Hybrid key establishment runs a post-quantum key-encapsulation mechanism (KEM) alongside a classical Diffie-Hellman primitive, so that the session key stays secure while either component resists attack. This design is now standardized in the Transport Layer Security protocol, Secure Shell, and the Internet Key Exchange, with the standardized module-lattice KEM (ML-KEM) as the post-quantum component. A hybrid KEM secures the derived key, but not the integrity of the negotiation that selects which primitives are used. Full protocols authenticate that negotiation through a handshake transcript; a hybrid KEM deployed as a standalone drop-in primitive, or inside a minimal handshake without transcript authentication, inherits no such guarantee, and an active attacker can strip the post-quantum option. We ask what the key schedule alone must contain to make downgrade resilience a local property of the combiner. We give a game-based definition at the combiner layer and prove a two-sided separation: a combiner that ignores the transcript is downgraded with certainty, whereas one that binds the session key and the confirmation tag to a hash of the transcript blocks every such attempt, up to a term negligible for a 256-bit transcript hash. We also give an explicit strongest-link security bound. Using a calibrated cost model composed from published Cortex-M4 measurements, transcript binding adds one hash per party - about 11.8% of handshake computation but only 1.5% of radio-inclusive energy - and adds no messages or bytes on the wire. Every reported number is produced by a released harness that passes a 30-check validation gate.
Hybrid key establishment runs a post-quantum key-encapsulation mechanism (KEM) alongside a classical Diffie-Hellman primitive, so that the session key stays secure while either component resists attack. This design is now standardized in the Transport Layer Security protocol, Secure Shell, and the Internet Key Exchange, with the standardized module-lattice KEM (ML-KEM) as the post-quantum component. A hybrid KEM secures the derived key, but not the integrity of the negotiation that selects which primitives are used. Full protocols authenticate that negotiation through a handshake transcript; a hybrid KEM deployed as a standalone drop-in primitive, or inside a minimal handshake without transcript authentication, inherits no such guarantee, and an active attacker can strip the post-quantum option. We ask what the key schedule alone must contain to make downgrade resilience a local property of the combiner. We give a game-based definition at the combiner layer and prove a two-sided separation: a combiner that ignores the transcript is downgraded with certainty, whereas one that binds the session key and the confirmation tag to a hash of the transcript blocks every such attempt, up to a term negligible for a 256-bit transcript hash. We also give an explicit strongest-link security bound. Using a calibrated cost model composed from published Cortex-M4 measurements, transcript binding adds one hash per party - about 11.8% of handshake computation but only 1.5% of radio-inclusive energy - and adds no messages or bytes on the wire. Every reported number is produced by a released harness that passes a 30-check validation gate.
Introduction Session establishment, the process by which two parties authenticate each other and derive a shared secret key, forms the foundation for secure digital communication. Quantum computers threaten this foundation by breaking classical public-key primitives such as RSA and elliptic-curve Diffie–Hellman (ECDH), thereby enabling harvest-now–decrypt-later (HNDL) attacks that endanger long-term confidentiality. Methods This paper presents the design, implementation, and evaluation of an authenticated, quantum-resistant session protocol that replaces these vulnerable mechanisms with their post-quantum counterparts. The proposed protocol integrates ML-KEM-1024 (FIPS 203; CRYSTALS, Kyber) for ephemeral key exchange, ML-DSA-65 (FIPS 204; CRYSTALS, Dilithium) for endpoint authentication, and AES-256-GCM for symmetric protection. A transcript-bound HKDF–SHA3-256 key schedule and a 96-bit GCM nonce construction with conservative rekey limits are used to ensure forward secrecy, downgrade resistance, and message integrity. A Python/C prototype (PQClean ML-KEM-1024 with PyCryptodome AES-256-GCM) was benchmarked over 1,000 iterations on commodity hardware. Results The results show that sub-millisecond cryptographic overhead ML-KEM-1024 matches the performance of X25519 while vastly outperforming RSA-3072 in secure session establishment, and symmetric encryption remains cost effective. Nonces are unique 96-bit values, never reused across directions or beyond 2³² records, following NIST SP 800-38D; when nonce-misuse resistance is required, AES-256-GCM-SIV (RFC 8452) is supported as a drop-in alternative. Empirical tests under both local and WAN-emulated ( ≈ 40 ms RTT) network conditions confirm that the additional post-quantum cost maintains the handshake cryptographic latency in the 0.50–0.70 ms range. Discussion These results demonstrate that fully authenticated, forward-secure, quantum-resistant session negotiation is practical for real-world deployments.
The quantum internet is evolving from isolated point-to-point quantum key distribution links toward a globally interconnected, multi-layer protocol stack supporting entanglement distribution, quantum teleportation, and distributed quantum computing. As this architecture matures, each protocol layer-physical, link, network, transport, and application exposes negotiable security parameters: QKD protocol type, entanglement fidelity thresholds, purification rounds, error-correction schemes, and authentication methods. Yet no standardized mechanism exists to negotiate these parameters securely across layers or to prevent adversarial downgrade. The classical internet spent two decades rediscovering this lesson through attacks such as POODLE, FREAK, Logjam, KNOB, and Dragonblood; the quantum internet is now repeating the same architectural oversight. This study introduces QShield , a cross-layer security negotiation framework that binds every layer’s capability commitment into a unified transcript hash, ensuring that any single-layer downgrade invalidates the session-wide security context. We formalize a quantum security downgrade hierarchy spanning six levels from device-independent QKD to classical cryptography and identify twelve concrete downgrade attack vectors mapped from classical analogs. Evaluation across all twelve attack types shows that QShield with cross-layer transcript binding achieves 100% deterministic detection across the twelve modeled downgrade vectors evaluated under emulation, whereas independent per-layer checks detect only 40–60% of coordinated multi-layer attacks. Hybrid mode preserves near-classical session bootstrap latency (48-55 ms versus 25-30 ms baseline), while the signaling overhead remains within practical bounds (3.5-5 KB versus 0.8-1.2 KB for classical).
The Internet Key Exchange Protocol Version 2 (IKEv2) underpins Internet Protocol Security (IPsec) by establishing secure associations and negotiating cryptographic keys. Its reliance on classical public-key primitives such as Elliptic Curve Diffie–Hellman (ECDH) renders it vulnerable to quantum attacks, as Shor’s algorithm can break these schemes once large-scale quantum computers become available. To address this challenge, we integrate post-quantum cryptography into IKEv2 using a hybrid key exchange combining ECDH over P-384 with the ML-KEM-768 parameter set of the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), following Request for Comments (RFC) 9370 and RFC 9242. We present a Fragmentation Boundary Model that identifies when post-quantum payloads approach or exceed the non-fragmenting IKE_SA_INIT payload budget across ML-KEM parameter sets, Internet Protocol (IP) versions, and effective path maximum transmission units (PMTUs). We implemented the hybrid design on a Texas Instruments TM4C1294 microcontroller running FreeRTOS and CycloneTCP, and measured its execution time, memory footprint, and network overhead. Across 150 successful handshakes per configuration, mean Security Association establishment time increased from 3390.4 to 3488.6 ms, an overhead of 98.2 ms (2.9%). Flash use increased by 8%, random-access memory (RAM) use by 5%, and total IKEv2 traffic size by 42%, while no IP fragmentation was observed under the evaluated Internet Protocol version 4 (IPv4) conditions. These findings establish the feasibility of the evaluated hybrid configuration on the TM4C1294 platform and provide a platform-specific baseline for further evaluation of quantum-resilient IPsec on embedded automotive architectures.
Post-quantum authenticated key exchange is needed for Internet of Things (IoT) systems facing quantum-enabled adversaries, but signature-heavy post-quantum handshakes remain costly for constrained devices and long-delay non-terrestrial network (NTN) links. This paper proposes NTN-PQ-AKE, a lightweight, transcript-bound authenticated key exchange for managed IoT/NTN deployments. The protocol avoids online post-quantum signatures by combining the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) with provisioned symmetric token material, replay-window checking, transcript-bound derivation using the HMAC-based Key Derivation Function (HKDF), and two-way confirmation tags. Its principal novelty relative to the KEM-based baselines considered here is the joint provision of pair-scoped pre-authentication before ML-KEM processing, complete binding of the key-establishing transcript, and fail-closed two-way key confirmation for managed IoT/NTN deployments. Its “authenticate first, compute later” design rejects forged initiations before expensive KEM processing, while each endpoint releases local session keys only after verifying the role-specific peer confirmation for the same transcript-derived state. Security analysis under a Dolev–Yao adversarial model shows that, within the stated freshness and provisioning assumptions, NTN-PQ-AKE supports mutual authentication, KEM-derived session-key freshness for uncompromised sessions, replay and man-in-the-middle resistance, transcript integrity, and scoped resource-exhaustion mitigation; it does not claim full perfect forward secrecy after later endpoint-key compromise. Across 100 measured runs after five warm-up runs, hardware profiling on an STM32F407G-DISC1 Cortex-M4 gives a mean combined Alice-and-Bob handshake cost of 3,812,967 cycles (SD 13,420; 95% CI half-width 2,662), or 22.70 ms at 168 MHz, with 52,356 B of text, 136 B of data, and 68,664 B of bss. OMNeT++ evaluation shows that NTN-PQ-AKE transmits 2,472 bytes and completes in approximately 524.67 ms on the modeled NTN channel.
This paper describes a hybrid key-encapsulation mechanism (KEM): a way for two parties to agree on a shared 32-byte secret that stays safe as long as either of two very different building blocks remains unbroken. The first building block is classical RSA-2048. The second is ML-KEM-768, the lattice-based KEM that NIST standardized as FIPS 203. We run both, then mix their two secrets with HKDF-SHA-256 to produce one session key. The pay-off is simple: an attacker has to break both RSA and ML-KEM to learn the session key, so the scheme protects you today (when RSA is strong) and continues to protect you after a quantum computer breaks RSA (when ML-KEM carries the load). A second, independent idea appears here only as an engineering optimization: the Furui 6n±1 sieve, a fast way to generate RSA primes. We are explicit that the sieve contributes nothing to security — it just makes classical key generation cheaper during the migration period, when systems keep minting new RSA keys. We prove this carefully so that no reader mistakes a performance trick for a security feature. The paper is written for engineers who want to deploy a hybrid KEM correctly. The main text explains the construction, the threat model, and how to implement it safely. The appendices give the full formal security reduction, the statistical validation of the sieve, and a reproducible benchmark methodology for readers who want the underlying detail.
Matter's first post-quantum change protects device attestation with ML-DSA, but its operational handshake, CASE, still derives session keys from P-256 ECDH, so recorded traffic can be decrypted once a quantum computer exists. We quantify the cost of moving CASE to ML-KEM and post-quantum signatures over Thread, where frames carry at most 127 bytes and a Matter message at most 1178 bytes. A byte-exact model of the CASE messages shows that a drop-in ML-KEM-768/ML-DSA-44 handshake grows from 1.6 kB to 22.8 kB and that no fully post-quantum configuration built from FIPS 203/204/205 algorithms fits the message limit. A Monte Carlo model of multi-hop Thread, calibrated to OpenThread and Matter source constants, shows that sending these messages as fragmented IPv6 datagrams causes spurious retransmissions whenever a message and its reply outlast Matter's retransmission timer. At three to four hops the drop-in handshake then takes 1.8 to 2.6 times longer than with a selective-repeat block transfer, with or without interference, and up to 33% of handshakes with sleepy devices fail; raising the timers does not remove the effect. Caching certificate chains and authenticating the device with a pre-distributed ML-KEM key reduce the handshake to 6.1 kB and 44 ms of device computation. As a first step, hybrid P-256+ML-KEM-512 key exchange with a cached device chain protects session keys against harvest-now, decrypt-later attacks while every message still fits the current limit.