The paper studies the relevance of the issues of encrypting confidential data for their transmission over unsecured channels of information and communication networks. An analysis of encrypted information exchange on the Internet based on the Google service was carried out in terms of the volume of encrypted web traffic. It is concluded that the difference in traffic volumes between countries is due to the popularity of the types of devices used, the geographic access infrastructure, as well as the availability of software that provides modern types of encryptions. The role of the HTTPS protocol in ensuring the security of working with resources on the Internet is substantiated. The NIST security requirements for modern information and communication systems in the post-quantum period are analyzed. It is determined that within a short period of time the power of computing devices increases exponentially, which entails an increase in the implementation of both already known and new attacks on cryptographic algorithms that ensure the strength of security services in networks. Based on the results of this study, the results of a comparative analysis of the complexity of classical and quantum algorithms were demonstrated. The classification of special attacks was considered according to the signs of influence on computing processes, according to access to systems and means, as well as according to the specifics of the attacks themselves. Solutions submitted for participation in the NIST competition for the definition of security standards through electronic digital signature mechanisms, encryption algorithms and key encapsulation are analyzed. The results of the analysis are presented in the form of a scheme of security and stability of the proposed protocols and algorithms. It is recommended to use TLS protocols to ensure the integrity and authenticity of users when establishing communication sessions with websites. A scheme of the process of authenticated encryption and authentication of an encrypted message transmitted over a TLS connection has been developed. A process scheme has been developed for authentication encryption and decryption of information when establishing a communication session in TLS protocols. A comparative analysis of the characteristics of the TLS 1.3 and TLS 1.2 protocols was carried out.
The paper studies the relevance of the issues of encrypting confidential data for their transmission over unsecured channels of information and communication networks. An analysis of encrypted information exchange on the Internet based on the Google service was carried out in terms of the volume of encrypted web traffic. It is concluded that the difference in traffic volumes between countries is due to the popularity of the types of devices used, the geographic access infrastructure, as well as the availability of software that provides modern types of encryptions. The role of the HTTPS protocol in ensuring the security of working with resources on the Internet is substantiated. The NIST security requirements for modern information and communication systems in the post-quantum period are analyzed. It is determined that within a short period of time the power of computing devices increases exponentially, which entails an increase in the implementation of both already known and new attacks on cryptographic algorithms that ensure the strength of security services in networks. Based on the results of this study, the results of a comparative analysis of the complexity of classical and quantum algorithms were demonstrated. The classification of special attacks was considered according to the signs of influence on computing processes, according to access to systems and means, as well as according to the specifics of the attacks themselves. Solutions submitted for participation in the NIST competition for the definition of security standards through electronic digital signature mechanisms, encryption algorithms and key encapsulation are analyzed. The results of the analysis are presented in the form of a scheme of security and stability of the proposed protocols and algorithms. It is recommended to use TLS protocols to ensure the integrity and authenticity of users when establishing communication sessions with websites. A scheme of the process of authenticated encryption and authentication of an encrypted message transmitted over a TLS connection has been developed. A process scheme has been developed for authentication encryption and decryption of information when establishing a communication session in TLS protocols. A comparative analysis of the characteristics of the TLS 1.3 and TLS 1.2 protocols was carried out.
At present and in the future, mathematical methods, mechanisms and algorithms of standardized asymmetric cryptotransformations such as electronic signature (ES) are and will be used for information cryptographic protection. Electronic signature is the main and essential component of cybersecurity, in terms of providing quality information security services such as integrity, irresistibility and authenticity of information and data processed. However, there are well-founded suspicions that in the post-quantum period the existing ES standards will be broken and compromised using classical and quantum cryptanalytic systems with appropriate mathematical, software and hardware-software. An analysis was performed, which confirms that quantum computers have already been developed, manufactured and used. It is believed that the actual state of development and use of powerful quantum computers and their mathematical and software is obviously strictly confidential and secure, and only publicly known data on quantum computers and their applications in cryptology are disclosed. A preliminary analysis has been carried out showing that in Ukraine there is an understanding of the existence of threats to cybersecurity and information security in the case of using available standardized ES in the transition and post-quantum periods. Currently, development and adoption of post-quantum ES standards is also one of the main issues in ensuring the necessary levels of security in the transition and post-quantum periods. The objective of this article is to substantiate, compare alternatives and develop proposals for the selection and standardization of post-quantum ES standards at the international and national levels, taking into account the results of the 2nd and 3rd rounds of the NIST US competition and national researches.
Recent advances in quantum technology and the potential that practical quantum computers may become a reality in the future have led to renewed interest in developing cryptographic technologies that are secure against conventional and quantum attacks. Currently, virtually all asymmetric cryptographic schemes in use are threatened by the potential development of powerful quantum computers. Post-quantum cryptography is one of main the ways to combat this threat. Its security is based on the complexity of mathematical problems that are currently considered unsolvable efficiently, even with the help of quantum computers. The security of information systems is ensured through protection against various threats that use system vulnerabilities. Security protocols are the building blocks of secure communication. They implement security mechanisms to provide security services. Security protocols are considered abstract when analyzed, but may have additional vulnerabilities in implementation. This work contains a holistic study of security protocols. Basics of security protocols, taxonomy of attacks on security protocols and their implementation are considered, as well as various methods and models of protocol security analysis. In particular, the differences between information-theoretic and computational security, computational and symbolic models are specified. In addition, an overview of the computational security models for Authenticated Key Exchange (AKE) and Password Authentication Key Exchange (PAKE) protocols is provided. The most important security models for the AKE and PAKE protocols were also described. With the emergence of new technologies that may have different security requirements, as well as with increased opportunities for competition, there is always a need to develop new protocols. Thus, the purpose of this article is to review, classify, analyze, and research the vulnerabilities of information systems from classical, quantum, and special attacks, performed taking into account the forecast regarding the possibilities of attacks on post-quantum cryptographic transformations; studying security assessment models for existing cryptographic protocols, as well as reviewing and benchmarking security models and providing suggestions for protection against existing potential attacks.
Cryptography has evolved from ancient substitution ciphers to modern mathematical algorithms including Rivest–Shamir–Adleman (RSA), elliptic curve cryptography (ECC), and advanced encryption standard (AES) that form the core of security systems, along with the major information security objectives: confidentiality, integrity, authenticity, availability, accountability, nonrepudiation, and privacy and their practical applications in protocols such as transport layer security (TLS), Internet Protocol Security (IPsec), and Secure/Multipurpose Internet Mail Extensions (S/MIME). The security of RSA, ECC, and symmetric-key ciphers has been threatened by quantum computers that exploit Shor’s and Grover’s algorithms. In response to this quantum threat, NIST has standardized post-quantum cryptographic PQC) algorithms: ML-KEM, a lattice-based key encapsulation mechanism and ML-DSA, a lattice-based digital signature scheme. This chapter surveys the development of cryptographic systems from transposition ciphers to post-quantum cryptography, examining their mathematical foundations, operational mechanisms, and respective security properties. In addition to these, the PQC algorithms have been implemented in TLS 1.3, and a comparative analysis has been performed. The study traces the history of cryptography while understanding post-quantum standards as the necessary foundation for long-term information security in the quantum era.
Aim: The imminent advent of large-scale quantum computers within the next years is expected to highly affect the security of several cryptosystems that are now considered secure; this mainly holds for classical, long-established, public key cryptographic algorithms such as RSA and elliptic curve cryptography. Apparently, any security protocol that relies on such ciphers, including the transport layer security (TLS) protocol which constitutes a somewhat de facto standard for the security on the web, will not be considered secure in the post-quantum era. To alleviate the security risks stemming from quantum computing, several proposals have been submitted to the relevant procedure initiated by NIST towards evaluating and standardizing one or more quantum-resistant public-key cryptographic algorithms. This paper focuses on embedding post-quantum secure cryptographic algorithms into the TLS protocol to analyze its performance. More precisely, the paper aims to analyze whether this transition to post-quantum secure algorithms will have a significant impact on the user experience due to the possible increase of client--server communication times. Methods: Having as the starting point several important works in the field, several experiments were carried out, using combinations of cloud and local virtual machines per case and considering all the post-quantum cryptographic algorithm finalists for key exchange from the third round of the ongoing NIST process, for various cryptographic as well as network parameters. Results: Our results exhibit that, for key exchange in TLS, the best performance among the post-quantum secure ciphers is achieved by the Saber and CRYSTAL-Kyber variants for all security levels, regardless of the underlying computing power. The performance is comparable to that of the corresponding one achieved by a classical elliptic curve algorithm for key exchange for both RTT and packet loss ratio — i.e., the network parameters seem to have the same effect on post-quantum secure algorithms as in the case of a conventional elliptic curve algorithm. However, the effect of the network parameters on the performance is more crucial than the effect of the underlying chosen ciphers. Conclusion: According to the experiments, we conclude that there exist very promising algorithms that could be utilized in TLS in the near future, which may behave even better than the conventional elliptic curve algorithms for key exchange. It should also be pointed out that NIST announced on 5 July 2022 (i.e., after the completion of our research experiments) that, for general encryption used when we access secure websites, the CRYSTALS-Kyber algorithm has been selected, having as one of its advantages the speed of operation. Hence, the results of our paper are fully in line with the progress of the NIST process. Taking into account that the NIST process is still ongoing (now in its fourth round) with the aim to select more algorithms, as well as that some algorithms may be standardized outside NIST, it becomes evident that our results provide very useful insights on performance aspects of the post-quantum secure algorithms.
The development of mobile technologies and their integration with Internet of Things and smart technologies form both cyber-physical and socio-cyber-physical systems. In such systems, as a rule, wireless communication channels are used, in which SSL/TLS protocols are used to provide security services (confidentiality, integrity and authenticity). However, this protocol is not only vulnerable to "Meeting in the Middle", POODLE, BEAST, CRIME, BREACH attacks, but with the advent of a full-scale quantum computer, it can be broken. The article proposes a protocol based on quantum algorithms – crypto-code constructions, which will ensure not only resistance to current attacks, but also stability in the post-quantum period. To ensure the "hybridity" of services, it is proposed to use McEliece and Niederreiter crypto-code constructions and the improved UMAC algorithm based on McEliece crypto-code design. The use of crypto-code constructions provides not only resistance to attacks, but also simplifies the formation of a connection – the parameters of elliptic curves are used for the transmission of the common key. This approach significantly reduces the time of connecting mobile gadgets and simplifies the procedure of agreement before data transfer.
Currently available cryptographic algorithms such as the RSA, Diffie-Hellman and the ECC are used in securing most Internet communications across the Internet. Theoretical quantum algorithms (and the Shor algorithm in particular) were demonstrated to be able to efficiently break that type of classical cryptography as soon as large-scale quantum computers are developed. To handle this new emerging security problem, PQC has been proposed as a class of cryptographic algorithms that is resistant to both quantum and classical attackers. It is a research paper offering and experimentally implementing a hybrid PQC-TLS protocol in a heterogeneous network architecture which includes edge computing devices and cloud computing and IoT devices. The suggested architecture integrates both lattice-based CRYSTALS-Kyber key encapsulation scheme and CRYSTALS-Dilithium digital signature scheme in the TLS 1.3 handshake without being interoperable with the older ECC-based key exchange schemes. Five measures of performance that included handshake latency, CPU consumption, memory consumption, bandwidth overhead and energy consumption were analyzed in detail through experimentation. The experiments were conducted using in Iot, edge and cloud nodes under controlled conditions that were repeated a number of times to give reliability in the statistics. The results indicate that the integration of PQC has moderate overhead (mean increase in latency about 1517) and decent computational and energy requirements. Another method of resisting popular attacks on networks like as the man in the middle, replay, and downgrade attacks, is security validation. The findings indicate that quantum resilient secure communication migration to a heterogeneous distributed infrastructure can be practically and scalably provided using hybrid PQC-TLS protocols. Statistical analysis including standard deviation and 95% confidence intervals was performed to validate the reliability of the results.