A Virtual Private Network (VPN) ensures the confidentiality and integrity of data transferred between two endpoints, even if the means of transport are insecure. One popular protocol is Internet Protocol Security (IPSec) which operates at OSI layer 3 and protects all protocols at higher layers. Cryptographic keys in IPSec are negotiated using the Internet Key Exchange (IKE) protocol. IKE negotiates security parameters for IPSec sessions. In particular, the IKEv2 protocol uses the Elliptic Curve Diffie-Hellman (ECDH) algorithm to establish a secret key shared between two nodes on a network. Although solving such a problem remains difficult with current computing power, it is believed that generic quantum computers will be able to solve this problem, which implies that the security of IKEv2 is compromised. There are, however, several cryptographic systems that are trusted to be resistant to attacks by quantum computers. This family of cryptosystems is known as quantum-resistant cryptography (QRC). In this paper, after highlighting the requirements for a secure key exchange protocol, we briefly review the QRC solutions that have been proposed in the recent literature.
A Virtual Private Network (VPN) ensures the confidentiality and integrity of data transferred between two endpoints, even if the means of transport are insecure. One popular protocol is Internet Protocol Security (IPSec) which operates at OSI layer 3 and protects all protocols at higher layers. Cryptographic keys in IPSec are negotiated using the Internet Key Exchange (IKE) protocol. IKE negotiates security parameters for IPSec sessions. In particular, the IKEv2 protocol uses the Elliptic Curve Diffie-Hellman (ECDH) algorithm to establish a secret key shared between two nodes on a network. Although solving such a problem remains difficult with current computing power, it is believed that generic quantum computers will be able to solve this problem, which implies that the security of IKEv2 is compromised. There are, however, several cryptographic systems that are trusted to be resistant to attacks by quantum computers. This family of cryptosystems is known as quantum-resistant cryptography (QRC). In this paper, after highlighting the requirements for a secure key exchange protocol, we briefly review the QRC solutions that have been proposed in the recent literature.
Abstract - In the emerging era of quantum computing, traditional cryptographic algorithms such as RSA and Elliptic Curve Cryptography (ECC) are at risk from quantum-based attacks. These developments pose a significant threat to secure network communication systems that rely on classical key exchange mechanisms. To overcome this challenge, the proposed work introduces a Hybrid Quantum-Resistant Key Exchange Protocol that combines the strengths of both classical andpost-quantum cryptographic algorithms. The hybrid approach integrates Elliptic Curve Dif ie–Hellman (ECDH) with alattice-based post-quantum algorithm, Kyber, to establish a shared session key between communicating entities. This sharedkeyisthen utilized for symmetric encryption using AES to ensure confidentiality and data integrity. The system is implementedusingPython socket programming to demonstrate secure data transmission between client and server. Performance is analyzedinterms of key generation time, encryption and decryption speed, key size, and computational ef iciency. The results validatethatthe proposed hybrid model provides enhanced resistance against quantum attacks while maintaining acceptable performance, making it suitable for future secure communication systems. Keywords - elliptic curve dif ie–hellman, hybrid key exchange, kyber, post-quantum cryptography, quantum computing.
Within 1–2 decades, quantum computers may become powerful enough to break current public-key cryptography, prompting authorities such as the IETF and NIST to push for adopting quantum-resistant cryptography (QRC) in ecosystems like Internet Protocol Security (IPsec). Yet, IPsec struggles to adopt QRC, primarily because Internet Key Exchange Protocol Version 2 (IKEv2), which sets up IPsec sessions, cannot easily tolerate the large public keys and digital signatures of QRC. Many IETF RFCs have been proposed to integrate QRC into IKEv2, but their performance and interplay remain largely untested in practice. In this paper, we measure the performance of these RFCs over constrained links by developing a flexible, reproducible measurement testbed for IPsec with quantum-resistant IKEv2 proposals. Deploying our testbed in lossy wireless links and on the internationally distributed FABRIC testbed for Internet scenarios, we reveal that bottlenecks arise with quantum-resistant IKEv2 under high round-trip times, non-trivial packet loss, or other constraints. Our results, including the revelation of a 400–1000-fold increase in data overhead over high-loss wireless links, expose the shortcomings of today’s RFCs and call for further work in this vital area of post-quantum network security.
The recent advances in the development of quantum computers pose a threat to the cryptography used today. While symmetric algorithms can adapt to those challenges, no prevalent key exchange method can protect against quantum computer based attacks. There already exist several new, quantum-resistant approaches. Yet, all of them either lack in confidence regarding their security or require large data to be transmitted. Due to the lack of confidence in these algorithms, researchers tend towards hybrid key exchange methods which combine at least two different algorithms. As long as one of them prevails, the shared secret remains secure. Yet, these hybrid key exchanges together with algorithms which transmit large payloads require significant changes to the design of security protocols. IKEv2 is willing to introduce radical changes in order to support as many different algorithms as possible. This was expected to impact the protocol's operational feasibility, but remained to be tested due to the lack of a working reference implementation of the newly proposed internet drafts. To address this issue, we implemented these drafts using a modified version of the OpenIKED as basis that already comprised the first steps towards the concept's integration. During the implementation we found that several design choices severely hinder a clean and maintainable structure. With the resulting implementation, we tested the adjusted protocol under real-world conditions. The results show that the result generally works but struggles to cope with slow, lossy networks. Based on these insights, we drafted an improved protocol design which also supports the full range of quantum-resistant key exchange methods. In contrast to the current drafts, it promises a cheaper and more maintainable implementation.
The threats are existential to the traditional cryptosystems of public keys, including RSA, Diffie-Hellman, and elliptic curve cryptography (ECC), due to the rapid progress in quantum computing. Such algorithms as the Shor and Grover algorithms prove that as soon as large scale quantum computers are achieved, these classical cryptographic protocols will not provide any privacy and integrity to online communication. This has created an emergency to find post-quantum cryptography (PQC), or quantum-safe cryptography, which will resist attacks by both classical and quantum attackers. The paper is a review of the latest research and development in post-quantum cryptographic algorithms and their implementation in current security systems. We organize quantum-safe methods into significant organizations such as lattice-based, hash-based, multivariate polynomial-based and code-based encrypted communications. Each type has been evaluated critically based on computational efficiency, key sizes, speed of encryption/decryption and security proofs. The survey also examines the current standardization activities happening in the world and especially the U.S. National Institute of Standards and Technology (NIST) PQC competition, which lists candidate algorithms that have advanced to standard adoption. Besides this, the paper addresses hybrid cryptographic designs that use both classical and post-quantum bases in ensuring a seamless migration in the transition phase. Internet security protocols like TLS, VPNs and blockchain consensus as applications of PQC are examined in detail. Lastly, we pinpoint open research issues, which include creating lightweight PQC to support resource-constrained IoT devices, balancing performance and strong security assurances, and interoperability between the new PQC algorithms and existing infrastructures. Through detailed survey we inform the future of researchers, practitioners, and policymakers on the preparation of the post-quantum era of secure digital communications.
The development of quantum computers will provide modern cryptographic systems with a practical computing infrastructure, yet the number-theoretic assumptions these systems are built on poses an acute security risk at this juncture, especially when Shor and Grover’s algorithms are considered. In this article, we present QRC-Stack (Quantum Resilient Cryptographic Stack): A modular architecture for post quantum about cyber resilient communication in current and next generation infrastructures of the internet. QRC-Stack combines lattice-based and hash-based schemes with transport layers and key management to guarantee data integrity, confidentiality, and authenticity within classical networks as well as software-defined networks. The architecture of QRC-Stack is enhanced by incorporating hybrid key exchange models that integrate classical (e.g., ECDH) and post-quantum (PQ) cryptography; Kyber and Dilithium from NIST PQC finalists to sustain legacy interoperability while advancing resilience to future threats in quantum networked environments The newly proposed QRC-Stack model includes three interrelated parts that together improve the security and flexibility of cryptographic communication within a quantum-threat context. Starting with the key management layer for quantum-aware systems (QKML), it incorporates a session key distribution system that the quantum cryptography foe cannot breach. Furthermore, the Adaptive Cipher Suite Negotiation (ACSN) injects a more node centric, risk-adaptive model in whereby selection of a cryptographic suite from a pool of available options is done dynamically where the suit best optimizes contextual threat. In addition, Q-Protect Transport Module enables seamless alignment with pre-existing transport protocols such as TLS/IPSec and QUIC or SD-WAN tunnels with limited overhead footprint. Emulation testing on SDN testbeds and active WAN environments showed that QRC-Stack sustained enterprise-class encryption throughput while adding latency overhead less than eight percent. Moreover, this hybrid architecture gives forward secrecy and stronger resistance to quantum-enhanced man-in-the-mid solar attacks with faster key refresh rates. QRC-Stack also outperformed classical TLS 1.3 alongside other variants of Transition Post Quantum Cryptography’, claiming steadfast post-compromised security while surpassing baseline models in adaptability, resilience, and versatility making it ideal for next-generation network backbone design. This information reconfirms QRC-Stack's supurb strength as an extensible multi layered blanced framework solution for communication systems in layers form situated in scenarios involving surveillance from powerful post-quantum adversaries. It helps to control the move toward safely moving quantum national, enterprise, and IoT networks from cryptographic systems built for surveillance heavy environments with minimal changes to current infrastructure.