Post-quantum Security of OAEP Transform.

Ehsan Ebrahimi

Ehsan Ebrahimi, Dominique Unruh

Tushar Jain

This thesis studies CDOC2 or Crypto Digidoc 2, the file transmission format used in the Estonian eID ecosystem and how it can be adapted for post-quantum security. CDOC2 protects file contents with symmetric cryptography and the key material required for decryption is delivered to recipients through public-key mechanisms such as elliptic-curve Diffie-Hellman, RSA-OAEP, Capsule Server workflows, and Shares Server workflows. These classical public-key mechanisms are vulnerable to quantum computers because of Shor’s algorithm. The thesis proposes a post-quantum design that preserves the existing CDOC2 container structure and operational model wherever possible, while replacing vulnerable key establishment with ML-KEM and adding ML-DSA based authorization for container retrieval from server. A prototype implementation was developed and evaluated against validation tests. The results show that a post-quantum variant of CDOC2 can be implemented without redesigning the symmetric payload encryption layer, but several migration issues were found such as increased header and token sizes, server-side authorization changes, and the need for further production level side-channel, interoperability, and certificate-management analysis.

Marc Fischlin, Jonas von der Heyden, Marian Margraf +3 more

Alex Lombardi, Ethan Mook, Willy Quach +1 more

Khiem Pham Tuan, Minh Le, Khuong Nguyen-An

Securing bandwidth-constrained Internet of Things (IoT) and edge networks during post-quantum migration creates an authentication trade-off: ML-KEM provides post-quantum key establishment, whereas post-quantum signatures increase certificate-chain size, verification cost, and handshake latency. We present HPQ-AKE, a sign-less hybrid authenticated key exchange for RSA-enabled IoT gateways and edge/cloud services that replaces transcript signatures with dual KEMs. HPQ-AKE combines ML-KEM-768 for post-quantum session secrecy and forward secrecy with RSA-OAEP for implicit mutual authentication, preserving existing RSA-enabled infrastructure during migration. We analyze HPQ-AKE in an extended Bellare-Rogaway model, separating classical authentication in the Random Oracle Model from session-key secrecy in the Quantum Random Oracle Model. Under the Module-LWE and RSA assumptions, it establishes AKE security, forward secrecy, and conditional KCI resistance under the long-term-key-only exposure assumptions. Evaluation combines x86 micro-benchmarking, analytical latency modeling, and 10,000-iteration Monte Carlo simulation. HPQ-AKE reduces modeled handshake transmission from 13,009 to 5,668 Bytes, a 56.4% reduction relative to a Hybrid TLS 1.3 Full handshake, while requiring 7.11 ms of total local computation on the measured x86 testbed. Under a simulated 50 kbps satellite-like link with 600 ms RTT and stochastic jitter, median latency is 1,914 ms, 31.4% below the 2,791 ms baseline. At 20 ms RTT, modeled break-even thresholds are 0.31 Mbps against the pre-cached baseline and 4.08 Mbps against the full baseline; both decrease as RTT increases. These x86-based results motivate evaluation on gateway-class IoT and edge platforms; performance on ARM gateways and unaccelerated microcontrollers remains unvalidated.