The advancement of quantum computing creates a big threat to classical cryptographic protocols, including TLS, which is responsible for secure internet communications. While recent industry and academic efforts have focused on integrating lattice-based post-quantum key encapsulation mechanisms (KEMs) such as Kyber+X25519 into hybrid TLS handshakes, these approaches often prioritize performance at the cost of cryptanalytic diversity. Code-based KEMs, despite their proven security measure they remain underexplored in hybrid frameworks due to some limitations like large key sizes and integration complexity. This paper proposes a novel hybrid TLS framework that explicitly incorporates code-based post-quantum cryptography—specifically McEliece—alongside classical key exchange mechanisms. The framework introduces a dual-handshake mechanism, adaptive parameter selection, and seamless fallback negotiation, enabling flexible deployment across heterogeneous networks while ensuring backward compatibility. Integration with Quantum Random Number Generators (QRNGs) and multifactor authentication further increases entropy quality and session security. We implemented and evaluated the framework using an OpenSSL-OQS integration. We measure handshake latency, CPU utilization, memory usage, and throughput across emulated and real-world testbeds. Results show that the proposed hybrid approach achieves up to 30% lower latency and significantly reduced resource overhead compared to pure post-quantum TLS variants, while maintaining near-classical efficiency levels. Mathematical modeling formalizes these trade-offs which offers a foundation for optimizing deployment in both resource-constrained IoT devices and high-performance servers. By advancing cryptographic diversity and aligning with emerging NIST and IETF standardization efforts, the proposed framework provides a practical pathway toward quantum-resilient secure communication.It shows that code-based post-quantum cryptography can be added to current TLS systems without any problems, keeping security, performance, and compatibility in mind as we get ready for the quantum age.
The advancement of quantum computing creates a big threat to classical cryptographic protocols, including TLS, which is responsible for secure internet communications. While recent industry and academic efforts have focused on integrating lattice-based post-quantum key encapsulation mechanisms (KEMs) such as Kyber+X25519 into hybrid TLS handshakes, these approaches often prioritize performance at the cost of cryptanalytic diversity. Code-based KEMs, despite their proven security measure they remain underexplored in hybrid frameworks due to some limitations like large key sizes and integration complexity. This paper proposes a novel hybrid TLS framework that explicitly incorporates code-based post-quantum cryptography—specifically McEliece—alongside classical key exchange mechanisms. The framework introduces a dual-handshake mechanism, adaptive parameter selection, and seamless fallback negotiation, enabling flexible deployment across heterogeneous networks while ensuring backward compatibility. Integration with Quantum Random Number Generators (QRNGs) and multifactor authentication further increases entropy quality and session security. We implemented and evaluated the framework using an OpenSSL-OQS integration. We measure handshake latency, CPU utilization, memory usage, and throughput across emulated and real-world testbeds. Results show that the proposed hybrid approach achieves up to 30% lower latency and significantly reduced resource overhead compared to pure post-quantum TLS variants, while maintaining near-classical efficiency levels. Mathematical modeling formalizes these trade-offs which offers a foundation for optimizing deployment in both resource-constrained IoT devices and high-performance servers. By advancing cryptographic diversity and aligning with emerging NIST and IETF standardization efforts, the proposed framework provides a practical pathway toward quantum-resilient secure communication.It shows that code-based post-quantum cryptography can be added to current TLS systems without any problems, keeping security, performance, and compatibility in mind as we get ready for the quantum age.
Currently available cryptographic algorithms such as the RSA, Diffie-Hellman and the ECC are used in securing most Internet communications across the Internet. Theoretical quantum algorithms (and the Shor algorithm in particular) were demonstrated to be able to efficiently break that type of classical cryptography as soon as large-scale quantum computers are developed. To handle this new emerging security problem, PQC has been proposed as a class of cryptographic algorithms that is resistant to both quantum and classical attackers. It is a research paper offering and experimentally implementing a hybrid PQC-TLS protocol in a heterogeneous network architecture which includes edge computing devices and cloud computing and IoT devices. The suggested architecture integrates both lattice-based CRYSTALS-Kyber key encapsulation scheme and CRYSTALS-Dilithium digital signature scheme in the TLS 1.3 handshake without being interoperable with the older ECC-based key exchange schemes. Five measures of performance that included handshake latency, CPU consumption, memory consumption, bandwidth overhead and energy consumption were analyzed in detail through experimentation. The experiments were conducted using in Iot, edge and cloud nodes under controlled conditions that were repeated a number of times to give reliability in the statistics. The results indicate that the integration of PQC has moderate overhead (mean increase in latency about 1517) and decent computational and energy requirements. Another method of resisting popular attacks on networks like as the man in the middle, replay, and downgrade attacks, is security validation. The findings indicate that quantum resilient secure communication migration to a heterogeneous distributed infrastructure can be practically and scalably provided using hybrid PQC-TLS protocols. Statistical analysis including standard deviation and 95% confidence intervals was performed to validate the reliability of the results.
the rapid advancement of quantum computing introduces substantial risks to classical cryptographic algorithms that rely on number-theoretic problems, such as the Rivest–Shamir–Adleman algorithm and elliptic curve cryptography. These cryptographic primitives are susceptible to polynomial-time quantum algorithms like those proposed by Shor and Grover, thereby endangering the security of contemporary digital infrastructures. In light of these emerging threats, the global cryptographic community is prioritizing the development and deployment of quantum-resistant cryptographic techniques. These include diverse algorithmic families such as those based on lattices, hash functions, error-correcting codes, and multivariate polynomials. Each approach exhibits distinct trade-offs in terms of computational performance, key length, signature size, and long-term resilience. This paper introduces a hybrid cryptographic framework optimized for specific application domains, particularly those with limited computational and energy resources. The proposed architecture strategically combines lattice-based encryption, hash-based digital signatures, and code-based key encapsulation mechanisms to form a unified model for secure data transmission. The architecture is implemented and evaluated across heterogeneous computing environments, including low-power embedded systems and Field-Programmable Gate Arrays. Experimental metrics such as execution latency, computational overhead, memory consumption, and energy efficiency are assessed and benchmarked against traditional single-algorithm deployments. The findings demonstrate that the hybrid approach maintains strong quantum resistance while significantly reducing performance penalties, making it suitable for mobile platforms, Internet of Things environments, and real-time communication systems. Future work should emphasize further fine-tuning for specific industrial domains, standardization of hybrid cryptographic protocols, and integration with artificial intelligence-based adaptive security layers to ensure sustainability in the approaching quantum era.
Classical public-key cryptography, mainly RSA, is at risk from the emergence of quantum computers. A complete shift to Post-Quantum Cryptography (PQC) faces vulnerabilities due to implementation and trust issues, despite NIST's approval of standards such as ML-KEM (Kyber). This paper presented a performance and bandwidth trade-off study of a proposed Hybrid Key Encapsulation Mechanism that fused the NIST-standardized ML-KEM-768 (FIPS 203) with the traditional RSA-3072. Two separate secret keys S1 and S2 were produced and encapsulated utilizing both classical and post-quantum public keys in our dual-layered model. In order to create a strong session key that ensures trust transition and backward compatibility with current network infrastructures, these secrets were then combined using a Hybrid Key Derivation Function (HKDF). In comparison to standalone systems, the study assessed the computational cost and communication latency brought about by this hybrid overhead. According to experimental data, the hybrid architecture offers a crucial security fail-safe against both classical flaws and future quantum threats without prohibitively high performance, even though it increases ciphertext size.
The emergence of cryptographically relevant quantum computers threatens the security ofclassical public-key cryptography, necessitating the transition toward post-quantum cryptographic (PQC)algorithms standardized by NIST. At the same time, modern Internet protocols such as HTTP/3—runningover the QUIC transport protocol—are becoming widely deployed, offering reduced latency and improvedreliability compared to traditional TCP+TLS stacks. Ensuring that HTTP/3 infrastructure remains secure inthe post-quantum era requires practical implementations that integrate PQC algorithms without causingprohibitive performance overheads. In this study, we present the development of a PQC–enabled Apacheweb server that supports HTTP/3 through a custom OpenSSL 3.5.4 provider embedding the NISTstandardized ML-KEM and ML-DSA algorithms. Our implementation integrates PQC primitives into theQUIC handshake via modified OpenSSL EVP interfaces and enables PQC-based certificates and keyencapsulation mechanisms within a Caddy reverse proxy + Apache server architecture. Performanceevaluations were conducted on heterogeneous hardware, including a Raspberry Pi 4 and an Intel-baseddesktop system, under realistic network conditions. Experimental results show that ML-KEM and MLDSA introduce moderate handshake latency (≈18%) and minimal throughput reduction (4–8%). Across allconfigurations, HTTP/3's multiplexed, UDP-based design mitigated PQC-related delays, maintaining morethan 90% of classical throughput. The results demonstrate that integrating standardized PQC algorithmsinto modern web servers is both feasible and efficient, validating HTTP/3 as a strong foundation forquantum-resilient Internet communication. This work provides an operational reference for deploying PQCwithin web infrastructures and highlights pathways for future enhancements such as hybrid key exchange,certificate compression, and hardware acceleration.
The emergence of large-scale quantum computers poses a significant threat to current cryptographic protocols, particularly Transport Layer Security (TLS), which relies on RSA and elliptic curve cryptography vulnerable to Shor's algorithm. This paper presents a hybrid framework for quantum-resistant TLS handshakes that integrates post-quantum cryptography (PQC), quantum key distribution (QKD) and classical cryptography to provide comprehensive protection against both classical and quantum attacks. The approach employs three QKD protocols; BB84, E91, and Measurement-Device-Independent QKD (MDI-QKD) alongside NIST-standardized PQC algorithms as well as alternative candidates such as HQC and BIKE. A key innovation is the QKD key management module, which addresses performance bottlenecks through periodic key generation and secure reuse within predefined retention periods, significantly reducing QKD overhead in TLS handshakes. The experimental implementation using the quantum network simulator evaluated 144 distinct cryptographic protocol combinations. Results demonstrate that ML-KEM combined with ML-DSA provides optimal PQC performance, while QKD protocol selection is distance-dependent: BB84 for short-range and MDI-QKD for long-distance communication. The framework includes various attack mitigation mechanisms and ensure security as long as at least one cryptographic method remains uncompromised. Consistent with current global quantum network usage, the proposed TLS approach is designed primarily for MAN and WAN environments rather than the Internet, providing a balanced solution that combines theoretical security guarantees with computational efficiency.
The proliferation of Internet of Things (IoT) devices that use the Message Queuing Telemetry Transport (MQTT) protocol poses significant security challenges in the emerging quantum computing era. Current Transport Layer Security (TLS) implementations rely on classical cryptographic algorithms vulnerable to Shor's algorithm. This paper proposes PQ-MQTT, a hybrid post-quantum secure communication protocol that integrates ML-KEM-768 with X25519 for key encapsulation and a lightweight session-key derivation mechanism optimized for resource-constrained IoT publishers. We present a formal security analysis under the Quantum Random Oracle Model (QROM), demonstrating resilience against store-now-decryptlater attacks. Experimental evaluation on the Raspberry Pi 4, ESP32, and Arduino Nano 33 platforms shows that PQ-MQTT achieves handshake latencies of127.3ms,412.7ms, and1,847.2ms, respectively, with 18.2 KB of additional memory overhead. A comparative analysis of pure post-quantum and classical TLS implementations shows energy reductions of23.5%−40.5%relative to pure PQC, achieved through our hybrid optimization approach, while maintaining 94.2 % throughput efficiency.