Cloud-native application platforms and latency-sensitive systems such as 5G Core networks rely heavily on certificate-based Public Key Infrastructure (PKI) and mutual TLS to secure service-to-service communication. While effective, this model introduces significant operational and performance overhead, which is further amplified in the post-quantum setting due to large certificates and expensive signature verification. In this paper, we present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption(IBE). Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation. We describe an IBE-based replacement for private PKI, including identity lifecycle management, and show how it can be instantiated using a threshold Private Key Generator (T-PKG). We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks. In particular, we demonstrate how identity-based TLS integrates with the 5G Service-Based Architecture while preserving security semantics and 3GPP requirements, and we show how the same architecture can replace private PKI in Kubernetes, including its control plane, without disrupting existing trust domains or deployment models.
Cloud-native application platforms and latency-sensitive systems such as 5G Core networks rely heavily on certificate-based Public Key Infrastructure (PKI) and mutual TLS to secure service-to-service communication. While effective, this model introduces significant operational and performance overhead, which is further amplified in the post-quantum setting due to large certificates and expensive signature verification. In this paper, we present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption(IBE). Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation. We describe an IBE-based replacement for private PKI, including identity lifecycle management, and show how it can be instantiated using a threshold Private Key Generator (T-PKG). We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks. In particular, we demonstrate how identity-based TLS integrates with the 5G Service-Based Architecture while preserving security semantics and 3GPP requirements, and we show how the same architecture can replace private PKI in Kubernetes, including its control plane, without disrupting existing trust domains or deployment models.
Current cellular authentication mechanisms rely primarily on SIM-based Authentication and Key Agreement (AKA), which have scaled successfully worldwide but face challenges as the Internet of Things (IoT) grows to billions of devices. SIM provisioning and lifecycle management become increasingly costly, while reliance on long-term symmetric keys limits revocation flexibility and cross-operator support. To address these issues, we propose a SIM-less, certificate-based authentication framework that integrates Public Key Infrastructure (PKI) with post-quantum cryptography (PQC). Specifically, the framework employs Kyber for key encapsulation and Dilithium for digital signatures, providing quantum-resistant protection for future networks. A key challenge is the computational overhead of PQC on constrained IoT devices; we address this by offloading cryptographic operations to trusted edge servers, whose integrity is validated using attestation mechanisms such as Trusted Platform Modules (TPMs) or secure enclaves. We implement and evaluate the framework in a simulated FutureG environment, comparing IoT-only execution against edge-assisted configurations. Results show that edge offloading reduces TLS handshake latency by up to 96% while maintaining minimal resource usage on devices. These findings demonstrate that PQC-enabled PKI, combined with edge-assisted execution, offers a scalable and practical complement to SIM/AKA for secure and quantum-resilient authentication in FutureG IoT deployments.
Cloud-native application ecosystems increasingly rely on large-scale microservices architectures composed of ephemeral containers, serverless functions, and service-mesh–enabled workloads that are dynamically instantiated and terminated. While Transport Layer Security (TLS) and classical public-key cryptographic mechanisms currently provide confidentiality and authentication for inter-service communication, these approaches are increasingly inadequate in the presence of emerging quantum computing capabilities. In particular, widely deployed algorithms such as RSA and elliptic curve cryptography (ECC) are vulnerable to quantum attacks, exposing long-lived secrets, archived data, and east–west service traffic to “harvest-now, decrypt-later” adversarial strategies. Moreover, existing encryption and key management solutions are not designed to provide true end-to-end encryption (E2EE) across highly dynamic microservices boundaries, nor do they adequately support crypto-agility in cloud-native environments. This paper proposes a scalable, quantum-resistant end-to-end encryption management framework tailored for cloud-native microservices ecosystems. The framework integrates post-quantum cryptographic (PQC) key exchange mechanisms with automated, policy-driven key lifecycle management to secure both data-in-motion and data-at-rest across heterogeneous deployment models. By decoupling cryptographic control planes from application logic and leveraging service identity–based trust establishment, the proposed approach enables seamless E2EE without disrupting microservice scalability or elasticity. Experimental evaluation conducted on a Kubernetes-based microservices testbed demonstrates that the framework achieves strong quantum-resilient security guarantees with manageable latency overhead, while supporting high-throughput service-to-service communication and rapid key rotation. The results indicate that quantum-resistant encryption can be practically integrated into modern cloud-native systems, providing a future-proof security foundation for next-generation distributed applications.
The impending threat posed by quantum-capable adversaries necessitates a secure and practical transition of Public Key Infrastructures (PKIs) to support post-quantum cryptography (PQC). This paper addresses the multifaceted challenges of integrating PQC into existing PKI ecosystems by examining novel cryptographic combiners and hybrid certificate designs that can provide quantum-resistant security. We assess the performance, compatibility, and security of these hybrid certificates across standard communication protocols such as TLS, considering variations in root and intermediate certification paths. In addition, we introduce key management procedures that cover signature generation, validation, and lifecycle considerations under both software and hardware constraints. Beyond X.509, alternative trust models and certificate mechanisms are also analyzed for specialized domains, including IoT, firmware signing, and smart cards.
The transition to a cloud-native 5G Service-Based Architecture (SBA) improves scalability but exposes control-plane signaling to emerging quantum threats, including Harvest-Now, Decrypt-Later (HNDL) attacks. While NIST has standardized post-quantum cryptography (PQC), practical, deployable integration in operational 5G cores remains underexplored. This work experimentally integrates NIST-standardized ML-KEM-768 and ML-DSA into an open-source 5G core (free5GC) using a sidecar proxy pattern that preserves unmodified network functions (NFs). Implemented on free5GC, we compare three deployments: (i) native HTTPS/TLS, (ii) TLS sidecar, and (iii) PQC-enabled sidecar. Measurements at the HTTP/2 request-response boundary over repeated independent runs show that PQC increases end-to-end Service-Based Interface (SBI) latency to approximately 54 ms, adding a deterministic 48-49 ms overhead relative to the classical baseline, while maintaining tightly bounded variance (IQR <= 0.2 ms, CV < 0.4%). We also quantify the impact of Certification Authority (CA) security levels, identifying certificate validation as a tunable contributor to overall delay. Overall, the results demonstrate that sidecar-based PQC insertion enables a non-disruptive and operationally predictable migration path for quantum-resilient 5G signaling.
In mobile networking, specifically in 5G networking, embedded SIM (eSIM) does not rely on the hardware chips to deliver the core network’s public key as traditional SIM cards do. Instead, eSIM utilizes remote digital certificates enabled by Public Key Infrastructure (PKI). In this research, we study the post-quantum transition of eSIM-based mobile networking by applying and incorporating the post-quantum ciphers to the digital certificates and authentication. While building on the existing mutual authentication between the user equipment and core network, we build quantum resistance in the digital signatures used for the digital certificate and authentication so that they are secure against quantum-computing attackers. We implement our scheme using the NIST-standardized post-quantum ciphers to evaluate the computing/time and battery/power overheads, which are important for resource-constrained mobile devices. We compare the post-quantum ciphers with the current quantum-vulnerable ciphers and show that the lattice-based schemes have comparable or even better overhead performances.
The X.509 certificate model underpinning global HTTPS security faces an existential dual threat: the imminent arrival of cryptographically relevant quantum computers capable of breaking current public-key algorithms, and the systemic architectural weaknesses of the certificate lifecycle that persist regardless of algorithm substitution. Certificate expiry failures, revocation infrastructure unreliability, CA compromise, and the operational burden of certificate lifecycle management represent failure modes that post-quantum algorithm substitution alone cannot resolve. This paper presents EPQI (Ephemeral Post-Quantum Identity-Based Key Agreement), a systems architecture for certificate-free TLS that addresses the quantum threat at the architectural level. EPQI replaces the X.509 certificate with an identity-based trust model in which a server's domain name is its cryptographic identity. Session keys are derived ephemerally on demand by a Private Key Generator (PKG) using NIST-standardised post-quantum primitives (ML-KEM, FIPS 203; ML-DSA, FIPS 204), and destroyed immediately after session termination. The certificate lifecycle is eliminated entirely. EPQI introduces a blinded ephemeral PKG construction satisfying identity privacy and session unlinkability, constituting an architectural resolution of the key escrow problem. The required security properties of this construction are formally specified; the formal cryptographic instantiation is identified as an open problem. The architecture is designed for overlay deployment on existing DNS and network infrastructure. Regulatory alignment with DORA, NIS2, NIST IR 8547, and ENISA post-quantum guidance provides a compliance-driven deployment rationale for financial sector operators.