The rise of quantum computing poses significant risks to classical cryptographic algorithms, especially those used in digital signatures within Virtual Private Networks (VPNs). This paper proposes a hybrid cryptographic framework for IPsec VPNs that combines traditional digital signatures with post-quantum cryptographic (PQC) techniques to enhance security against both conventional and quantum threats. Our method introduces a dual-signature scheme integrated into the IKEv2 protocol, verified using formal methods via the Tamarin Prover to ensure robustness. We further evaluate performance using a modified StrongSwan implementation under realistic network conditions. Results show that while hybrid signatures introduce modest overhead, they provide a viable and forward-compatible solution for securing VPNs in the post-quantum era.
The rise of quantum computing poses significant risks to classical cryptographic algorithms, especially those used in digital signatures within Virtual Private Networks (VPNs). This paper proposes a hybrid cryptographic framework for IPsec VPNs that combines traditional digital signatures with post-quantum cryptographic (PQC) techniques to enhance security against both conventional and quantum threats. Our method introduces a dual-signature scheme integrated into the IKEv2 protocol, verified using formal methods via the Tamarin Prover to ensure robustness. We further evaluate performance using a modified StrongSwan implementation under realistic network conditions. Results show that while hybrid signatures introduce modest overhead, they provide a viable and forward-compatible solution for securing VPNs in the post-quantum era.
The fast development of quantum computing presents a great threat to the security of classical cryptographic algorithms that support secure communication systems like Virtual Private Networks (VPNs). RSA and ECC algorithms that are commonly employed in key exchange and digital authentication can fall victim to quantum attacks from Shor’s and Grover’s algorithms. This study introduces the design and deployment of a post-quantum-resistant VPN protocol using post-quantum cryptographic (PQC) primitives, i.e., Kyber for key encapsulation and Dilithium for digital signatures. The suggested structure is incorporated into OpenVPN via the Open Quantum Safe (OQS) framework for uninterrupted post-quantum compatibility. The protocol is also capable of supporting hybrid cryptography for smooth transition from classical to post-quantum systems. Performance benchmarks are performed over metrics like handshake latency, tunnel throughput, CPU usage, and certificate overhead. The findings illustrate that post-quantum secure VPNs are not only achievable but also feasible for near-future deployment. This work adds a future-proof framework to improve the resilience of secure communications in the post-quantum era with a focus on scalability, crypto-agility, and real-world implementation readiness.
Building-Wide Virtual Private Network (VPN) systems leverage the current communication infrastructure to connect various IoT devices and management systems through encrypted tunnels. These systems are essential for protecting sensitive data and ensuring operational security but face imminent threats from quantum computers capable of breaking widely-used public key cryptography. In this paper, we propose a lightweight hybrid post-quantum security framework specifically designed for building-wide IoT VPN systems, which combines classical cryptographic primitives (e.g., ECDH) with selected post-quantum crypto (PQC) algorithms (e.g., Kyber, Dilithium). This dual-layer architecture ensures protection against both current and future quantum threats, relying on the hardness of at least one underlying cryptographic assumption for security. Furthermore, the framework incorporates lightweight design principles tailored for resource-constrained IoT environments. These principles emphasize minimal computational demands, reduced communication costs, and limited protocol complexity. Specifically, its lightweight nature reflects simplification to the VPN protocol’s operations and the selected integration of post-quantum algorithms. This optimized application of PQC simplifies the cryptographic workload for key exchange and signature, thereby balancing security guarantees with feasible deployment on IoT hardware. Our analysis and experimental results demonstrate that the proposed architecture achieves quantum resistance with manageable performance impact compared to traditional VPNs, making it a practical and scalable solution for migrating existing building management infrastructures towards post-quantum security across diverse IoT devices.
This paper introduces qTrustNet VPN, a next-generation Virtual Private Network (VPN) designed to enhance security in the quantum era. With the rapid advancement of quantum computing, traditional encryption methods face obsolescence, necessitating more robust security solutions. qTrustNet VPN addresses this need by integrating the WireGuard protocol, known for its simplicity and high performance, with Post-Quantum Cryptography (PQC) algorithms developed by the National Institute of Standards and Technology (NIST). These PQC algorithms are designed to withstand the decryption capabilities of quantum computers, providing long-term security.
The urgent threat posed by cryptographically significant quantum computers (CRQC) necessitates a global transition to Post-Quantum Cryptography (PQC) to secure Virtual Private Networks (VPNs). Current standardization efforts, notably in IETF drafts, focus predominantly on hybrid constructions, which introduce operational complexity, dual overhead, and retain partial security dependence on quantum-vulnerable primitives. This paper is in effort of StrongVPN, a novel protocol and implementation that achieves end-to-end quantum resistance without hybrid dependencies which is lift and scale model. Our architecture integrates ML-DSA-65 choosen for authentication and ML-KEM-768 for key exchange in a unified, certificate-free** handshake, offering a simplified trust model compared to complex X.509/PKI requirements, reducing overheads. The implementation emphasizes performance through low-level mathematical optimizations, including Number Theoretic Transform (NTT) for efficient polynomial arithmetic, and stringent constant-time operations for side-channel resilience. Empirical evaluation validates its practical feasibility, demonstrating a mean end-to-end handshake latency of only 127ms on commodity infrastructure, despite a necessary 14.1KB cryptographic overhead. StrongVPN establishes a critical, high-performance baseline for pure PQC network security, offering a simplified and accelerated migration path to full quantum safety solution.
The urgent threat posed by cryptographically significant quantum computers (CRQC) necessitates a global transition to Post-Quantum Cryptography (PQC) to secure Virtual Private Networks (VPNs). Current standardization efforts, notably in IETF drafts, focus predominantly on hybrid constructions, which introduce operational complexity, dual overhead, and retain partial security dependence on quantum-vulnerable primitives. This paper is in effort of StrongVPN, a novel protocol and implementation that achieves end-to-end quantum resistance without hybrid dependencies which is lift and scale model. Our architecture integrates ML-DSA-65 choosen for authentication and ML-KEM-768 for key exchange in a unified, certificate-free** handshake, offering a simplified trust model compared to complex X.509/PKI requirements, reducing overheads. The implementation emphasizes performance through low-level mathematical optimizations, including Number Theoretic Transform (NTT) for efficient polynomial arithmetic, and stringent constant-time operations for side-channel resilience. Empirical evaluation validates its practical feasibility, demonstrating a mean end-to-end handshake latency of only 127ms on commodity infrastructure, despite a necessary 14.1KB cryptographic overhead. StrongVPN establishes a critical, high-performance baseline for pure PQC network security, offering a simplified and accelerated migration path to full quantum safety solution.
A Virtual Private Network (VPN) ensures the confidentiality and integrity of data transferred between two endpoints, even if the means of transport are insecure. One popular protocol is Internet Protocol Security (IPSec) which operates at OSI layer 3 and protects all protocols at higher layers. Cryptographic keys in IPSec are negotiated using the Internet Key Exchange (IKE) protocol. IKE negotiates security parameters for IPSec sessions. In particular, the IKEv2 protocol uses the Elliptic Curve Diffie-Hellman (ECDH) algorithm to establish a secret key shared between two nodes on a network. Although solving such a problem remains difficult with current computing power, it is believed that generic quantum computers will be able to solve this problem, which implies that the security of IKEv2 is compromised. There are, however, several cryptographic systems that are trusted to be resistant to attacks by quantum computers. This family of cryptosystems is known as quantum-resistant cryptography (QRC). In this paper, after highlighting the requirements for a secure key exchange protocol, we briefly review the QRC solutions that have been proposed in the recent literature.