This paper proposes a novel approach to transitioning the classical TLS 1.3 protocol to a post-quantum version with minimal changes to the existing infrastructure. By integrating a hybrid KEMTLS protocol with Identity-Based Encryption (IBE), the solution achieves post-quantum security without incorporating post-quantum keys into TLS certificates. This enables the protocol to function with Certificate Authorities that do not support post-quantum keys, ensuring its security while simplifying the transition. The main challenge addressed is the immediate need for support of post-quantum algorithms by Certificate Authorities and servers. The proposed solution leverages existing certificates and keys, facilitating a smoother transition.
This paper proposes a novel approach to transitioning the classical TLS 1.3 protocol to a post-quantum version with minimal changes to the existing infrastructure. By integrating a hybrid KEMTLS protocol with Identity-Based Encryption (IBE), the solution achieves post-quantum security without incorporating post-quantum keys into TLS certificates. This enables the protocol to function with Certificate Authorities that do not support post-quantum keys, ensuring its security while simplifying the transition. The main challenge addressed is the immediate need for support of post-quantum algorithms by Certificate Authorities and servers. The proposed solution leverages existing certificates and keys, facilitating a smoother transition.
Cloud-native application platforms and latency-sensitive systems such as 5G Core networks rely heavily on certificate-based Public Key Infrastructure (PKI) and mutual TLS to secure service-to-service communication. While effective, this model introduces significant operational and performance overhead, which is further amplified in the post-quantum setting due to large certificates and expensive signature verification. In this paper, we present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption(IBE). Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation. We describe an IBE-based replacement for private PKI, including identity lifecycle management, and show how it can be instantiated using a threshold Private Key Generator (T-PKG). We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks. In particular, we demonstrate how identity-based TLS integrates with the 5G Service-Based Architecture while preserving security semantics and 3GPP requirements, and we show how the same architecture can replace private PKI in Kubernetes, including its control plane, without disrupting existing trust domains or deployment models.
The impending threat posed by quantum-capable adversaries necessitates a secure and practical transition of Public Key Infrastructures (PKIs) to support post-quantum cryptography (PQC). This paper addresses the multifaceted challenges of integrating PQC into existing PKI ecosystems by examining novel cryptographic combiners and hybrid certificate designs that can provide quantum-resistant security. We assess the performance, compatibility, and security of these hybrid certificates across standard communication protocols such as TLS, considering variations in root and intermediate certification paths. In addition, we introduce key management procedures that cover signature generation, validation, and lifecycle considerations under both software and hardware constraints. Beyond X.509, alternative trust models and certificate mechanisms are also analyzed for specialized domains, including IoT, firmware signing, and smart cards.
This paper discusses the significance of integrating post-quantum security measures in TLS 1.3 cryptographic protocol, emphasizing its role in ensuring long-term security against quantum attacks. It highlights the importance of collaboration between researchers, industry stakeholders, and standardization bodies for widespread acceptance and interoperability. The cryptographic algorithms used in TLS 1.3, including AES-GCM, ChaCha20-Po1y1305, and secure key exchange algorithms, are discussed for ensuring confidentiality and integrity. Post-quantum security threats to TLS 1.3 are analyzed, and proposed solutions encompass hybrid encryption schemes, development of new post-quantum cryptographic algorithms, and quantum-resistant key exchange protocols. The paper concludes by underscoring the necessity of a comprehensive approach to post-quantum security in TLS 1.3 and cryptographic systems, emphasizing continuous research, collaboration, and adaptation to address evolving cybersecurity threats.
The emergence of quantum computing presents a fundamental challenge to the security of current Internet communication systems. Transport Layer Security (TLS), which forms the backbone of secure web communication, predominantly relies on classical public-key cryptographic algorithms such as RSA and elliptic curve cryptography (ECC), both of which are susceptible to quantum attacks. This paper conducts a large scale empirical evaluation of post-quantum readiness across 32,011 domains, with a primary focus on real-world TLS deployments across diverse sectors by analysing negotiated TLS parameters, including protocol versions, cipher suites, key exchange mechanisms, and certificates. The results indicate that while modern protocols like TLS 1.3 and QUIC are gaining adoption, 15.70% of domains especially in critical sectors such as banking and government still rely on TLS 1.2. Furthermore, 49.3% of domains support hybrid post-quantum key exchange mechanisms (e.g., MLKEM768 with X25519), whereas 50.7% continue to use classical key exchange, reflecting partial transition. Notably, 0% adoption of hybrid post-quantum certificates was observed, leaving the authentication layer vulnerable to quantum-enabled attacks such as certificate forgery. The findings reveal uneven adoption of post-quantum mechanisms across sectors, where technology driven platforms are advancing more rapidly than legacy-dependent infrastructures. Overall, the study highlights that achieving complete quantum resilience requires a coordinated transition not only in key exchange mechanisms but also in certificate infrastructures. Without such comprehensive migration, Internet communication systems remain vulnerable to long-term threats, including Harvest-Now-Decrypt-Later (HNDL) attacks.
Quantum computers pose a significant threat to widely used cryptographic schemes, making it crucial to urgently shift to post-quantum protocols that ensure the long-term security of communications. This paper presents a framework for facilitating the transition to a quantum-resistant web by enabling the evaluation of the impact of integrating post-quantum and hybrid cryptographic primitives in the TLS protocol. By leveraging the OpenSSL library, the framework enables the seamless evaluation and comparison of key encapsulation mechanisms (KEMs) and signature schemes provided by the Open Quantum Safe project. The proposed framework is used to analyze different TLS configurations involving classic, hybrid and post-quantum primitives, with a focus on those selected by NIST. The study concentrates on evaluating the performance impact and the data overhead introduced by configurations involving primitives at different security levels. It starts by benchmarking standalone cryptographic primitives and continues with the evaluation of TLS configurations with hybrid and post-quantum KEMs under controlled network conditions, as this is the first natural step for a transition to a quantum-safe TLS. An impact analysis on real-world scenarios follows. Finally, our evaluation concentrates on providing insight into the cost of shifting to TLS configurations involving only hybrid or post-quantum primitives.
The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.