The threat of a cryptographically relevant quantum computer contributes to an increasing interest in the field of post-quantum cryptography (PQC). Compared to existing research efforts regarding the integration of PQC into the Transport Layer Security (TLS) protocol, industrial communication protocols have so far been neglected. Since industrial cyber-physical systems (CPS) are typically deployed for decades, protection against such long-term threats is needed. In this work, we propose two novel solutions for the integration of post-quantum (PQ) primitives (digital signatures and key establishment) into the industrial protocol Open Platform Communications Unified Architecture (OPC UA): a hybrid solution combining conventional cryptography with PQC and a solution solely based on PQC. Both approaches provide mutual authentication between client and server and are realized with certificates fully compliant to the X.509 standard. We implement the two solutions and measure and evaluate their performance across three different security levels. All selected algorithms (Kyber, Dilithium, and Falcon) are candidates for standardization by the National Institute of Standards and Technology (NIST). We show that Falcon is a suitable option – especially – when using floating-point hardware provided by our ARM-based evaluation platform. Our proposed hybrid solution provides PQ security for early adopters but comes with additional performance and communication requirements. Our solution solely based on PQC shows superior performance across all evaluated security levels in terms of handshake duration compared to conventional OPC UA but comes at the cost of increased handshake sizes. In addition to our performance evaluation, we provide a proof of security in the symbolic model for our two PQC-based variants of OPC UA. For this proof, we use the cryptographic protocol verifier ProVerif and formally verify confidentiality and authentication properties of our quantum-resistant variants.
The threat of a cryptographically relevant quantum computer contributes to an increasing interest in the field of post-quantum cryptography (PQC). Compared to existing research efforts regarding the integration of PQC into the Transport Layer Security (TLS) protocol, industrial communication protocols have so far been neglected. Since industrial cyber-physical systems (CPS) are typically deployed for decades, protection against such long-term threats is needed. In this work, we propose two novel solutions for the integration of post-quantum (PQ) primitives (digital signatures and key establishment) into the industrial protocol Open Platform Communications Unified Architecture (OPC UA): a hybrid solution combining conventional cryptography with PQC and a solution solely based on PQC. Both approaches provide mutual authentication between client and server and are realized with certificates fully compliant to the X.509 standard. We implement the two solutions and measure and evaluate their performance across three different security levels. All selected algorithms (Kyber, Dilithium, and Falcon) are candidates for standardization by the National Institute of Standards and Technology (NIST). We show that Falcon is a suitable option – especially – when using floating-point hardware provided by our ARM-based evaluation platform. Our proposed hybrid solution provides PQ security for early adopters but comes with additional performance and communication requirements. Our solution solely based on PQC shows superior performance across all evaluated security levels in terms of handshake duration compared to conventional OPC UA but comes at the cost of increased handshake sizes. In addition to our performance evaluation, we provide a proof of security in the symbolic model for our two PQC-based variants of OPC UA. For this proof, we use the cryptographic protocol verifier ProVerif and formally verify confidentiality and authentication properties of our quantum-resistant variants.
Cyber-physical systems (CPS) are considered a crucial part for providing connectivity in industrial environments. However, the recent increase in connectivity has led to an extended attack vector. Therefore, it is important that CPS are secured against current and - due to their long life span - also against future threats, such as quantum computers. The security of present communication can be broken once a sufficiently powerful quantum computer is available. To protect against this attack vector, applications and protocols should start utilizing quantum-resistant primitives. One approach that maintains common security guarantees and protects against quantum computer attacks is to use hybrid constructions: a combination of classically secure and quantum-resistant schemes. In this work, we propose a hybrid key exchange mechanism for the industrial communication protocol Open Platform Communications Unified Architecture (OPC UA). We describe four distinct instantiations based on selected quantum-resistant key encapsulation mechanisms (KEMs), namely NewHope, NTRU, CRYSTALS-Kyber, and Saber. We implement our resulting quantum-resistant modifications of OPC UA on two different ARM based platforms and present detailed performance footprints. Finally, we show the feasibility of employing hybrid quantum-resistant key exchange within OPC UA preserving industrial communication against future threats.
While the current progress in quantum computing opens new opportunities in a wide range of scientific fields, it poses a serious threat to today?s asymmetric cryptography. New quantum resistant primitives are already available but under active investigation. To avoid the risk of deploying immature schemes we combine them with well-established classical primitives to hybrid schemes, thus hedging our bets. Because quantum resistant primitives have higher resource requirements, the transition to them will affect resource constrained IoT devices in particular. We propose two modifications for the authenticated key establishment process of the industrial machine-to-machine communication protocol OPC UA to make it quantum resistant. Our first variant is based on Kyber for the establishment of shared secrets and uses either Falcon or Dilithium for digital signatures in combination with classical RSA. The second variant is solely based on Kyber in combination with classical RSA. We modify existing opensource software (open62541, mbedTLS) to integrate our two proposed variants and perform various performance measurements
The growing interconnection of critical engineering infrastructure through IoT introduces unprecedented exposure to cyber threats. Emerging quantum computing capabilities pose a transformative risk to classical cryptographic primitives such as Rivest–Shamir–Adleman and Elliptic-Curve Cryptography, which underpin secure communication and device authentication in industrial control systems, power grids, transportation networks, and healthcare infrastructure. This paper investigates quantum-resistant encryption, often termed post-quantum cryptography (PQC), as a sustainable security paradigm for IoT communication within critical systems. By analyzing lattice-based, code-based, multivariate, and hash-based schemes, the study evaluates trade-offs between computational cost, memory footprint, and latency constraints intrinsic to resource-limited IoT nodes. A hybrid architectural framework integrating the National Institute of Standards and Technology-standardized algorithms (e.g., Cryptographic Suite for Algebraic Lattices—Kyber, Dilithium) with lightweight symmetric primitives (e.g., Ascon, GIFT block cipher in Combined Feedback mode) is proposed for secure data transmission across heterogeneous IoT layers. Experimental simulations benchmark key-exchange throughput, ciphertext expansion, and resilience against quantum-adversarial models, demonstrating up to 65% reduction in handshake latency compared to baseline lattice implementations under constrained conditions. The paper concludes with policy and engineering recommendations for the adoption of quantum-resistant IoT protocols in energy, transportation, and industrial automation sectors, highlighting alignment with global PQC migration roadmaps and IEC 62443 cybersecurity standards.
Quantum computing threatens classical cryptographic systems, particularly those used in financial security infrastructures. This paper explores the implementation of post-quantum cryptography (PQC) in financial systems, addressing the vulnerabilities of traditional schemes such as RSA, ECC, and Diffie-Hellman. It examines NIST’s standardized PQC algorithms, including Kyber for key exchange and Dilithium and Falcon for digital signatures. The study highlights the role of hybrid cryptographic approaches in ensuring a seamless transition, with a focus on post-quantum TLS 1.3 for secure financial communications. Additionally, blockchain security is analyzed with SPHINCS+ for quantum-resistant signatures. The paper reviews existing research on PQC adoption in financial applications, emphasizing security, performance, and regulatory considerations. The findings underscore the necessity of proactive PQC integration to safeguard financial transactions against quantum threats.
This thesis investigates the current state of Post-quantum cryptography (PQC) in the industry, with a particular focus on its practical deployment, integration challenges, and performance implications.The study combines a structured analysis of academic literature, standardization efforts, and industry guidance with an experimental evaluation of PQC integration in widely used security protocols. The analysis shows that, while significant progress has been made in the standardization of quantum-resistant algorithms such as ML-KEM, ML-DSA, and SLH-DSA, real-world adoption remains in an early and transitional phase. Organizations primarily focus on evaluation and pilot implementations, as deployment is constrained by interoperability issues, implementation maturity, and the complexity of migrating existing cryptographic infrastructures.To complement the conceptual analysis, experimental measurements were conducted for TLS, SSH, and IPsec to evaluate the performance impact of hybrid post-quantum cryptographic mechanisms. The results indicate that performance overhead is not uniform across components. In particular, post-quantum signature schemes introduce significant computational and network overhead, mainly due to increased key and certificate sizes. In contrast, hybrid key exchange mechanisms show only moderate performance impact across all evaluated protocols.The findings highlight that the primary challenge of PQC adoption lies not in algorithm design but in practical integration and large-scale migration. Hybrid cryptographic approaches emerge as the most viable strategy for enabling a gradual transition, balancing improved security against quantum threats with operational feasibility.Overall, this thesis demonstrates that PQC is transitioning from a theoretical research field to a practical engineering challenge, with significant implications for the future design of secure communication systems.
The advent of quantum computing has precipitated an estimated attack resistant cryptography system necessitating quantum attacks. The classical asymmetric algorithms, i.e., RSA and ECC are susceptible to Shor algorithm and a transition should be made to Post-Quantum Cryptography (PQC) anymore. The novelty of this work lies in providing a unified comparative framework that analyzes PQC families through security assumptions, concrete key/ciphertext sizes, and implementation complexity an aspect not addressed collectively in prior surveys. This survey gives a general picture of the status of the design process and general evaluation of PQC accounting its application within the paradigm of the diversified networks including the IoT and 5G/6G and in the cyber-physical environment. Furthermore, this review uniquely synthesizes practical hybrid‑deployment strategies, including protocol layering, coexistence models, and backward‑compatibility mechanisms, offering actionable guidance for real‑world migration. Additionally, the manuscript contributes a prioritized list of open problems across IoT, 5G/6G, blockchain, and cyber‑physical systems, highlighting domains facing the most urgent quantum‑resilience challenges. In this paper, the authors will evaluate the most popular PQC schemes, including schemes based on lattice, code, hash, and isogeny, depending on their performance, scalability, and interoperability (with reference to the recent research). It also examines the problems of integration as implemented with respect to the computational overhead, latency and adoption of hybrid with classical cryptography. This is expounded more to the standardization of PQC by NISTs and with a focus on such algorithms as CRYSTALS-Kyber and Dilithium. The findings suggest that, hybrid PQC protocols are able to control quantum resistance and actual performance in numerous infrastructures in computing systems.