The rise of Web 3.0 has propelled the Internet to new heights of development. However, post-quantum protocols are in high demand to ensure the utmost security to keep pace with the advancements. Our solution is upgrading the traditional synchronous authenticated identity identification and key agreement protocol. Specifically, we have developed an asymmetric key version of the quantum-safe Needham-Schroeder protocol. The proposed protocol achieves forward secrecy, which the classical Needham-Schroeder lacks. Using the highly flexible universal composability framework (iUC), we have analyzed the security of the protocol and achieved mutual authentication and session key security for an unbounded number of sessions. Our informal security analysis confirms that the proposed protocol resists known attacks such as replay and masquerading. Besides, it satisfies security goals, including known-key secrecy and ephemeral secret key leakage. Our modular solution can upgrade practical applications that rely on the traditional Needham-Schroeder protocol and its derivatives to the post-quantum era.
The rise of Web 3.0 has propelled the Internet to new heights of development. However, post-quantum protocols are in high demand to ensure the utmost security to keep pace with the advancements. Our solution is upgrading the traditional synchronous authenticated identity identification and key agreement protocol. Specifically, we have developed an asymmetric key version of the quantum-safe Needham-Schroeder protocol. The proposed protocol achieves forward secrecy, which the classical Needham-Schroeder lacks. Using the highly flexible universal composability framework (iUC), we have analyzed the security of the protocol and achieved mutual authentication and session key security for an unbounded number of sessions. Our informal security analysis confirms that the proposed protocol resists known attacks such as replay and masquerading. Besides, it satisfies security goals, including known-key secrecy and ephemeral secret key leakage. Our modular solution can upgrade practical applications that rely on the traditional Needham-Schroeder protocol and its derivatives to the post-quantum era.
Advancements in 5G are largely driven by its adoption across a variety of applications, including smart homes, smart healthcare, autonomous vehicles, transportation, and Industry 5.0. However, this widespread usage raises significant security and privacy concerns, particularly regarding authentication. To secure 5G communications, 3GPP has standardised the 5G-Authentication and Key Agreement (5G-AKA) protocol. Despite this, state-of-the-art research has revealed that 5G-AKA suffers from several vulnerabilities. In response, numerous alternative authentication schemes have been proposed. Nevertheless, many of these protocols continue to be susceptible to classical security threats, such as malicious serving network (SN) attacks, ephemeral secret leakage, traceability, anonymity violations, and, most critically, a lack of Perfect Forward Secrecy (PFS). Additionally, recent advancements in quantum computing pose a substantial risk to the security of 5G-AKA and its variants, rendering them insecure in the post-quantum era. Although a few post-quantum cryptography-based protocols have been introduced, studies show that they are either computationally expensive or still vulnerable to quantum attacks. In order to tackle these challenges, we propose two versions of a novel authentication protocol that not only provide comprehensive security guarantees but are also computationally efficient. Version 1 utilises a hybrid cryptographic approach (AES + KEM) and achieves the lowest computational cost—even lower than Version 2, which relies solely on KEM. Both versions offer the same level of security, but Version 1 is significantly more efficient in terms of resource usage. We have validated our proposed protocols using the Real-Or-Random (ROR) model and the Scyther tool. Furthermore, we evaluated their performance against existing protocols under both known and unknown attack scenarios. The results show that our protocols incur lower computational, communication, and energy overhead, as well as strong resilience against unknown attacks, outperforming several existing authentication schemes. Furthermore, we implement a testbed to demonstrate the real-time applicability of both proposed versions.
Objective: To design a secure and efficient three-party post-quantum authenticated key agreement (AKE) protocol that ensures mutual authentication, user anonymity, and forward secrecy, while resisting both classical and quantum adversaries. Methods: The proposed protocol is constructed using the Ring Learning with Errors (Ring-LWE) assumption, which is widely regarded as quantum-resistant. The scheme enables two users to establish a shared session key through a trusted server over an insecure channel. Cryptographic hash functions, lattice-based operations, and masking techniques are employed to achieve authentication, anonymity, and key confidentiality. Formal correctness proofs, informal security analysis, and comparative performance evaluations are conducted to validate the protocol. Findings: The study describes qualitative benefits like "outperforms current protocols" but lacks specific metrics, such as exact computation costs (e.g., 4913 ns total execution) or communication rounds, and "reduces user-side cost to 2438 ns vs. 5395 ns in Islam et al.". Also, substantially more efficient than pairing- or chaotic-map-based protocols, which incur costs exceeding 12000 ns. Communication overhead is reduced by limiting the exchange to two RLWE-based messages and one server response, avoiding expensive bilinear pairing or biometric hash transmissions. These results demonstrate that the proposed scheme provides stronger security guarantees at a lower computational and communication cost, making it suitable for resource-constrained mobile and IoT environments. Novelty: Unlike existing approaches, the proposed protocol simultaneously guarantees user anonymity, forward secrecy, and quantum resistance in a three-party setting based on Ring-LWE. It overcomes known vulnerabilities in prior schemes and achieves improved efficiency without compromising security, making it a practical and robust solution for post-quantum secure communications. Keywords: Key Establishment, Authentication, Ring Learning with Errors, Anonymous Key Exchange, Post Quantum Forward Secrecy
The rapid expansion of Internet of Things (IoT) ecosystems has introduced significant security challenges due to resource-constrained devices, heterogeneous network architectures, and largescale connectivity. Traditional authentication and key exchange mechanisms, primarily based on classical cryptographic algorithms such as RSA and ECC, are vulnerable to future quantum computing attacks. The emergence of quantum algorithms, particularly Shor’s algorithm, threatens the long-term confidentiality and integrity of IoT communications. This paper proposes a Quantum-Resistant Authentication and Key Exchange Protocol specifically designed for secure IoT architectures. The proposed framework integrates post-quantum cryptographic primitives, including lattice-based key exchange mechanisms and hash-based authentication schemes, optimized for low computational overhead suitable for constrained IoT devices. The protocol ensures mutual authentication, forward secrecy, and resistance against quantum adversaries while maintaining minimal communication latency. Security analysis demonstrates robustness against replay, man-in-the-middle, and key-compromise attacks. Performance evaluation shows that the proposed solution achieves a balance between quantum security strength and resource efficiency, making it suitable for next-generation IoT deployments in smart cities, healthcare systems, and industrial automation.
Key agreement in open networks must not only resist quantum computing threats but also establish keys and authenticate counterparties without explicitly revealing identities. Existing solutions often rely on additional certificates or explicit signature-based authentication or require multiple rounds of interaction and complex state management, thereby imposing burdens on deployment and scalability. To address this, we propose a key agreement protocol based on a post-quantum identity-matching scheme, which unifies identity binding, implicit authentication, and session key establishment into a single key agreement process. Specifically, the initiator generates a ciphertext based on the peer’s identity and embeds session-related information within it, enabling the recipient to verify the peer’s identity and confirm the consistency of the key while decrypting and recovering the shared material. Additionally, bidirectional confirmation messages are used to eliminate negotiation deviations such as the sharing of unknown keys. Furthermore, a version control mechanism is introduced as a synchronization tag for key evolution, allowing the session key to be naturally updated within a predetermined time window. Concurrently, a revocation list maintained by a blockchain is established, enabling distributed verification and auditing of revocation status. This supports key update and revocation management without increasing the number of negotiation rounds. Performance evaluations and security analyses indicate that the protocol incurs a single-end computational overhead of less than 100 μs and a communication overhead of approximately 17.1 KB, trading moderate performance overhead for strong security semantics.
Two-Party Authenticated key agreement protocol is essential for setting up the common session key for parties to establish secure channel for network communication in the open environment. Most of proposed schemes require expensive bilinear pairing operation and only provide limited security attributes. So such protocols are unsuitable for real-world applications that require stronger sense of secrecy. In this paper, we first analysis two schemes recently proposed by Cao etc., and then present a one-round ID-based authenticated key agreement protocol with more desired security attributes, which need no pairing operations while still achieve nice computational efficiency. These security attributes include known-key secrecy, perfect forward secrecy, PKG forward secrecy, key-compromise impersonation resilience, unknown key-share resilience and no key control. Moreover, it captures the enhanced security attributes known session-specific temporary key information secrecy, which means that even the ephemeral secret key were compromised, the adversary can hardly acquire the agreed session key.
Authenticated key agreement protocol is used to set up the session key and establish secure channel for network communication in the open environment. So far, great deals of identity-based protocols have been proposed to provide robust mutual authentication and key establishment in the two-party setting. Majority of the existing identity-based key agreement protocols require expensive bilinear pairing operation and only provide limited security attributes. Therefore, such protocols are unsuitable for real-world applications that require stronger sense of secrecy. In this paper, we first analysis some of the schemes proposed recently, and then present a one-round ID-based authenticated key agreement protocol with enhanced security attributes, which doesn't need pairing operation and achieves most of the required security attributes, such as known-key secrecy, perfect forward secrecy, PKG Forward Secrecy, key-compromise impersonation resilience, unknown key-share resilience and no key control. In addition, it captures the enhanced security attributes-Known session-specific temporary key information secrecy.