Passive Optical Networks (PONs) are widely used in fixed-access networks for delivering connectivity to domestic, commercial and industrial users. Authentication and encryption are required in PONs, because of their vulnerability to Optical Network Unit (ONU) impersonating or downstream data sniffing attacks. The research community has pointed out the vulnerabilities of the authentication mechanisms enforced in PON, and has proposed Shared Mutual Authentication (SMA) using Public-Key Cryptography (PKC) based on Diffie-Hellman. However, this last is vulnerable to attacks from quantum computers. This work proposes using Post-Quantum Cryptography (PQC) for SMA in Time-Division Multiplexing (TDM)-PONs. Kyber is selected for the proposed SMA mechanism. This algorithm is the finalist in the PQC standardization process of the National Institute of Standards and Technology (NIST). The feasibility of the proposed Kyber SMA mechanism is shown in a simulation, and it is compared against a baseline SMA from the 10-Gigabitcapable Passive Optical Network (XG-PON) and a state-of-the-art SMA based on Diffie-Hellman. The proposed Kyber SMA mechanism requires more random bytes, has a longer execution time than the baseline and its overhead is similar to the state-of-the-art mechanism with similar security features but based on classical cryptography. According to the presented evaluations, the proposed approach is feasible and offers an SMA resistant to threats from traditional and quantum computers.
Passive Optical Networks (PONs) are widely used in fixed-access networks for delivering connectivity to domestic, commercial and industrial users. Authentication and encryption are required in PONs, because of their vulnerability to Optical Network Unit (ONU) impersonating or downstream data sniffing attacks. The research community has pointed out the vulnerabilities of the authentication mechanisms enforced in PON, and has proposed Shared Mutual Authentication (SMA) using Public-Key Cryptography (PKC) based on Diffie-Hellman. However, this last is vulnerable to attacks from quantum computers. This work proposes using Post-Quantum Cryptography (PQC) for SMA in Time-Division Multiplexing (TDM)-PONs. Kyber is selected for the proposed SMA mechanism. This algorithm is the finalist in the PQC standardization process of the National Institute of Standards and Technology (NIST). The feasibility of the proposed Kyber SMA mechanism is shown in a simulation, and it is compared against a baseline SMA from the 10-Gigabitcapable Passive Optical Network (XG-PON) and a state-of-the-art SMA based on Diffie-Hellman. The proposed Kyber SMA mechanism requires more random bytes, has a longer execution time than the baseline and its overhead is similar to the state-of-the-art mechanism with similar security features but based on classical cryptography. According to the presented evaluations, the proposed approach is feasible and offers an SMA resistant to threats from traditional and quantum computers.
It is well known that optical access networks are able to provide high data rates over long distances and to a reasonable number of users. Security and privacy are always a challenge for public accessible network infrastructures. Especially in time-division multiplexing passive optical networks (TDM-PONs), in which the downstream signal is broadcasted to all users connected via the same wavelength channel in a shared fiber link, privacy can be a critical concern. Although encryption at the application layer can provide a high level of security, this can be achieved only if the encryption key distribution is perfectly save. On the other hand, encryption on the physical layer such as quantum cryptography or, more precisely, quantum key distribution (QKD) is a very promising approach to achieve secure communication. However, there remain several issues that have to be solved before the quantum cryptography reaches the maturity level needed for a cost effective implementation in practical networks. In this paper, we address quantum key distribution (QKD) over passive optical access networks, which is an enabling technology required to cost efficiently deploy practical quantum encrypted data communication in the access area. We study different methods to integrate QKD systems in conventional optical access networks and quantitatively evaluate their suitability for a potential implementation.
This research aims to establish a secure system for key exchange by using post-quantum cryptography (PQC) schemes in the classic channel of quantum key distribution (QKD). Modern cryptography faces significant threats from quantum computers, which can solve classical problems rapidly. PQC schemes address critical security challenges in QKD, particularly in authentication and encryption, to ensure the reliable communication across quantum and classical channels. The other objective of this study is to balance security and communication speed among various PQC algorithms in different security levels, specifically CRYSTALS-Kyber, CRYSTALS-Dilithium, and Falcon, which are finalists in the National Institute of Standards and Technology (NIST) Post-Quantum Cryptography Standardization project. The quantum channel of QKD is simulated with Qiskit, which is a comprehensive and well-supported tool in the field of quantum computing. By providing a detailed analysis of the performance of these three algorithms with Rivest–Shamir–Adleman (RSA), the results will guide companies and organizations in selecting an optimal combination for their QKD systems to achieve a reliable balance between efficiency and security. Our findings demonstrate that the implemented PQC schemes effectively address security challenges posed by quantum computers, while keeping the the performance similar to RSA.
The Hybrid approach in Quantum Cryptography creates adaptable security model which provides the safest Communication in the emerging quantum era. The development of quantum computing raise questions about the long-term security. Traditional algorithms, such as RSA, ECC, and Diffie-Hellman, which is seemed computationally secure but it can be effectively solved by quantum algorithms such as Shor's and Grover's. This problem leads to the origination of two key trends in current studies, namely Post-Quantum Cryptography (PQC), designing mathematical approaches to encryption resistant to quantum attacks; Quantum Key Distribution (QKD) using the principles of quantum mechanics to assure security in communications. Accordingly, this research proposes a hybrid security framework including reliable data encryption and authentication using PQC, combined with the safe key- exchange method of QKD. The model is implemented in Python, Qiskit, and PQClean's Kyber and Dilithium algorithms to show how these two paradigms can cooperate toward quantum- resilient communication. To present the system performance, key exchange efficiency, computational overhead, and security strength have been considered. According to the results, this hybrid approach gives superior defense against quantum threats while maintaining practical effectiveness for real-world applications such as cloud security, 6G networks, and the Internet of Things.
In this paper, a generic post-quantum authentication protocol is constructed for quantum-resistant satellite communication. This scheme was proposed to address emerging authentication needs in post-quantum satellite communication systems consistent with evolving standards such as Consultative Committee for Space Data Systems (CCSDS) and European Telecommunications Standards Institute (ETSI). In the proposed authentication, it is aimed to obtain additional security features and low communication complexity based on simple operations and post-quantum algorithms. The mutual authentication is achieved by using Physical Unclonable Functions (PUF), Hash Message Authentication Code (HMAC), and post-quantum cryptography (PQC) primitives. The security analysis shows that the proposed authentication provides additional security properties and resistance to replay and man-in-the-middle (MitM) attacks. The main difference between the proposed protocol and PQC-based authentication for satellites in the literature is that it does not require complex operations and provides anonymity, integrity, and legitimacy with the help of lightweight principles. The proposed scheme leverages National Institute of Standards and Technology (NIST)-approved post-quantum cryptographic primitives (e.g., CRYSTALS-Kyber, HQC, SHA3-256), while the overall authentication protocol design is novel and constitutes the main contribution of our work.
The advent of quantum computing poses a significant threat to current cryptographic systems, particularly public-key algorithms such as RSA and ECC, which are vulnerable to quantum attacks like Shor's algorithm. Post-Quantum Cryptography (PQC) aims to develop and standardize quantum-resistant cryptographic algorithms to secure digital communications in the quantum era. This paper examines the current landscape of PQC, focusing on the evaluation and standardization efforts led by organizations such as the National Institute of Standards and Technology (NIST). We analyze the major families of quantum-resistant algorithms, including lattice-based, hash-based, code-based, multivariate, and isogeny-based cryptography, discussing their security guarantees, performance trade-offs, and implementation challenges. Furthermore, we review NIST's PQC standardization process, highlighting selected finalists and alternate candidates, and explore the ongoing transition challenges in adopting these algorithms across industries. Finally, we discuss future directions for PQC research, including hybrid cryptographic systems and the need for continued cryptanalysis to ensure long-term security. This work provides a comprehensive overview of the progress and challenges in deploying quantum-resistant cryptography to safeguard against emerging quantum threats.
The threat of a cryptographically relevant quantum computer contributes to an increasing interest in the field of post-quantum cryptography (PQC). Compared to existing research efforts regarding the integration of PQC into the Transport Layer Security (TLS) protocol, industrial communication protocols have so far been neglected. Since industrial cyber-physical systems (CPS) are typically deployed for decades, protection against such long-term threats is needed. In this work, we propose two novel solutions for the integration of post-quantum (PQ) primitives (digital signatures and key establishment) into the industrial protocol Open Platform Communications Unified Architecture (OPC UA): a hybrid solution combining conventional cryptography with PQC and a solution solely based on PQC. Both approaches provide mutual authentication between client and server and are realized with certificates fully compliant to the X.509 standard. We implement the two solutions and measure and evaluate their performance across three different security levels. All selected algorithms (Kyber, Dilithium, and Falcon) are candidates for standardization by the National Institute of Standards and Technology (NIST). We show that Falcon is a suitable option – especially – when using floating-point hardware provided by our ARM-based evaluation platform. Our proposed hybrid solution provides PQ security for early adopters but comes with additional performance and communication requirements. Our solution solely based on PQC shows superior performance across all evaluated security levels in terms of handshake duration compared to conventional OPC UA but comes at the cost of increased handshake sizes. In addition to our performance evaluation, we provide a proof of security in the symbolic model for our two PQC-based variants of OPC UA. For this proof, we use the cryptographic protocol verifier ProVerif and formally verify confidentiality and authentication properties of our quantum-resistant variants.