Hybrid authenticated key exchange combines cryptography key material from different sources (classical, quantum and post-quantum cryptography) to build protocols that are resilient to catastrophic failures, technology advances and future cryptanalytic attacks. In this work, we propose and implement a triple-hybrid version of the transport layer security network protocol TLS 1.3, combining classical and post-quantum cryptography, and quantum key distribution. We evaluate the performance of this triple-hybrid TLS in an experimental network scenario and our analysis shows that the quantum-resistant feature comes at an increased communication cost of approximately 68 % over the total time of the composite handshakes. In exchange, our solution is an enhancement to the TLS 1.3 protocol by adding quantum-resistant cryptography schemes.
Hybrid authenticated key exchange combines cryptography key material from different sources (classical, quantum and post-quantum cryptography) to build protocols that are resilient to catastrophic failures, technology advances and future cryptanalytic attacks. In this work, we propose and implement a triple-hybrid version of the transport layer security network protocol TLS 1.3, combining classical and post-quantum cryptography, and quantum key distribution. We evaluate the performance of this triple-hybrid TLS in an experimental network scenario and our analysis shows that the quantum-resistant feature comes at an increased communication cost of approximately 68 % over the total time of the composite handshakes. In exchange, our solution is an enhancement to the TLS 1.3 protocol by adding quantum-resistant cryptography schemes.
The emergence of quantum computing poses a threat to classical cryptography algorithms, necessitating a shift to quantum secure cryptography. Hybrid protocols combining at least one classical and one quantum-resistant cryptographic algorithm are becoming the standard for securing communications. In this work, we present our novel solution for integrating three different cryptographic assumptions (two of them quantumresistant) into hybrid network security protocols, ensuring that three different cryptographic assumptions must be broken before the protocol becomes vulnerable. Our solution allows for a seamless integration of classical and post-quantum (PQ) cryptography, and quantum key distribution (QKD) into existing network security protocols (e.g., TLS, IPsec) without any major modifications to the protocols themselves. This crypto-agility ensures the mitigation of some of the most well known challenges of both PQ cryptography and QKD. Our findings demonstrate the feasibility of such triple-hybrid network security protocols, showing non-substantial decrease in performance and almost no added packet overhead compared to state of the art protocols. In exchange, we pave the way towards next generation networks where the potential of new quantum-resistant cryptographic schemes can be leveraged in a dynamic and agile fashion, thus fostering a new era of unbreakable communication systems.
The reliance on asymmetric public key cryptography (PKC) and symmetric encryption for cyber-security in current telecommunication networks is threatened by the emergence of powerful quantum computing technology. This is due to the ability of quantum computers to efficiently solve problems such as factorization or discrete logarithms, which are the basis for classical PKC schemes. Thus, the assumption that communications networks are secure no longer holds true. Quantum Key Distribution (QKD) and post-quantum cryptography (PQC) are the first cyber-security technologies that allow communications to resist the attacks of a quantum computer. To achieve quantum-resistant communications, the aforementioned technologies need to be incorporated into a network security protocol such as Transport Layer Security (TLS). In this paper, we describe and implement two novel, hybrid solutions in which QKD and PQC are combined inside TLS for achieving quantum-resistant authenticated key exchange: Concatenation and Exclusively-OR (XOR). We present the results, in terms of complexity and security enhancement, of integrating state-of-the-art QKD and PQC technologies into a practical, industry-ready TLS implementation. Our findings demonstrate that the adoption of a PQC-only approach enhances the TLS handshake performance by approximately 9 % compared to classical methods. Furthermore, our hybrid PQC-QKD quantum-resistant TLS comes at a performance cost of approximately 117 % during the key establishment process. In return, we substantially augment the security of the handshake, paving the road for the development of future-proof quantum-resistant communication systems based on QKD and PQC.
The emergence of large-scale quantum computers poses a significant threat to current cryptographic protocols, particularly Transport Layer Security (TLS), which relies on RSA and elliptic curve cryptography vulnerable to Shor's algorithm. This paper presents a hybrid framework for quantum-resistant TLS handshakes that integrates post-quantum cryptography (PQC), quantum key distribution (QKD) and classical cryptography to provide comprehensive protection against both classical and quantum attacks. The approach employs three QKD protocols; BB84, E91, and Measurement-Device-Independent QKD (MDI-QKD) alongside NIST-standardized PQC algorithms as well as alternative candidates such as HQC and BIKE. A key innovation is the QKD key management module, which addresses performance bottlenecks through periodic key generation and secure reuse within predefined retention periods, significantly reducing QKD overhead in TLS handshakes. The experimental implementation using the quantum network simulator evaluated 144 distinct cryptographic protocol combinations. Results demonstrate that ML-KEM combined with ML-DSA provides optimal PQC performance, while QKD protocol selection is distance-dependent: BB84 for short-range and MDI-QKD for long-distance communication. The framework includes various attack mitigation mechanisms and ensure security as long as at least one cryptographic method remains uncompromised. Consistent with current global quantum network usage, the proposed TLS approach is designed primarily for MAN and WAN environments rather than the Internet, providing a balanced solution that combines theoretical security guarantees with computational efficiency.
Most of todays Internet connections are protected through the Transport Layer Security (TLS) protocol. Its client-server handshake mechanism provides authentication, privacy and data integrity between communicating applications. It is also the security base for the 5G connectivity. While currently considered secure, the dawn of quantum computing represents a threat for TLS. In order to prepare for such an event, TLS must integrate quantum-secure (post-quantum) cryptography (PQC). The use of hybrid approaches, that combines PQC and traditional cryptography are recommended by security agencies. Efficient PQC integration at TLS requires the exploration of a wide set of design parameters and platforms. To this end this work presents the following contributions. First, wide evaluation of PQC-enhanced TLS hybrid protocols, using end-to-end communication latency as metric. Second, the exploration and benchmarking in constrained embedded devices. Third, a wide traffic analysis, including the impact and behavior of PQC-enhanced hybrid TLS in real practical scenarios.
The emergence of quantum computing presents a fundamental challenge to the security of current Internet communication systems. Transport Layer Security (TLS), which forms the backbone of secure web communication, predominantly relies on classical public-key cryptographic algorithms such as RSA and elliptic curve cryptography (ECC), both of which are susceptible to quantum attacks. This paper conducts a large scale empirical evaluation of post-quantum readiness across 32,011 domains, with a primary focus on real-world TLS deployments across diverse sectors by analysing negotiated TLS parameters, including protocol versions, cipher suites, key exchange mechanisms, and certificates. The results indicate that while modern protocols like TLS 1.3 and QUIC are gaining adoption, 15.70% of domains especially in critical sectors such as banking and government still rely on TLS 1.2. Furthermore, 49.3% of domains support hybrid post-quantum key exchange mechanisms (e.g., MLKEM768 with X25519), whereas 50.7% continue to use classical key exchange, reflecting partial transition. Notably, 0% adoption of hybrid post-quantum certificates was observed, leaving the authentication layer vulnerable to quantum-enabled attacks such as certificate forgery. The findings reveal uneven adoption of post-quantum mechanisms across sectors, where technology driven platforms are advancing more rapidly than legacy-dependent infrastructures. Overall, the study highlights that achieving complete quantum resilience requires a coordinated transition not only in key exchange mechanisms but also in certificate infrastructures. Without such comprehensive migration, Internet communication systems remain vulnerable to long-term threats, including Harvest-Now-Decrypt-Later (HNDL) attacks.
TLS 1.3 is a crucial protocol for securing modern internet communications. To facilitate a smooth transition to post-quantum security, hybrid key exchange, which combines classical key exchange algorithms with post-quantum key encapsulation mechanisms (KEMs), is proposed to enhance the security of the current TLS 1.3 handshake. However, existing drafts and implementations of hybrid key exchange for TLS 1.3 primarily rely on CCA-secure KEMs (i.e., secure against chosen-ciphertext attacks) based on the Fujisaki-Okamoto (FO) transform. The re-encryption step in their decapsulation algorithms not only introduces additional performance overhead but also raises the risk of side-channel attacks. Although Huguenin-Dumittan and Vaudenay (Eurocrypt 2022) and Zhou et al. (Asiacrypt 2024) demonstrated that the weaker CPA-secure KEMs (i.e., secure against chosen-plaintext attacks) suffice for constructing a secure TLS 1.3 handshake, their analyses were limited to single-KEM settings and did not consider the hybrid key exchange scenario. This work challenges the necessity of CCA security by proving that CPA-secure KEMs are sufficient for the TLS 1.3 handshake even in the hybrid key exchange setting. We provide the first formal security proofs for this claim, covering both the classical random oracle model (ROM) and the quantum random oracle model (QROM), thereby ensuring security against quantum adversaries. To validate the practical benefits, we conduct an extensive performance evaluation based on the latest OpenSSL implementation. Our results show that using CPA-secure KEMs yields up to 44.8% performance improvement at the key exchange layer and up to approximately 9% acceleration for the full TLS 1.3 handshake. Beyond performance gains, this approach reduces the codebase's attack surface by eliminating the re-encryption step, thereby mitigating a class of side-channel vulnerabilities. Our work positions CPA-secure KEMs as a secure, efficient, and practical alternative for standardizing and deploying post-quantum TLS 1.3 even with hybrid key exchange.