Three-Pass Hybrid Key Establishment Protocol Based on ESIGN Signature

Dariush Abbasinezhad‐Mood, Arezou Ostad‐Sharif, Morteza Nikooghadam

Konstantinos Chalkias, Spyros T. Halkidis, Dimitrios Hristu‐Varsakelis +2 more

Fei DENG, Jun He

Alexander W. Smith

Network defense platforms rely on authenticated management channels between sensors, agents, and controllers. These channels are typically secured with TLS using RSA or elliptic-curve public-key primitives that a cryptanalytically relevant quantum computer executing Shor's algorithm will break. The National Security Agency's Commercial National Security Algorithm Suite 2.0 mandates a transition to quantum-resistant cryptography for national security systems between 2030 and 2035, with hybrid classical-and-post-quantum constructions explicitly permitted during the transition. We present a hybrid attestation protocol for network management channels that combines Ed448 with ML-DSA-87 for mutual authentication and X448 with ML-KEM-1024 for session key establishment. An adversary must forge both a classical elliptic-curve signature and a lattice-based signature to impersonate a peer, and must recover both a classical elliptic-curve shared secret and a lattice-based encapsulated secret to decrypt session traffic. Authentication succeeds only when both signature verifications pass; session keys are derived from the concatenation of both shared secrets through HKDF-SHA-512. The protocol supports both trust-on-first-use key management and a PKI-backed enrollment mode under which peer public keys are authenticated by certificate chains from two parallel certificate authorities (Ed448 and ML-DSA-87). Deployments can select either mode, or a hybrid admitting both paths, allowing the protocol to fit air-gapped environments as well as deployments that require cryptographic rather than observational trust establishment. A cryptographic agility mechanism supports algorithm suite negotiation and hot-swap without device re-provisioning. We specify the protocol, analyze its security against classical and quantum adversaries, and report measured performance from a reference implementation in Python: the full handshake including mutual HELLO, hybrid key exchange, and session key derivation completes in approximately 330 milliseconds on commodity hardware using pure-Python post-quantum primitives. The protocol is one component of a larger network defense platform; a full system description appears in a companion paper.

K. Chalkias, F. Mpaldimtsi, D. Hristu-Varsakelis +1 more

Abstract: Key establishment protocols are among the most important security mechanisms via which two or more parties can generate a common session key to in order to encrypt their communications over an otherwise insecure network. This paper is concerned with the vulnerability of one-pass two-party key establishment protocols to key-compromise impersonation (K-CI) attacks. The latter may occur once an adversary has obtained the long-term private key of an honest party, and represents a serious — but often underestimated — threat. This is because an entity may not be aware that her computer has been compromised and her private key is exposed, and because a successful impersonation attack may result in far greater harm than the reading of past and future conversations. Our aim is to describe two main classes of K-CI attacks that can be mounted against all of the best-known one-pass protocols, including MQV and HMQV. We show that one of the attacks described can be somewhat avoided (though not completely eliminated) through the combined use of digital signatures and time-stamps; however, there still remains a class of K-CI threats for which there is no obvious solution. 1