Recent advances in quantum computing threaten key exchange protocols based on problems like prime factorization and discrete logarithms. In response, NIST is standardizing post-quantum cryptographic methods, selecting CRYSTALS-Kyber for its efficiency. However, Kyber’s key exchange protocol assumes prior authenticated communication and requires significant computational overhead. To address these limitations, we propose a NIST-compliant, quantum-resistant, password-authenticated key exchange protocol for mobile devices. Built on Kyber’s encryption primitives, it achieves mutual authentication and perfect forward secrecy. Compared to Kyber’s original protocol, ours reduces communication and computation costs by 46% and 67%, respectively. It also ensures strong anonymity and resists common attacks. Formal proofs and hardware implementation confirm its security and efficiency.
Recent advances in quantum computing threaten key exchange protocols based on problems like prime factorization and discrete logarithms. In response, NIST is standardizing post-quantum cryptographic methods, selecting CRYSTALS-Kyber for its efficiency. However, Kyber’s key exchange protocol assumes prior authenticated communication and requires significant computational overhead. To address these limitations, we propose a NIST-compliant, quantum-resistant, password-authenticated key exchange protocol for mobile devices. Built on Kyber’s encryption primitives, it achieves mutual authentication and perfect forward secrecy. Compared to Kyber’s original protocol, ours reduces communication and computation costs by 46% and 67%, respectively. It also ensures strong anonymity and resists common attacks. Formal proofs and hardware implementation confirm its security and efficiency.
The explosive growth of smart city infrastructures demands secure and private message exchange between heterogeneous IoT devices deployed in the city. Standard authentication schemes, primarily based on elliptic curve cryptography (ECC) or symmetric primitives, are vulnerable to future quantum adversaries and, thus, are not suitable for extended deployment in public urban settings. In this work, we introduce a new post-quantum anonymous authentication scheme that is based on key encapsulation via CRYSTALS-Kyber and signatures via CRYSTALS-Dilithium. This scheme is able to provide mutual authentication, user anonymity, perfect forward secrecy, and lightweight communication, making it applicable to resource-constrained environments in typical scenarios of smart cities. We provide a formal security proof of our construction under the RealOr-Random model for quantum adversaries (ROR-Q) and an informal analysis showing security against a number of attacks, including impersonation, replay, man-in-the-middle, and key compromise. We provide experimental evaluation on constrained platforms to show the feasibility of the protocol in terms of computational cost and the efficiency of the proposed solution for bandwidth validation for modern smart city applications.
Authentication key exchange protocols enable communication entities to agree on a shared secret value over an insecure public channel. Conventional authentication key exchange protocols rely on mathematical problems that can be broken by Shor's algorithm executed on a quantum computer. This study proposes a quantum-safe authentication protocol that uses the CRYSTALS-Kyber post-quantum cryptographic primitive and Elliptic-Curve Cryptography. The primary application area of the proposed scheme is smart-city infrastructures and resource-constrained environments. This protocol is motivated by the scheme of Parameswarath et al. Their solution lacks perfect forward secrecy and protection against denial-of-service attacks, and it is practically infeasible. The proposed scheme addresses those limitations. The scheme presented in this study was analyzed in the Real-or-Random formal security model. Additionally, the formal security verifier ProVerif was used to verify security properties, including message integrity, strong authentication, and session key secrecy. Moreover, this document includes an informal security analysis that demonstrates a wide range of security features. This study also contains a performance analysis of the proposed scheme along with other recently published schemes. The total computation costs at the IoT device and the Cloud Server are 0.2014 and 0.216 milliseconds, respectively. The storage cost for both the IoT device and the Cloud Server is 2545 bytes. The total communication cost for authentication messages is 1687 bytes. Finally, the presented protocol was simulated using the NS3 network simulator. The measured values for Packet Delivery Ratio, End-to-End delay, and Throughput in a scenario with 40 devices are 99.07\%, 3.54 ms, and 162.92 kbps, respectively.
Objective: To design a secure and efficient three-party post-quantum authenticated key agreement (AKE) protocol that ensures mutual authentication, user anonymity, and forward secrecy, while resisting both classical and quantum adversaries. Methods: The proposed protocol is constructed using the Ring Learning with Errors (Ring-LWE) assumption, which is widely regarded as quantum-resistant. The scheme enables two users to establish a shared session key through a trusted server over an insecure channel. Cryptographic hash functions, lattice-based operations, and masking techniques are employed to achieve authentication, anonymity, and key confidentiality. Formal correctness proofs, informal security analysis, and comparative performance evaluations are conducted to validate the protocol. Findings: The study describes qualitative benefits like "outperforms current protocols" but lacks specific metrics, such as exact computation costs (e.g., 4913 ns total execution) or communication rounds, and "reduces user-side cost to 2438 ns vs. 5395 ns in Islam et al.". Also, substantially more efficient than pairing- or chaotic-map-based protocols, which incur costs exceeding 12000 ns. Communication overhead is reduced by limiting the exchange to two RLWE-based messages and one server response, avoiding expensive bilinear pairing or biometric hash transmissions. These results demonstrate that the proposed scheme provides stronger security guarantees at a lower computational and communication cost, making it suitable for resource-constrained mobile and IoT environments. Novelty: Unlike existing approaches, the proposed protocol simultaneously guarantees user anonymity, forward secrecy, and quantum resistance in a three-party setting based on Ring-LWE. It overcomes known vulnerabilities in prior schemes and achieves improved efficiency without compromising security, making it a practical and robust solution for post-quantum secure communications. Keywords: Key Establishment, Authentication, Ring Learning with Errors, Anonymous Key Exchange, Post Quantum Forward Secrecy
The advent of quantum computing poses significant challenges to traditional cryptographic systems, threatening the confidentiality, integrity and authenticity of digital communications. This paper investigates the integration of Post-Quantum Cryptography (PQC) algorithms into mobile communication systems to address these challenges. The study focuses on evaluating key PQC algorithms shortlisted by the National Institute of Standards and Technology (NIST), including CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon and SPHINCS+, within the context of 5G and future mobile network architectures. The research encompasses the design and implementation of an experimental framework involving mobile devices, servers, and cloud-based infrastructure to simulate real-world communication scenarios. Performance metrics such as key generation time, signature generation, encryption and decryption speed, and resource consumption were analyzed across various devices to identify algorithms suitable for mobile environments. The findings reveal that lattice-based algorithms, such as Kyber and Dilithium, offer a promising balance between security and efficiency, making them ideal for resource-constrained devices. In contrast, hash-based algorithms like SPHINCS+ exhibit higher computational demands, limiting their practicality in certain applications. This work highlights the importance of algorithm selection and hardware optimization in ensuring secure and efficient communications in the quantum era. By integrating theoretical advancements in PQC with practical applications, this research lays the foundation for quantum-resistant security in mobile networks, ensuring secure and future-ready digital communications.
Once the shared secret key is established, three parties can use it for secure communication using symmetric-key encryption AES (128, 192, 256) algorithms or other cryptographic primitives. Although there are few third-party post-quantum authentication and key agreement protocols exist, but the recent studies in this article show that they are not anonymous or cannot provide forward secrecy. Most of the existing protocols enable adversaries to trace the source of messages. Many of third-party AKA schemes based on conventional public-key cryptosystems are vulnerable to quantum computers. Therefore, this paper contains a forward secure three-party post-quantum authenticated key establishment protocol for mobile devices. The proposed three-party key exchange protocol establishes an authenticated shared key that can be periodically refreshed to maintain forward secrecy. This protocol enables two parties to establish a shared session key even in the presence of quantum adversaries and enables them to communicate confidentially and securely over insecure networks. The protocol is anonymous as both the parties communicate using masked dynamic identities. A contrast study consisting of performance and security assessment is presented, which illustrates the suggested design is more applicable.
The rapid expansion of Internet of Things (IoT) ecosystems has introduced significant security challenges due to resource-constrained devices, heterogeneous network architectures, and largescale connectivity. Traditional authentication and key exchange mechanisms, primarily based on classical cryptographic algorithms such as RSA and ECC, are vulnerable to future quantum computing attacks. The emergence of quantum algorithms, particularly Shor’s algorithm, threatens the long-term confidentiality and integrity of IoT communications. This paper proposes a Quantum-Resistant Authentication and Key Exchange Protocol specifically designed for secure IoT architectures. The proposed framework integrates post-quantum cryptographic primitives, including lattice-based key exchange mechanisms and hash-based authentication schemes, optimized for low computational overhead suitable for constrained IoT devices. The protocol ensures mutual authentication, forward secrecy, and resistance against quantum adversaries while maintaining minimal communication latency. Security analysis demonstrates robustness against replay, man-in-the-middle, and key-compromise attacks. Performance evaluation shows that the proposed solution achieves a balance between quantum security strength and resource efficiency, making it suitable for next-generation IoT deployments in smart cities, healthcare systems, and industrial automation.