Legacy SCADA protocols like DNP3 are vital for smart grid communications but lack robust defenses against modern cyber threats, especially from quantum computing. Current security enhancements, such as DNP3 Secure Authentication (DNP3-SA) and its broadcast variant (DNP3-SAB), are vulnerable due to their reliance on classical cryptography and static configurations. This paper introduces a Quantum-Safe Hybrid Authentication Protocol with Moving Target Defense (MTD), which combines post-quantum ML-KEM lattice-based cryptography with classical ECC-Diffie-Hellman key exchanges to protect against both classical and quantum attacks. The protocol employs MTD to dynamically reconfigure identities and network settings, disrupting reconnaissance and persistent attacks. It includes four phases: synchronization, key agreement, key update, and MTD-driven authentication, ensuring secure, low-latency communication. Formal analysis in universal composability framework confirms mutual authentication and session key secrecy, while Scyther tool verification demonstrates resilience against adversarial exploits. Performance evaluations show efficiency comparable to DNP3-SAB. Overall, this hybrid approach significantly enhances the security of legacy SCADA systems against evolving cyber-physical threats. For the real-world deployment, to benefit wider stakeholders, we provide a handy plug-and-play (HPP) module, which is a takeaway from this research.
Legacy SCADA protocols like DNP3 are vital for smart grid communications but lack robust defenses against modern cyber threats, especially from quantum computing. Current security enhancements, such as DNP3 Secure Authentication (DNP3-SA) and its broadcast variant (DNP3-SAB), are vulnerable due to their reliance on classical cryptography and static configurations. This paper introduces a Quantum-Safe Hybrid Authentication Protocol with Moving Target Defense (MTD), which combines post-quantum ML-KEM lattice-based cryptography with classical ECC-Diffie-Hellman key exchanges to protect against both classical and quantum attacks. The protocol employs MTD to dynamically reconfigure identities and network settings, disrupting reconnaissance and persistent attacks. It includes four phases: synchronization, key agreement, key update, and MTD-driven authentication, ensuring secure, low-latency communication. Formal analysis in universal composability framework confirms mutual authentication and session key secrecy, while Scyther tool verification demonstrates resilience against adversarial exploits. Performance evaluations show efficiency comparable to DNP3-SAB. Overall, this hybrid approach significantly enhances the security of legacy SCADA systems against evolving cyber-physical threats. For the real-world deployment, to benefit wider stakeholders, we provide a handy plug-and-play (HPP) module, which is a takeaway from this research.
Security mechanisms for Operational Technology (OT) protocols like Modbus/TCP Security, DNP3-SAv6 and Profinet Security protect the underlying protocols that govern how industrial automation systems communicate. However, these solutions are dependent on classical cryptography and lack the agility to withstand the emerging threat posed by quantum computing, which breaks or weakens classical cryptography. Furthermore, the increasing sophistication of classical cyberattacks on industrial control systems, as evidenced by the recent Polish power grid incident of December 2025, shows the growing capabilities of adversaries. When considered alongside the anticipated capabilities of quantum computing, this necessitates the development of robust and future-resilient security mechanisms for OT nvironments. In this paper, we present PQOTSec, a protocol-agnostic, post-quantum (PQ) secure overlay that enables mutual authentication and secure key exchange without modifying the existing protocol structure. Our framework employs NIST-standardised ML-DSA for authentication and ML-KEM for key establishment and achieves confidentiality, integrity, availability, and authenticity in PQ settings. We assess the security of our framework using the AVISPA tool and demonstrate its applicability by overlaying it onto Modbus/TCP. In our experiment, the framework shows better performance than Modbus/TCP Security, making it suitable for deployment in OT environments. We finally use PQ-OTSec to mitigate the vulnerabilities exploited in the Polish power grid attack, as well as protect against future quantum threats
Quantum computing is rapidly approaching a stage where classical cryptographic systems, particularly RSA, ECC, and Diffie–Hellman, will no longer provide adequate security for critical infrastructure. The emergence of Shor’s and Grover’s algorithms introduces unprecedented vulnerability to national cyber-defense ecosystems, underpinning power grids, transportation, military communications, and banking systems. This paper presents a unified post-quantum cryptographic (PQC) security framework integrating lattice-based primitives, hybrid key-exchange mechanisms, and secure orchestration for resource-constrained operational-technology environments. The proposed architecture leverages NIST-recommended schemes, including CRYSTALS-Kyber, CRYSTALS-Dilithium, and SPHINCS+, to ensure long-term confidentiality, integrity, and interoperability across legacy and modern control environments. A defense-in-depth trust-fabric is introduced to protect critical data flows across edge controllers, automation PLCs, substations, cloud-SCADA gateways, and defense communication systems. Performance evaluation demonstrates a 39.4% reduction in key-exchange latency, 46% faster authentication cycles, and zero-downtime cryptographic transition capability. Our findings position this framework as a practical migration blueprint supporting national PQC readiness and cyber-resilience mandates.
The Hybrid approach in Quantum Cryptography creates adaptable security model which provides the safest Communication in the emerging quantum era. The development of quantum computing raise questions about the long-term security. Traditional algorithms, such as RSA, ECC, and Diffie-Hellman, which is seemed computationally secure but it can be effectively solved by quantum algorithms such as Shor's and Grover's. This problem leads to the origination of two key trends in current studies, namely Post-Quantum Cryptography (PQC), designing mathematical approaches to encryption resistant to quantum attacks; Quantum Key Distribution (QKD) using the principles of quantum mechanics to assure security in communications. Accordingly, this research proposes a hybrid security framework including reliable data encryption and authentication using PQC, combined with the safe key- exchange method of QKD. The model is implemented in Python, Qiskit, and PQClean's Kyber and Dilithium algorithms to show how these two paradigms can cooperate toward quantum- resilient communication. To present the system performance, key exchange efficiency, computational overhead, and security strength have been considered. According to the results, this hybrid approach gives superior defense against quantum threats while maintaining practical effectiveness for real-world applications such as cloud security, 6G networks, and the Internet of Things.
The convergence of quantum computing capabilities and sophisticated cyberattacks poses unprecedented threats to critical infrastructure communications. Traditional cryptographic defenses and perimeter-based security models are increasingly inadequate against quantum-enabled adversaries and advanced persistent threats targeting operational technology (OT) environments. This paper presents a comprehensive framework for implementing post-quantum cryptography (PQC) within a zero-trust architecture to secure critical infrastructure communications across control centers, substations, hospitals, and ports. Our approach integrates NIST-endorsed quantum-resistant cryptographic suites with identity-first network segmentation, authenticated SCADA protocol encryption, and continuous verification mechanisms. The proposed framework addresses the unique challenges of legacy industrial systems while providing scalable security for hybrid OT/IT environments. Through systematic analysis of current vulnerabilities and implementation strategies, this research demonstrates how a post-quantum zero-trust backbone can prevent catastrophic cyberattacks while maintaining operational continuity in critical infrastructure sectors.
The evolution of 6G networks necessitates robust authentication and key agreement (AKA) protocols to counter emerging security challenges, particularly the threat posed by quantum computing. Existing 5G-AKA protocols remain vulnerable to user tracking, replay attacks, and false base station impersonation, while Elliptic Curve Cryptography (ECC) and RSA-based key exchanges face imminent obsolescence due to quantum attacks. This study examines the vulnerabilities of 5G-AKA and explores hybrid post-quantum cryptography (PQC) as a transitional security solution for 6G networks. We evaluate NIST-standardized PQC algorithms, focusing on their computational overhead, key size efficiency, and adaptability to heterogeneous network environments, including IoT and ultra-low latency applications. A comparative analysis of hybrid cryptographic schemes demonstrates that lattice-based (Kyber, Dilithium), hash-based (SPHINCS+), and code-based (BIKE, Classic McEliece) PQC techniques provide varying trade-offs between security, efficiency, and deployment feasibility. Furthermore, we propose a quantum-resistant 6G-AKA framework, integrating hybrid PQC, AI-driven trust mechanisms, and decentralized authentication to ensure scalability and interoperability. Experimental benchmarks highlight potential performance constraints, including latency in PQC-based key exchange and resource limitations in edge computing. Addressing these challenges requires the optimization of lightweight PQC implementations, formal security validation, and global standardization efforts. Our findings provide a roadmap for the secure transition to 6G authentication protocols, ensuring resilience against both classical and quantum threats.
The imminent advent of quantum computing threatens the long-term security of classical public-key cryptography, creating critical challenges for resource-constrained internet of things (IoT) environments.Hybrid cryptographic frameworks combining elliptic curve cryptography (ECC) with post-quantum cryptography (PQC) primitives have emerged as a transitional solution; however, their security properties remain insufficiently validated under semi-trusted infrastructure assumptions.This paper presents a comprehensive security evaluation of a hybrid ECC-KEM authentication and key agreement framework targeting IoT deployments.Using a dual-verification methodology that integrates formal symbolic analysis with the Tamarin-Prover and practical AI-assisted testing via the APSVer tool, we identify a critical impersonation vulnerability that enables a semi-trusted third party (TTP) to reconstruct PUF-based authentication material.To mitigate this flaw, we introduce a protocol enhancement incorporating ML-DSA post-quantum digital signatures and device-isolated key derivation.Formal verification confirms that the enhanced protocol achieves mutual authentication, session key secrecy, replay resistance, and effective isolation of the TTP.Experimental performance analysis demonstrates that the proposed security improvements introduce only a 12%-15% computational overhead, preserving feasibility for constrained IoT devices.The proposed framework provides a practical, quantum-resilient authentication architecture suitable for next-generation secure IoT deployments.