof techniques in the process. Moreover, we implemented a proof of concept, thereby demonstrating practicality of this alternative approach to authentication within HAKE.

arXiv:2411.04030•EPJ Quantum Technology•Nov 10, 2025•9 citations

Benchmarking hybrid quantum-safe cryptography over real-world infrastructures

Jaime S. Buruaga, Juan Pedro Brito Méndez, Vicente Martín Ayuso

Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.

•May 15, 2026•0 citations

Benchmarking hybrid quantum-safe cryptography over real-world infrastructures

Jaime S. Buruaga, Juan P. Brito, Vicente Martín

Abstract Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.

EPJ Quantum Technology•May 15, 2026•0 citations
Advancements in quantum computing pose a significant threat to most of the cryptography currently deployed in our communication networks. Fortunately, cryptographic building blocks to mitigate this threat are already available; mostly based on Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD), but also on symmetric cryptography techniques. Notably, those building blocks must be deployed as soon as possible in communication networks due to the “harvest-now decrypt-later” attack scenario, which is already challenging our sensitive and encrypted data today. Following an agile and defense-in-depth approach, Hybrid Authenticated Key-Exchange (HAKE) protocols have recently been gaining significant attention. Such protocols have the benefit of modularly combining classical (symmetric) cryptography, PQC, and QKD to achieve strong confidentiality, authenticity, and integrity guarantees for network channels. Unfortunately, only a few protocols have yet been proposed (mainly Muckle and Muckle+) with different flexibility guarantees. Looking at available standards in the network domain – especially at the Media Access Control Security (MACsec) standard – we believe that HAKE protocols could already bring strong security benefits to MACsec today. MACsec is a standard designed to secure communication at the data link layer in Ethernet networks by providing confidentiality, authenticity, and integrity for all traffic between trusted nodes. In addition, it establishes secure channels within a Local Area Network (LAN), ensuring that data remain protected from eavesdropping, tampering, and unauthorized access, while operating transparently to higher layer protocols. Currently, MACsec does not offer enough protection against the aforementioned threats. In this work, we tackle the challenge and propose a new versatile HAKE protocol, dubbed VMuckle, which is sufficiently flexible for use in MACsec. The use of VMuckle in MACsec provides LAN participants with quantum-safe hybrid key material to ensure secure communication even in the event of cryptographically relevant quantum computers.
Abstract Media access control security (MACsec) is an IEEE 802.1AE standard for secure communication on Ethernet links. MACsec ensures the confidentiality, integrity and origin authenticity of Ethernet frames. The secrecy of MACsec stems from a root key that is either configured as a pre‐shared key or derived from a mutual authentication protocol. However, both methods are not ideal because such a root key may be disclosed due to human errors or broken by quantum attacks. Here, the authors investigate the quantum key distribution (QKD) as an alternative source of trust for MACsec. QKD can be used as either a root key provider or a session key generator. The authors develop a new key exchange protocol based on QKD for Ethernet networks. Furthermore, it is verified by the experiment that QKD could be well integrated into MACsec without performance degradation.
Once a cryptographically relevant quantum computer is built, confidential information that is communicated today can be decrypted and exposed. Key exchange methods currently used can then be broken and the key used to protect the data can be recovered. Depending on the duration for which information needs to remain confidential, quantum-safe solutions have to be used now to protect data transmitted today. In this paper, we review recent advances in integrating the combination of two different quantum-safe solutions, Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC), in existing protocols. We also combine classical cryptography, PQC and QKD to securely exchange a key that remains secure even if only one of the three key exchange methods is secure. This is one of the first steps to update existing communication methods such that they remain secure even if only one of PQC, QKD or classical cryptography is secure.
Post-quantum cryptography (PQC) and quantum key distribution (QKD) address the quantum threat from opposite directions: PQC replaces vulnerable public-key algorithms with schemes believed to resist quantum cryptanalysis, while QKD derives keys whose secrecy rests on physical assumptions rather than computational ones. Because each approach has a distinct failure mode, a growing body of work combines them so that a session key remains secure if either component holds. We first establish the deployed baseline, hybrid classical-plus-PQC key exchange, against which QKD-augmented designs must be judged. We then propose a taxonomy of hybrid PQC-QKD designs along eight dimensions (integration layer, combiner construction, authentication scope and source, QKD topology, trusted entities, key-delivery interface, classical component, and evidence type), and use it to compare published protocols, including Muckle and its successors, MACsec and TLS integrations, and IKEv2 mechanisms standardised in RFCs 8784, 9370, and 9867. We examine key-combiner constructions in light of the KEM-combiner literature and of NIST, ETSI, and ITU-T guidance, and map the security arguments for hybrid PQC-QKD protocols onto a common grid of security model, assumptions, permitted compromise, established guarantee, and limitations. We synthesise deployment evidence from metropolitan and national QKD networks, distinguishing the few testbeds that have run PQC in the key path from pure-QKD deployments, and summarise the standards and policy landscape, including the positions of national security agencies that recommend against relying on QKD alone. We close with open problems: authentication of the QKD classical channel, shared-infrastructure threat models, device certification versus formal proofs, formal verification of hybrid handshakes, and the lack of peer-reviewed deployment economics.
AKE (HAKE) protocol dubbed Muckle+, which is particularly useful in large quantum-safe networks consisting of a large number of nodes. The Muckle+ protocol is of a hybrid nature, in that it facilitates the incorporation of key material from conventional, post-quantum, and quantum cryptography primitives into a unified authenticated shared key. To achieve the desired authentication properties, Muckle+ utilizes post-quantum digital signatures. However, the efficiency of available instantiations of such signature schemes is not yet comparable to that of their post-quantum key-encapsulation mechanism (KEM) counterparts, particularly in large networks with potentially several connections in a short period of time. In order to address this discrepancy, the present work proposes Muckle#, a protocol that aims to expand the existing boundaries of efficiency within the HAKE framework. Muckle# utilizes post-quantum KEMs for implicit authentication, drawing inspiration from recent advancements in the domain of Transport Layer Security (TLS) protocols, particularly in KEMTLS (CCS'20). Our KEM-based approach results in a slightly different message flow compared to prior work and we developed novel proof techniques in the process. Moreover, we implemented a proof of concept, thereby demonstrating practicality of this alternative approach to authentication within HAKE.
Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.
Abstract Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.