The urgent threat posed by cryptographically significant quantum computers (CRQC) necessitates a global transition to Post-Quantum Cryptography (PQC) to secure Virtual Private Networks (VPNs). Current standardization efforts, notably in IETF drafts, focus predominantly on hybrid constructions, which introduce operational complexity, dual overhead, and retain partial security dependence on quantum-vulnerable primitives. This paper is in effort of StrongVPN, a novel protocol and implementation that achieves end-to-end quantum resistance without hybrid dependencies which is lift and scale model. Our architecture integrates ML-DSA-65 choosen for authentication and ML-KEM-768 for key exchange in a unified, certificate-free** handshake, offering a simplified trust model compared to complex X.509/PKI requirements, reducing overheads. The implementation emphasizes performance through low-level mathematical optimizations, including Number Theoretic Transform (NTT) for efficient polynomial arithmetic, and stringent constant-time operations for side-channel resilience. Empirical evaluation validates its practical feasibility, demonstrating a mean end-to-end handshake latency of only 127ms on commodity infrastructure, despite a necessary 14.1KB cryptographic overhead. StrongVPN establishes a critical, high-performance baseline for pure PQC network security, offering a simplified and accelerated migration path to full quantum safety solution.
The urgent threat posed by cryptographically significant quantum computers (CRQC) necessitates a global transition to Post-Quantum Cryptography (PQC) to secure Virtual Private Networks (VPNs). Current standardization efforts, notably in IETF drafts, focus predominantly on hybrid constructions, which introduce operational complexity, dual overhead, and retain partial security dependence on quantum-vulnerable primitives. This paper is in effort of StrongVPN, a novel protocol and implementation that achieves end-to-end quantum resistance without hybrid dependencies which is lift and scale model. Our architecture integrates ML-DSA-65 choosen for authentication and ML-KEM-768 for key exchange in a unified, certificate-free** handshake, offering a simplified trust model compared to complex X.509/PKI requirements, reducing overheads. The implementation emphasizes performance through low-level mathematical optimizations, including Number Theoretic Transform (NTT) for efficient polynomial arithmetic, and stringent constant-time operations for side-channel resilience. Empirical evaluation validates its practical feasibility, demonstrating a mean end-to-end handshake latency of only 127ms on commodity infrastructure, despite a necessary 14.1KB cryptographic overhead. StrongVPN establishes a critical, high-performance baseline for pure PQC network security, offering a simplified and accelerated migration path to full quantum safety solution.
The urgent threat posed by cryptographically significant quantum computers (CRQC) necessitates a global transition to Post-Quantum Cryptography (PQC) to secure Virtual Private Networks (VPNs). Current standardization efforts, notably in IETF drafts, focus predominantly on hybrid constructions, which introduce operational complexity, dual overhead, and retain partial security dependence on quantum-vulnerable primitives. This paper is in effort of StrongVPN, a novel protocol and implementation that achieves end-to-end quantum resistance without hybrid dependencies which is lift and scale model. Our architecture integrates ML-DSA-65 choosen for authentication and ML-KEM-768 for key exchange in a unified, certificate-free** handshake, offering a simplified trust model compared to complex X.509/PKI requirements, reducing overheads. The implementation emphasizes performance through low-level mathematical optimizations, including Number Theoretic Transform (NTT) for efficient polynomial arithmetic, and stringent constant-time operations for side-channel resilience. Empirical evaluation validates its practical feasibility, demonstrating a mean end-to-end handshake latency of only 127ms on commodity infrastructure, despite a necessary 14.1KB cryptographic overhead. StrongVPN establishes a critical, high-performance baseline for pure PQC network security, offering a simplified and accelerated migration path to full quantum safety solution.
As the era of quantum computing approaches, the fundamental cryptographic primitives securing global communications face a paradigm shift. With the National Institute of Standards and Technology (NIST) finalizing new standards, the industry must urgently address the vulnerabilities of legacy systems. The imminent advent of CRQCs (Cryptographically Relevant Quantum Computers) poses an existential threat to the Public Key Infrastructure (PKI) underpinning the global digital economy. Classical algorithms such as RSA and ECC (Elliptic Curve Cryptography) are vulnerable to polynomial-time cryptanalysis via Shor’s algorithm. This study investigates the HNDL (Harvest Now, Decrypt Later) threat model and evaluates the resilience of NIST-standardized PQC (Post-Quantum Cryptography) algorithms: ML-KEM and ML-DSA. Utilizing a high-performance Fortinet networking environment, we experimentally validate that "Hybrid Mode" IPsec VPNs can achieve quantum resistance with negligible performance degradation, offering a viable migration path for enterprise infrastructure. Specifically, we benchmark the trade-offs between PQC’s larger key sizes and network latency, demonstrating that the overhead remains within acceptable operational thresholds. Implementing hybrid protocols provides a critical transition mechanism, allowing organizations to secure long-term data confidentiality against retrospective decryption while preserving interoperability with legacy systems.
Building-Wide Virtual Private Network (VPN) systems leverage the current communication infrastructure to connect various IoT devices and management systems through encrypted tunnels. These systems are essential for protecting sensitive data and ensuring operational security but face imminent threats from quantum computers capable of breaking widely-used public key cryptography. In this paper, we propose a lightweight hybrid post-quantum security framework specifically designed for building-wide IoT VPN systems, which combines classical cryptographic primitives (e.g., ECDH) with selected post-quantum crypto (PQC) algorithms (e.g., Kyber, Dilithium). This dual-layer architecture ensures protection against both current and future quantum threats, relying on the hardness of at least one underlying cryptographic assumption for security. Furthermore, the framework incorporates lightweight design principles tailored for resource-constrained IoT environments. These principles emphasize minimal computational demands, reduced communication costs, and limited protocol complexity. Specifically, its lightweight nature reflects simplification to the VPN protocol’s operations and the selected integration of post-quantum algorithms. This optimized application of PQC simplifies the cryptographic workload for key exchange and signature, thereby balancing security guarantees with feasible deployment on IoT hardware. Our analysis and experimental results demonstrate that the proposed architecture achieves quantum resistance with manageable performance impact compared to traditional VPNs, making it a practical and scalable solution for migrating existing building management infrastructures towards post-quantum security across diverse IoT devices.
The fast development of quantum computing presents a great threat to the security of classical cryptographic algorithms that support secure communication systems like Virtual Private Networks (VPNs). RSA and ECC algorithms that are commonly employed in key exchange and digital authentication can fall victim to quantum attacks from Shor’s and Grover’s algorithms. This study introduces the design and deployment of a post-quantum-resistant VPN protocol using post-quantum cryptographic (PQC) primitives, i.e., Kyber for key encapsulation and Dilithium for digital signatures. The suggested structure is incorporated into OpenVPN via the Open Quantum Safe (OQS) framework for uninterrupted post-quantum compatibility. The protocol is also capable of supporting hybrid cryptography for smooth transition from classical to post-quantum systems. Performance benchmarks are performed over metrics like handshake latency, tunnel throughput, CPU usage, and certificate overhead. The findings illustrate that post-quantum secure VPNs are not only achievable but also feasible for near-future deployment. This work adds a future-proof framework to improve the resilience of secure communications in the post-quantum era with a focus on scalability, crypto-agility, and real-world implementation readiness.
The emergence of cryptographically relevant quantum computers (CRQCs) would compromise today’s dominant public-key primitives (RSA, DiffieHellman, ECDSA), threatening long-lived confidentiality, authentication, and integrity guarantees across AI pipelines and blockchain networks. This manuscript proposes a unified, quantum-resilient architecture that blends NISTstandardized post-quantum cryptography (PQC)—MLKEM for key establishment and ML-DSA or SLH-DSA for digital signatures—with defense-in-depth controls for AI model protection, data privacy, and blockchain protocol evolution. We first motivate the need for migration by outlining quantum attacks (Shor for factoring and discrete logarithms; Grover for quadratic search speedups) and summarize PQC standardization milestones and transition guidance. We then review the literature on lattice-based and hash-based cryptography, homomorphic encryption for privacy-preserving AI, and secure aggregation/differential privacy as complementary privacy technologies. Building on this foundation, we present a methodology for designing and evaluating quantum-resistant AI and blockchain systems, including key-lifecycle hardening, protocol-level hybrids, and crypto-agility. A simulated deployment (1,000 clients; 16 validator nodes; TLS 1.3 with ML-KEM and hybrid handshakes; blockchain transactions signed with ML-DSA and SLH-DSA) measures handshake and signing overheads, throughput, and model-training privacy-utility trade-offs. Results indicate that: (i) PQC-only handshakes add modest latency yet remain acceptable for online APIs; (ii) hybrid ECDHE+ML-KEM offers near-term defense against “store-now-decrypt-later,” with predictable cost; (iii) ML-DSA is practical for blockchain validation at common block sizes, while SLH-DSA suits firmware/codesigning and archival integrity; and (iv) combining PQC with secure aggregation and differentially private training preserves model utility with bounded overhead.
This thesis investigates the current state of Post-quantum cryptography (PQC) in the industry, with a particular focus on its practical deployment, integration challenges, and performance implications.The study combines a structured analysis of academic literature, standardization efforts, and industry guidance with an experimental evaluation of PQC integration in widely used security protocols. The analysis shows that, while significant progress has been made in the standardization of quantum-resistant algorithms such as ML-KEM, ML-DSA, and SLH-DSA, real-world adoption remains in an early and transitional phase. Organizations primarily focus on evaluation and pilot implementations, as deployment is constrained by interoperability issues, implementation maturity, and the complexity of migrating existing cryptographic infrastructures.To complement the conceptual analysis, experimental measurements were conducted for TLS, SSH, and IPsec to evaluate the performance impact of hybrid post-quantum cryptographic mechanisms. The results indicate that performance overhead is not uniform across components. In particular, post-quantum signature schemes introduce significant computational and network overhead, mainly due to increased key and certificate sizes. In contrast, hybrid key exchange mechanisms show only moderate performance impact across all evaluated protocols.The findings highlight that the primary challenge of PQC adoption lies not in algorithm design but in practical integration and large-scale migration. Hybrid cryptographic approaches emerge as the most viable strategy for enabling a gradual transition, balancing improved security against quantum threats with operational feasibility.Overall, this thesis demonstrates that PQC is transitioning from a theoretical research field to a practical engineering challenge, with significant implications for the future design of secure communication systems.