Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2610.16100

HDKEM: Authentication Allocation for Deniable Hybrid Key Exchange

Kazi Hassan Shakib, Muhammad Asfand Hafeez, Arslan Munir

Published Oct 12, 2026• 0 citations
arXivHTMLPDF

Abstract

Deniable authenticated key exchange (DAKE) establishes a shared key without leaving transferable evidence that a party participated. We study DAKE protocols that authenticate each fresh session with one ring signature and show that their deniability mechanisms fall into three authentication allocations: sharing an authentication witness, hiding the signing witness under a fixed ring, or varying the verified ring between real and simulated executions. For fixed-ring protocols, witness hiding yields a necessary relation between the ring signature's witness-indistinguishability gap and the protocol's $(μ,δ)$ deniability parameters. We instantiate witness hiding in HDKEM, a three-slot hybrid that combines ML-KEM-768, X25519, and an optional pairwise information-theoretic source through a split-key PRF. HDKEM binds all public session values, including a QKD key identifier when present, into authentication and key derivation. Under the stated component models, it achieves eCK key indistinguishability, forward secrecy, and strong local deniability. We evaluate HDKEM with FalconRS and Gandalf. Across 2,000 primitive operations, median signing/verification times are 9.20/1.02 ms for FalconRS and 18.61/0.97 ms for Gandalf in our reference environment. In source-backed mode, the corresponding TCP-application costs are 8,607 B and 8,555 B per handshake. A separate 500-session server experiment exercises the complete FalconRS source-backed path and reports a median server time of 16.29 ms including local I/O.

DOI
10.48550/arxiv.2610.16100

Related papers

Improved Strongly Deniable Authenticated Key Exchanges for Secure Messaging

Nik Unger, Ian Goldberg

Abstract A deniable authenticated key exchange (DAKE) protocol establishes a secure channel without producing cryptographic evidence of communication. A DAKE offersstrong deniabilityif transcripts provide no evidence even if long-term key material is compromised (offline deniability) and no outsider can obtain evidence even when interactively colluding with an insider (online deniability). Unfortunately, existing strongly deniable DAKEs have not been adopted by secure messaging tools due to security and deployability weaknesses. In this work, we propose three new strongly deniable key exchange protocols—DAKEZ, ZDH, and XZDH—that are designed to be used in modern secure messaging applications while eliminating the weaknesses of previous approaches. DAKEZ offers strong deniability in synchronous network environments, while ZDH and XZDH can be used to construct asynchronous secure messaging systems with offline and partial online deniability. DAKEZ and XZDH provide forward secrecy against active adversaries, and all three protocols can provide forward secrecy against future quantum adversaries while remaining classically secure if attacks against quantum-resistant cryptosystems are found. We seek to reduce barriers to adoption by describing our protocols from a practitioner’s perspective, including complete algebraic specifications, cryptographic primitive recommendations, and prototype implementations. We evaluate concrete instantiations of our DAKEs and show that they are the most efficient strongly deniable schemes; with all of our classical security guarantees, our exchanges require only 1 ms of CPU time on a typical desktop computer and at most 464 bytes of data transmission. Our constructions are nearly as efficient as key exchanges with weaker deniability, such as the ones used by the popular OTR and Signal protocols.

Proceedings on Privacy Enhancing Technologies•Jan 1, 2018•38 citations

K-Waay:Fast and Deniable Post-Quantum X3DH without Ring Signatures

Daniel Collins, Loïs Huguenin-Dumittan, Ngoc Khanh Nguyen +2 more

The Signal protocol and its X3DH key exchange core are regularly used by billions of people in applications like WhatsApp but are unfortunately not quantum-secure. Thus, designing an efficient and post-quantum secure X3DH alternative is paramount. Notably, X3DH supports asynchronicity, as parties can immediately derive keys after uploading them to a central server, and deniability, allowing parties to plausibly deny having completed key exchange. To satisfy these constraints, existing post-quantum X3DH proposals use ring signatures (or equivalently a form of designated-verifier signatures) to provide authentication without compromising deniability as regular signatures would. Existing ring signature schemes, however, have some drawbacks. Notably, they are not generally proven secure in the quantum random oracle model (QROM) and so the quantum security of parameters that are proposed is unclear and likely weaker than claimed. In addition, they are generally slower than standard primitives like KEMs. In this work, we propose an efficient, deniable and post-quantum X3DH-like protocol that we call K-Waay, that does not rely on ring signatures. At its core, K-Waay uses a split-KEM, a primitive introduced by Brendel et al. [SAC 2020], to provide Diffie-Hellman-like implicit authentication and secrecy guarantees. Along the way, we revisit the formalism of Brendel et al. and identify that additional security properties are required to prove a split-KEM-based protocol secure. We instantiate split-KEM by building a protocol based on the Frodo key exchange protocol relying on the plain LWE assumption: our proofs might be of independent interest as we show it satisfies our novel unforgeability and deniability security notions. Finally, we complement our theoretical results by thoroughly benchmarking both K-Waay and existing X3DH protocols. Our results show even when using plain LWE and a conservative choice of parameters that K-Waay is significantly faster than previous work.

•Aug 14, 2024•0 citations

A Drop-in KEM Replacement for Client Signatures in Post-Quantum SSH

Hongbo Liu, Yufan Su, Jiangxia Ge +6 more

The transition to post-quantum cryptography is reshaping the Secure Shell (SSH) protocol for remote administration. Post-quantum key exchange has been deployed in OpenSSH and is being standardized, while SSH authentication largely remains a signature-replacement effort. This path preserves the familiar public-key credential model, but inherits the size and computation overhead of post-quantum signatures, which can increase latency, traffic, and server-side load. KEM-based authentication offers a natural alternative to this signature-centric path, and SSH makes this especially attractive at the user-authentication layer, which is method-extensible, separated from transport-layer key exchange and host-key authentication, and already protected by the established channel. We present a drop-in KEM-based user-authentication method for SSH that replaces client public-key signatures with a session-bound challenge-response proof. The method fits into SSH's existing user-authentication framework, preserving the public-key credential model and enabling incremental deployment alongside existing methods. We provide a reduction-based security argument in the post-quantum ACCE framework, implement the design in OpenSSH using liboqs, and evaluate it under representative RTTs, TCP initial-window settings, and post-quantum migration configurations. Our results show that KEM-based authentication is competitive with compact signature-based authentication under representative network settings, while reducing median handshake latency by up to about 10% against large-signature hybrid baselines. The advantages are clearer when post-quantum signatures stress transmission or computation: median latency under small TCP initial windows falls by up to 7.3% versus ML-DSA and 17.9% versus SLH-DSA, while server-side online cryptographic cost is 59.1% lower than that for ML-DSA in the same NIST category.

arXiv:2608.24447•Aug 25, 2026•0 citations

Privacy-Preserving Authenticated Key-Exchange Over Internet

Andrew Chi-Chih Yao, Yunlei Zhao

Key-exchange, in particular Diffie-Hellman key-exchange (DHKE), is among the core cryptographic mechanisms for ensuring network security. For key-exchange over the Internet, both security and privacy are desired. In this paper, we develop a family of privacy-preserving authenticated DHKE protocols named deniable Internet key-exchange (DIKE), both in the traditional PKI setting and in the identity-based setting. The newly developed DIKE protocols are of conceptual clarity and practical (online) efficiency. They provide useful privacy protection to both protocol participants, and add novelty and new value to the IKE standard. To the best of our knowledge, our protocols are the first provably secure DHKE protocols that additionally enjoy all the following privacy protection advantages: 1) forward deniability, actually concurrent non-malleable statistical zero-knowledge, for both protocol participants simultaneously; 2) the session transcript and session-key can be generated merely from DH-exponents (together with some public values), which thus cannot be traced to the pair of protocol participants; and 3) exchanged messages do not bear peer's identity, and do not explicitly bear player role information.

IEEE Transactions on Information Forensics and Security•Jan 1, 2014•36 citations

Deniable Key Exchanges for Secure Messaging

Nik Unger, Ian Goldberg

In the wake of recent revelations of mass government surveillance, secure messaging protocols have come under renewed scrutiny. A widespread weakness of existing solutions is the lack of strong deniability properties that allow users to plausibly deny sending messages or participating in conversations if the security of their communications is later compromised. Deniable authenticated key exchanges (DAKEs), the cryptographic protocols responsible for providing deniability in secure messaging applications, cannot currently provide all desirable properties simultaneously. We introduce two new DAKEs with provable security and deniability properties in the Generalized Universal Composability framework. Our primary contribution is the introduction of Spawn, the first non-interactive DAKE that offers forward secrecy and achieves deniability against both offline and online judges; Spawn can be used to improve the deniability properties of the popular TextSecure secure messaging application. We also introduce an interactive dual-receiver cryptosystem that can improve the performance of the only existing interactive DAKE with competitive security properties. To encourage adoption, we implement and evaluate the performance of our schemes while relying solely on standard-model assumptions.

ACM SIGSAC Conference on Computer and Communications Security (CCS)•Oct 6, 2015•44 citations

Quantum-Resistant Diffie-Hellman Key Exchange Protocol

A. K. M. Fakhrul Hossain

The necessity of a secure key exchange protocol arises from the critical need to establish encrypted communication over an untrusted network. Over time, a multitude of key exchange mechanisms have been developed to counteract adversarial threats. The Diffie-Hellman key exchange protocol (DHKE) is one of the most widely used protocols for symmetric key sharing. However, this protocol exhibits certain inherent limitations that attackers may exploit. It lacks authentication mechanism and is susceptible to Man-in-the-Middle (MITM) attacks and quantum attacks. To mitigate these vulnerabilities, we have designed a hybrid key exchange protocol combining DHKE with Learning With Errors (LWE), a lattice-based post-quantum primitive. This proposed protocol provides authentication via a Public Key Infrastructure (PKI) together with CRYSTALS-Dilithium digital signature, resilience against MITM attacks, and robustness against classical and quantum threats. We have done a security analysis using the Dolev-Yao threat model, extended to quantum-equipped attackers, and showed that the protocol achieves mutual authentication, session key secrecy, and forward secrecy under the hardness of LWE and DHKE. Lastly, we provided detailed parameter recommendations based on NIST standards and shed light on side-channel attacks.

SUST Journal of Science and Technology (SUST JST)•Aug 17, 2026•0 citations
Deniable authenticated key exchange (DAKE) establishes a shared key without leaving transferable evidence that a party participated. We study DAKE protocols that authenticate each fresh session with one ring signature and show that their deniability mechanisms fall into three authentication allocations: sharing an authentication witness, hiding the signing witness under a fixed ring, or varying the verified ring between real and simulated executions. For fixed-ring protocols, witness hiding yields a necessary relation between the ring signature's witness-indistinguishability gap and the protocol's (μ,δ)(μ,δ)(μ,δ) deniability parameters. We instantiate witness hiding in HDKEM, a three-slot hybrid that combines ML-KEM-768, X25519, and an optional pairwise information-theoretic source through a split-key PRF. HDKEM binds all public session values, including a QKD key identifier when present, into authentication and key derivation. Under the stated component models, it achieves eCK key indistinguishability, forward secrecy, and strong local deniability. We evaluate HDKEM with FalconRS and Gandalf. Across 2,000 primitive operations, median signing/verification times are 9.20/1.02 ms for FalconRS and 18.61/0.97 ms for Gandalf in our reference environment. In source-backed mode, the corresponding TCP-application costs are 8,607 B and 8,555 B per handshake. A separate 500-session server experiment exercises the complete FalconRS source-backed path and reports a median server time of 16.29 ms including local I/O.
Abstract A deniable authenticated key exchange (DAKE) protocol establishes a secure channel without producing cryptographic evidence of communication. A DAKE offersstrong deniabilityif transcripts provide no evidence even if long-term key material is compromised (offline deniability) and no outsider can obtain evidence even when interactively colluding with an insider (online deniability). Unfortunately, existing strongly deniable DAKEs have not been adopted by secure messaging tools due to security and deployability weaknesses. In this work, we propose three new strongly deniable key exchange protocols—DAKEZ, ZDH, and XZDH—that are designed to be used in modern secure messaging applications while eliminating the weaknesses of previous approaches. DAKEZ offers strong deniability in synchronous network environments, while ZDH and XZDH can be used to construct asynchronous secure messaging systems with offline and partial online deniability. DAKEZ and XZDH provide forward secrecy against active adversaries, and all three protocols can provide forward secrecy against future quantum adversaries while remaining classically secure if attacks against quantum-resistant cryptosystems are found. We seek to reduce barriers to adoption by describing our protocols from a practitioner’s perspective, including complete algebraic specifications, cryptographic primitive recommendations, and prototype implementations. We evaluate concrete instantiations of our DAKEs and show that they are the most efficient strongly deniable schemes; with all of our classical security guarantees, our exchanges require only 1 ms of CPU time on a typical desktop computer and at most 464 bytes of data transmission. Our constructions are nearly as efficient as key exchanges with weaker deniability, such as the ones used by the popular OTR and Signal protocols.
The Signal protocol and its X3DH key exchange core are regularly used by billions of people in applications like WhatsApp but are unfortunately not quantum-secure. Thus, designing an efficient and post-quantum secure X3DH alternative is paramount. Notably, X3DH supports asynchronicity, as parties can immediately derive keys after uploading them to a central server, and deniability, allowing parties to plausibly deny having completed key exchange. To satisfy these constraints, existing post-quantum X3DH proposals use ring signatures (or equivalently a form of designated-verifier signatures) to provide authentication without compromising deniability as regular signatures would. Existing ring signature schemes, however, have some drawbacks. Notably, they are not generally proven secure in the quantum random oracle model (QROM) and so the quantum security of parameters that are proposed is unclear and likely weaker than claimed. In addition, they are generally slower than standard primitives like KEMs. In this work, we propose an efficient, deniable and post-quantum X3DH-like protocol that we call K-Waay, that does not rely on ring signatures. At its core, K-Waay uses a split-KEM, a primitive introduced by Brendel et al. [SAC 2020], to provide Diffie-Hellman-like implicit authentication and secrecy guarantees. Along the way, we revisit the formalism of Brendel et al. and identify that additional security properties are required to prove a split-KEM-based protocol secure. We instantiate split-KEM by building a protocol based on the Frodo key exchange protocol relying on the plain LWE assumption: our proofs might be of independent interest as we show it satisfies our novel unforgeability and deniability security notions. Finally, we complement our theoretical results by thoroughly benchmarking both K-Waay and existing X3DH protocols. Our results show even when using plain LWE and a conservative choice of parameters that K-Waay is significantly faster than previous work.
The transition to post-quantum cryptography is reshaping the Secure Shell (SSH) protocol for remote administration. Post-quantum key exchange has been deployed in OpenSSH and is being standardized, while SSH authentication largely remains a signature-replacement effort. This path preserves the familiar public-key credential model, but inherits the size and computation overhead of post-quantum signatures, which can increase latency, traffic, and server-side load. KEM-based authentication offers a natural alternative to this signature-centric path, and SSH makes this especially attractive at the user-authentication layer, which is method-extensible, separated from transport-layer key exchange and host-key authentication, and already protected by the established channel. We present a drop-in KEM-based user-authentication method for SSH that replaces client public-key signatures with a session-bound challenge-response proof. The method fits into SSH's existing user-authentication framework, preserving the public-key credential model and enabling incremental deployment alongside existing methods. We provide a reduction-based security argument in the post-quantum ACCE framework, implement the design in OpenSSH using liboqs, and evaluate it under representative RTTs, TCP initial-window settings, and post-quantum migration configurations. Our results show that KEM-based authentication is competitive with compact signature-based authentication under representative network settings, while reducing median handshake latency by up to about 10% against large-signature hybrid baselines. The advantages are clearer when post-quantum signatures stress transmission or computation: median latency under small TCP initial windows falls by up to 7.3% versus ML-DSA and 17.9% versus SLH-DSA, while server-side online cryptographic cost is 59.1% lower than that for ML-DSA in the same NIST category.
Key-exchange, in particular Diffie-Hellman key-exchange (DHKE), is among the core cryptographic mechanisms for ensuring network security. For key-exchange over the Internet, both security and privacy are desired. In this paper, we develop a family of privacy-preserving authenticated DHKE protocols named deniable Internet key-exchange (DIKE), both in the traditional PKI setting and in the identity-based setting. The newly developed DIKE protocols are of conceptual clarity and practical (online) efficiency. They provide useful privacy protection to both protocol participants, and add novelty and new value to the IKE standard. To the best of our knowledge, our protocols are the first provably secure DHKE protocols that additionally enjoy all the following privacy protection advantages: 1) forward deniability, actually concurrent non-malleable statistical zero-knowledge, for both protocol participants simultaneously; 2) the session transcript and session-key can be generated merely from DH-exponents (together with some public values), which thus cannot be traced to the pair of protocol participants; and 3) exchanged messages do not bear peer's identity, and do not explicitly bear player role information.
In the wake of recent revelations of mass government surveillance, secure messaging protocols have come under renewed scrutiny. A widespread weakness of existing solutions is the lack of strong deniability properties that allow users to plausibly deny sending messages or participating in conversations if the security of their communications is later compromised. Deniable authenticated key exchanges (DAKEs), the cryptographic protocols responsible for providing deniability in secure messaging applications, cannot currently provide all desirable properties simultaneously. We introduce two new DAKEs with provable security and deniability properties in the Generalized Universal Composability framework. Our primary contribution is the introduction of Spawn, the first non-interactive DAKE that offers forward secrecy and achieves deniability against both offline and online judges; Spawn can be used to improve the deniability properties of the popular TextSecure secure messaging application. We also introduce an interactive dual-receiver cryptosystem that can improve the performance of the only existing interactive DAKE with competitive security properties. To encourage adoption, we implement and evaluate the performance of our schemes while relying solely on standard-model assumptions.
The necessity of a secure key exchange protocol arises from the critical need to establish encrypted communication over an untrusted network. Over time, a multitude of key exchange mechanisms have been developed to counteract adversarial threats. The Diffie-Hellman key exchange protocol (DHKE) is one of the most widely used protocols for symmetric key sharing. However, this protocol exhibits certain inherent limitations that attackers may exploit. It lacks authentication mechanism and is susceptible to Man-in-the-Middle (MITM) attacks and quantum attacks. To mitigate these vulnerabilities, we have designed a hybrid key exchange protocol combining DHKE with Learning With Errors (LWE), a lattice-based post-quantum primitive. This proposed protocol provides authentication via a Public Key Infrastructure (PKI) together with CRYSTALS-Dilithium digital signature, resilience against MITM attacks, and robustness against classical and quantum threats. We have done a security analysis using the Dolev-Yao threat model, extended to quantum-equipped attackers, and showed that the protocol achieves mutual authentication, session key secrecy, and forward secrecy under the hardness of LWE and DHKE. Lastly, we provided detailed parameter recommendations based on NIST standards and shed light on side-channel attacks.