Many companies are working to build a powerful quantum computer.Once quantum computer with large qubits is reality, asymmetric-key cryptosystem will be vulnerable for Shor's algorithm.The transition from one cryptosystem to another is very slow process and consumes many years.National Institute of Standards and Technology (NIST) is working on standardization of post-quantum cryptographic (PQC) algorithms.Security of current PQC algorithms cannot be fully verified today.So, in coming years we need to rely on both traditional algorithms and PQC algorithms.Hybrid mode consisting of one traditional algorithm and one post quantum algorithm is a best solution for smooth migration to quantum-safe cryptosystem.For key exchange, it means using two or more key exchange encapsulation algorithms for generating session key [Meher and Midhunchakkaravarthy (2019)].For authentication, it means using two or more digital signature algorithms [Meher and Midhunchakkaravarthy (2019)].There are number of approaches to combine secret key from traditional algorithm and PQC algorithm to make key encapsulation mechanism quantum-proof.In the paper we propose a new approach of using secret master key generated from one of the KEM algorithm as a salt for hashbased key derivation function (HKDF) to drive session keys from secret master key generated from another KEM algorithm.
Many companies are working to build a powerful quantum computer.Once quantum computer with large qubits is reality, asymmetric-key cryptosystem will be vulnerable for Shor's algorithm.The transition from one cryptosystem to another is very slow process and consumes many years.National Institute of Standards and Technology (NIST) is working on standardization of post-quantum cryptographic (PQC) algorithms.Security of current PQC algorithms cannot be fully verified today.So, in coming years we need to rely on both traditional algorithms and PQC algorithms.Hybrid mode consisting of one traditional algorithm and one post quantum algorithm is a best solution for smooth migration to quantum-safe cryptosystem.For key exchange, it means using two or more key exchange encapsulation algorithms for generating session key [Meher and Midhunchakkaravarthy (2019)].For authentication, it means using two or more digital signature algorithms [Meher and Midhunchakkaravarthy (2019)].There are number of approaches to combine secret key from traditional algorithm and PQC algorithm to make key encapsulation mechanism quantum-proof.In the paper we propose a new approach of using secret master key generated from one of the KEM algorithm as a salt for hashbased key derivation function (HKDF) to drive session keys from secret master key generated from another KEM algorithm.
Since the security of post-quantum cryptography (PQC) algorithms is based on the hardness of mathematical problems, while the security of quantum key distribution (QKD) relies on the fundamental principles of quantum physics, each approach possesses distinct advantages and limitations that can complement one another. Consequently, recent studies have proposed hybrid schemes that combine QKD and PQC to establish a dual-layered security model. In response to this trend, this study proposes hybrid schemes that integrate QKD with the National Institute of Standards and Technology (NIST) standardized PQC algorithms. These hybrid schemes include two core components: a hybrid QKD-PQC key exchange protocol and a hybrid QKD-PQC digital signature scheme. For the hybrid key exchange protocol, this study combines Module-Lattice-based Key Encapsulation Mechanisms (ML-KEM) with QKD protocols, specifically BB84 and E91, to construct a secure key exchange protocol. In the design of the hybrid digital signature scheme, this study utilizes Module-Lattice-based Digital Signature Algorithms (ML-DSA) and Stateless Hash-based Digital Signature Algorithms (SLH-DSA) to generate signature reconstruction values. These values are verified using confirmation codes transmitted via the BB84 and E91 protocols. The proposed hybrid key exchange protocol is evaluated by examining the shared secret key it produces, particularly with respect to entropy and whether the output is independent and identically distributed (IID). Furthermore, the computation time and message lengths of the proposed hybrid schemes are evaluated.
The fast development of cyber communications, multimedia distribution, remote working have promoted the demand to transmit sensitive information through secure means in both the public and the private networks. The advent of massive quantum computers is rendering traditional cryptographic algorithms like RSA and Elliptic Curve Cryptography (ECC) insecure because they can crack the classical public-key algorithms like the Shor and Grover algorithms. This brings an immediate need of hybrid cryptographic systems, which integrate classical, quantum, and post-quantum algorithms to provide confidentiality, integrity, authentication, and future security beyond the quantum threat horizon.The paper is a proposal of a Hybrid Quantum-Post-Quantum Cryptographic Framework of transmitting files safely. It starts by aggregating files, which is a process to compress several files, images, videos, and multimedia files that users have chosen into one file to minimize redundancy and ease encryption. The AES-256 encrypted file is in GCM mode and provides confidentiality and integrity of the compressed file.The dual-layer mechanism ensures key establishment security. To begin with, Quantum Key Distribution (QKD) based on the protocols of BB84/E91 allows the Sender and the Receiver to generate a Quantum Secret Key (QSK) by exchanging quantum bits in quantum channel. Constant monitoring of the error rate facilitates automatic eavesdropping detection, and guarantees the keys generation is made when the conditions are secure, as well as the safeguarding of interception and man-in-the-middle attacks.A post-quantum layer is provided to ensure long-term security against quantum cryptanalysis, which uses Kyber, a NIST-approved lattice-based Key Encapsulation Mechanism (KEM). The Receiver creates a key pair of Kyber and disseminates the public key to the Sender. By using encapsulation, the Sender gets a PQC ciphertext and a Shared Secret (SS), with decapsulation on the Receiver side giving ensure that only participants of good faith get the same secret value.The hybridization phase consists of combining the QSK of QKD and SS of Kyber with the help of HKDF-SHA256 to obtain a Final Wrap Key (FWK). AES-GCM encrypts the key of file encryption by wrapping it with FWK which allows a secure and authenticated transfer of the key. The Sender sends four messages: encrypted file, Kyber ciphertext, wrapped AES key and the initialisation vector. At Receiver end, FWK is calculated once again with the help of QSK and SS so that the original data can be decrypted with the help of AES key.The suggested framework provides a defense-in-depth solution based on the combination of quantum security, post-quantum resilience and authenticated symmetric encryption. It can be analyzed that there is a strong resistance to classical and quantum adversaries, scalability, and compatibility with the existing communication networks. This renders the model to be appropriate to secure government communication, military systems, data exchange in healthcare environments, cloud storage and financial infrastructures. Keywords— Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), Kyber,Key Encapsulation Mechanism (KEM), HKDF-SHA256, Quantum Secret Key (QSK), GCM Mode.
Information security is a fundamental and urgent issue in the digital transformation era. Cryptographic techniques and digital signatures have been applied to protect and authenticate relevant information. However, with the advent of quantum computers and quantum algorithms, classical cryptographic techniques have been in danger of collapsing because quantum computers can solve complex problems in polynomial time. Stemming from that risk, researchers worldwide have stepped up research on post-quantum algorithms to resist attack by quantum computers. In this review paper, we survey studies in recent years on post-quantum cryptography (PQC) and provide statistics on the number and content of publications, including a literature overview, detailed explanations of the most common methods so far, current implementation status, implementation comparisons, and discussion on future work. These studies focused on essential public cryptography techniques and digital signature schemes, and the US National Institute of Standards and Technology (NIST) launched a competition to select the best candidate for the expected standard. Recent studies have practically implemented the public key encryption/key encapsulation mechanism (PKE/KEM) and digital signature schemes on different hardware platforms and applied various optimization measures based on other criteria. Along with the increasing number of scientific publications, the recent trend of PQC research is increasingly evident and is the general trend in the cryptography industry. The movement opens up a promising avenue for researchers in public key cryptography and digital signatures, especially on algorithms selected by NIST.
Recent developments in quantum computing have shed light on the shortcomings of the conventional public cryptosystem. Even while Shor's algorithm cannot yet be implemented on quantum computers, it indicates that asymmetric key encryption will not be practicable or secure in the near future. The National Institute of Standards and Technology (NIST) has started looking for a post-quantum encryption algorithm that is resistant to the development of future quantum computers as a response to this security concern. The current focus is on standardizing asymmetric cryptography that should be impenetrable by a quantum computer. This has become increasingly important in recent years. Currently, the process of standardizing asymmetric cryptography is coming very close to being finished. This study evaluated the performance of two post-quantum cryptography (PQC) algorithms, both of which were selected as NIST fourth-round finalists. The research assessed the key generation, encapsulation, and decapsulation operations, providing insights into their efficiency and suitability for real-world applications. Further research and standardization efforts are required to enable secure and efficient post-quantum encryption. When selecting appropriate post-quantum encryption algorithms for specific applications, factors such as security levels, performance requirements, key sizes, and platform compatibility should be taken into account. This paper provides helpful insight for post-quantum cryptography researchers and practitioners, assisting in the decision-making process for selecting appropriate algorithms to protect confidential data in the age of quantum computing.
Post Quantum Cryptography (sometimes referred to as a quantum-proof, quantum-safe or quantum-resistant) refers to cryptographic algorithms (usually public-key algorithms) that are thought to be secure against an attack by a quantum computer. PQC is all about preparing for the era of quantum computing by updating existing mathematical-based algorithms and standards. The cryptographic community is working on post-quantum cryptography in order to provide alternatives using hard mathematical problems that cannot be broken by quantum computers. A hybrid scheme is recommended to ease the transition into the post-quantum era. A hybrid scheme is a combination of a traditional and a post-quantum scheme. The resulting scheme is at least as secure as one of the schemes used. In hybrid key establishment, two independent key exchanges are performed one with a traditional scheme like ECDHE and one with a post-quantum scheme like NewHope [1]. In this paper, we propose possible best-fit hybrid digital signatures.
Classical public-key cryptography, mainly RSA, is at risk from the emergence of quantum computers. A complete shift to Post-Quantum Cryptography (PQC) faces vulnerabilities due to implementation and trust issues, despite NIST's approval of standards such as ML-KEM (Kyber). This paper presented a performance and bandwidth trade-off study of a proposed Hybrid Key Encapsulation Mechanism that fused the NIST-standardized ML-KEM-768 (FIPS 203) with the traditional RSA-3072. Two separate secret keys S1 and S2 were produced and encapsulated utilizing both classical and post-quantum public keys in our dual-layered model. In order to create a strong session key that ensures trust transition and backward compatibility with current network infrastructures, these secrets were then combined using a Hybrid Key Derivation Function (HKDF). In comparison to standalone systems, the study assessed the computational cost and communication latency brought about by this hybrid overhead. According to experimental data, the hybrid architecture offers a crucial security fail-safe against both classical flaws and future quantum threats without prohibitively high performance, even though it increases ciphertext size.