The rapid advancement of quantum computing poses a significant threat to conventional cryptography. Whilst post-quantum cryptography (PQC) stands as the prevailing trend for fortifying the security of cryptographic systems, the coexistence of quantum and classical computing paradigms presents an opportunity to leverage the strengths of both technologies, for instance, nowadays the use of Quantum Random Number Generators (QRNGs) – considered as True Random Number Generators (TRNGs) – opens up the possibility of discussing hybrid systems. In this paper, we evaluate both aspects, on the one hand, we use hybrid TLS (Transport Layer Security) protocol that leverages the widely used secure protocol on the Internet and integrates PQC algorithms, and, on the other hand, we evaluate two approaches to integrate a QRNG, i.e., Quantis PCIe-240M, in OpenSSL 3.0 to be used by TLS. Both approaches are compared through a Nginx Web server, that uses OpenSSL’s implementation of TLS 1.3 for secure web communication. Our findings highlight the importance of optimizing such integration method, because while direct integration can lead to performance penalties specific to the method and hardware used, alternative methods demonstrate the potential for efficient QRNG deployment in cryptographic systems.
The rapid advancement of quantum computing poses a significant threat to conventional cryptography. Whilst post-quantum cryptography (PQC) stands as the prevailing trend for fortifying the security of cryptographic systems, the coexistence of quantum and classical computing paradigms presents an opportunity to leverage the strengths of both technologies, for instance, nowadays the use of Quantum Random Number Generators (QRNGs) – considered as True Random Number Generators (TRNGs) – opens up the possibility of discussing hybrid systems. In this paper, we evaluate both aspects, on the one hand, we use hybrid TLS (Transport Layer Security) protocol that leverages the widely used secure protocol on the Internet and integrates PQC algorithms, and, on the other hand, we evaluate two approaches to integrate a QRNG, i.e., Quantis PCIe-240M, in OpenSSL 3.0 to be used by TLS. Both approaches are compared through a Nginx Web server, that uses OpenSSL’s implementation of TLS 1.3 for secure web communication. Our findings highlight the importance of optimizing such integration method, because while direct integration can lead to performance penalties specific to the method and hardware used, alternative methods demonstrate the potential for efficient QRNG deployment in cryptographic systems.
As quantum technologies advance, the security of popular cryptographic protocols becomes more threatened by the capabilities of Cryptographically Relevant Quantum Computers (CRQCs). In this scenario, Post-Quantum Cryptography (PQC) has become a potential solution to prolong the life of existing Public Key Infrastructure (PKI) systems. However, PQC protocols depend on high-quality randomness for key generation and encapsulation procedures, with the quality of the entropy source potentially having a profound impact on the security of the overall system. In this work, we demonstrate a proof-of-concept enabling the incorporation of Quantum Random Number Generation (QRNG) devices within communication networks using PQC-based Transport Layer Security (TLS).Using open-source cryptographic libraries and commercial QRNG hardware, we demonstrate their use as entropy sources via an Entropy-as-a-Service (EaaS) model. We highlight two particular use cases: a fully virtualized private PKI network and a connection to an external PQC-enabled server. Experimental results show that EaaS QRNG enables real-time entropy monitoring and quality assessment in cryptographic management systems, with negligible impact on TLS handshake time.
Web services of quantum random number generators (QRNG) open new opportunities for enhancing the resilience of cryptographic systems due to their ability to generate true random numbers based on quantum effects. Unlike pseudo-random number generators (PRNG), the QRNG ensures a high level of unpredictability in output data, making them critical components in modern security systems. However, their implementation is accompanied by significant challenges, particularly due to potential attacks at the software level and during integration with hardware infrastructure. At the software level, major threats include attacks on cryptographic libraries, substitution or manipulation of runtime output data, and side-channel attacks exploiting information leaks from physical number generation processes. At the hardware level, risks arise from equipment defects, failures in integration processes, or improper operation of the QRNG in combination with other systems. This study provides a classification of the main types of attacks on QRNG web services, presents an analysis of existing attacks, and introduces modern approaches to their prevention. Among the key solutions are the certification of the QRNG during development and deployment, multi-factor verification of output data to ensure unpredictability, and the use of monitoring systems with artificial intelligence algorithms for anomaly detection. Special attention is given to hybrid protection methods that combine the QRNG with quantum key distribution (QKD) and post-quantum cryptographic algorithms, allowing for the mitigation of risks from both classical and quantum attacks. Thus, a comprehensive combination of software and hardware security methods will enhance the reliability of QRNG and their resilience to modern threats. Further research should focus on the implementation of unified standards for QRNG and the optimization of their integration into existing cryptographic systems.
Most of todays Internet connections are protected through the Transport Layer Security (TLS) protocol. Its client-server handshake mechanism provides authentication, privacy and data integrity between communicating applications. It is also the security base for the 5G connectivity. While currently considered secure, the dawn of quantum computing represents a threat for TLS. In order to prepare for such an event, TLS must integrate quantum-secure (post-quantum) cryptography (PQC). The use of hybrid approaches, that combines PQC and traditional cryptography are recommended by security agencies. Efficient PQC integration at TLS requires the exploration of a wide set of design parameters and platforms. To this end this work presents the following contributions. First, wide evaluation of PQC-enhanced TLS hybrid protocols, using end-to-end communication latency as metric. Second, the exploration and benchmarking in constrained embedded devices. Third, a wide traffic analysis, including the impact and behavior of PQC-enhanced hybrid TLS in real practical scenarios.
The advancement of quantum computing creates a big threat to classical cryptographic protocols, including TLS, which is responsible for secure internet communications. While recent industry and academic efforts have focused on integrating lattice-based post-quantum key encapsulation mechanisms (KEMs) such as Kyber+X25519 into hybrid TLS handshakes, these approaches often prioritize performance at the cost of cryptanalytic diversity. Code-based KEMs, despite their proven security measure they remain underexplored in hybrid frameworks due to some limitations like large key sizes and integration complexity. This paper proposes a novel hybrid TLS framework that explicitly incorporates code-based post-quantum cryptography—specifically McEliece—alongside classical key exchange mechanisms. The framework introduces a dual-handshake mechanism, adaptive parameter selection, and seamless fallback negotiation, enabling flexible deployment across heterogeneous networks while ensuring backward compatibility. Integration with Quantum Random Number Generators (QRNGs) and multifactor authentication further increases entropy quality and session security. We implemented and evaluated the framework using an OpenSSL-OQS integration. We measure handshake latency, CPU utilization, memory usage, and throughput across emulated and real-world testbeds. Results show that the proposed hybrid approach achieves up to 30% lower latency and significantly reduced resource overhead compared to pure post-quantum TLS variants, while maintaining near-classical efficiency levels. Mathematical modeling formalizes these trade-offs which offers a foundation for optimizing deployment in both resource-constrained IoT devices and high-performance servers. By advancing cryptographic diversity and aligning with emerging NIST and IETF standardization efforts, the proposed framework provides a practical pathway toward quantum-resilient secure communication.It shows that code-based post-quantum cryptography can be added to current TLS systems without any problems, keeping security, performance, and compatibility in mind as we get ready for the quantum age.
In recent years, the advancement of quantum computing technology has posed potential security threats to RSA cryptography and elliptic curve cryptography. In response, the National Institute of Standards and Technology (NIST) published several Federal Information Processing Standards (FIPS) of post-quantum cryptography (PQC) in August 2024, including the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), Module-Lattice-Based Digital Signature Algorithm (ML-DSA), and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA). Although these PQC algorithms are designed to resist quantum computing attacks, they may not provide adequate security in certain specialized application scenarios. To address this issue, this study proposes quantum random number generator (QRNG)-based PQC algorithms. These algorithms leverage quantum computing to generate random numbers, which serve as the foundation for key pair generation, key encapsulation, and digital signature generation. A generalized architecture of QRNG is proposed, along with the design of six QRNGs. Each generator is evaluated according to the statistical validation procedures outlined in NIST SP 800-90B, including tests for verification of entropy sources and independent and identically distributed (IID) outputs. Experimental results assess the computation time of the six QRNGs, as well as the performance of QRNG-based ML-KEM, QRNG-based ML-DSA, and QRNG-based SLH-DSA. These findings provide valuable reference data for future deployment of PQC-based Transport Layer Security in web systems.
Quantum computers pose a significant threat to widely used cryptographic schemes, making it crucial to urgently shift to post-quantum protocols that ensure the long-term security of communications. This paper presents a framework for facilitating the transition to a quantum-resistant web by enabling the evaluation of the impact of integrating post-quantum and hybrid cryptographic primitives in the TLS protocol. By leveraging the OpenSSL library, the framework enables the seamless evaluation and comparison of key encapsulation mechanisms (KEMs) and signature schemes provided by the Open Quantum Safe project. The proposed framework is used to analyze different TLS configurations involving classic, hybrid and post-quantum primitives, with a focus on those selected by NIST. The study concentrates on evaluating the performance impact and the data overhead introduced by configurations involving primitives at different security levels. It starts by benchmarking standalone cryptographic primitives and continues with the evaluation of TLS configurations with hybrid and post-quantum KEMs under controlled network conditions, as this is the first natural step for a transition to a quantum-safe TLS. An impact analysis on real-world scenarios follows. Finally, our evaluation concentrates on providing insight into the cost of shifting to TLS configurations involving only hybrid or post-quantum primitives.