Several lightweight protocols are being developed to secure communication in resource-constrained environments. Ephemeral Diffie-Hellman over COSE (EDHOC) plays a key role in this lightweight protocol family by managing the key establishment process. However, due to the vulnerability of the discrete logarithm problem to Shor’s algorithm, a quantum-resistant replacement for Diffie-Hellman is required. This work examines the quantum-resistant transition of EDHOC, focusing on its multiple authentication methods as a step toward enabling robust post-quantum security for IoT devices. A novel authentication method for EDHOC is introduced, utilizing Key Encapsulation Mechanisms (KEMs) as a replacement for the static Diffie-Hellman (DH) authentication method, providing a post-quantum signature-free alternative. Among existing post-quantum algorithms for both KEMs and signatures, the NIST-standardized ML-KEM offers the fastest implementation at the lowest memory cost, both of which are crucial for resource-constrained devices. While compatible with various post-quantum KEMs, the method can exploit the computational efficiency of ML-KEM to bring a PQ Signature-free EDHOC to highly constrained devices, providing the same security guarantees as classical EDHOC once the handshake is complete. Additionally, an efficient three-message handshake KEM-based EDHOC Initiator Known Responder (IKR) variant is proposed for environments with pre-established peer awareness.
Several lightweight protocols are being developed to secure communication in resource-constrained environments. Ephemeral Diffie-Hellman over COSE (EDHOC) plays a key role in this lightweight protocol family by managing the key establishment process. However, due to the vulnerability of the discrete logarithm problem to Shor’s algorithm, a quantum-resistant replacement for Diffie-Hellman is required. This work examines the quantum-resistant transition of EDHOC, focusing on its multiple authentication methods as a step toward enabling robust post-quantum security for IoT devices. A novel authentication method for EDHOC is introduced, utilizing Key Encapsulation Mechanisms (KEMs) as a replacement for the static Diffie-Hellman (DH) authentication method, providing a post-quantum signature-free alternative. Among existing post-quantum algorithms for both KEMs and signatures, the NIST-standardized ML-KEM offers the fastest implementation at the lowest memory cost, both of which are crucial for resource-constrained devices. While compatible with various post-quantum KEMs, the method can exploit the computational efficiency of ML-KEM to bring a PQ Signature-free EDHOC to highly constrained devices, providing the same security guarantees as classical EDHOC once the handshake is complete. Additionally, an efficient three-message handshake KEM-based EDHOC Initiator Known Responder (IKR) variant is proposed for environments with pre-established peer awareness.
The Ephemeral Diffie-Hellman over COSE (EDHOC) is a compact and lightweight key establishment protocol for constrained scenarios that provides end-to-end application layer security context. However, because of the vulnerability of the discrete logarithm problem to Shor’s algorithm, a quantum resistant replacement for Diffie-Hellman is required. This paper proposes an architecture to transform EDHOC into a quantum-resistant protocol, with an open-source implementation supporting various Post Quantum Cryptography (PQC) schemes from the National Institute of Standards and Technology (NIST) PQC standardization process. Necessary modifications to EDHOC are analyzed, integrating PQC Key Encapsulation Mechanisms (KEMs) and PQC digital signatures in a complete Post-Quantum (PQ) version of the EDHOC protocol (PQ-EDHOC). PQC operations often involve complex computations and require larger byte sizes, which can challenge resource-constrained devices designed for lightweight operation in constrained network environments. To evaluate the applicability of various PQC schemes in a realistic PQ EDHOC environment, various PQC KEM and Digital Signature combinations are assessed for execution time, energy consumption, memory usage, and network performance on an nRF52840 ARM Cortex-M4 platform with a 6LoWPAN (IPv6 over Low-Power Wireless Personal Area Networks) over BLE (Bluetooth LowEnergy) network. Results indicate that NIST standardized ML-KEM emerges as the only suitable KEM choice for resource-constrained environments, while promising new signature schemes, like HAWK, show significant performance improvement over the NIST standardized ML-DSA and selected for standardization FALCON.
Transport Layer Security (TLS) is considered to be the most used standard security protocol for the Internet of Things (IoT). However, as TLS was originally designed for computer networks, it is not optimal with respect to efficiency. Therefore, a new protocol called Object Security for Constrained RESTful Environments (OSCORE) has been standardized for securing constrained devices. Currently, the Ephemeral-Diffie-Hellman-Over-COSE (EDHOC) protocol, which is a key exchange protocol to define a session key used in OSCORE, is also in the process of being standardized. EDHOC consists of four authentication modes, each offering different security strengths and performance. However, these modes are not yet secure against quantum attacks. Since we are in a transition period and do not yet possess deeply analyzed post-quantum algorithms, we propose a generic hybrid protocol. As such, the protocol can easily update from one post-quantum algorithm to the other and becomes secure against either a post-quantum attack or a potential attack against a newly defined post-quantum algorithm. The proposed mode does not require any changes to the original EDHOC protocol and offers perfect backward compatibility. The security is ensured using Real-Or-Random (ROR) logic, and additional performance costs are analyzed using different variants of post-quantum algorithms.
Traditional public-key cryptography algorithms, such as Elliptic Curve Diffie-Hellman (ECDH), are vulnerable to quantum computing attacks. More critically, security protocols based on these algorithms are exposed to the “Harvest Now, Decrypt Later” threat, an ongoing risk that emphasizes the urgency of transitioning to post-quantum cryptography. This transition presents a significant challenge for lightweight security protocols, such as Ephemeral Diffie-Hellman over COSE (EDHOC), which are designed for IoT environments. To address this, a PQ/T hybrid key exchange construction for EDHOC is proposed, combining post-quantum mechanisms alongside traditional algorithms to mitigate future quantum threats while remaining secure against current threats using well-established classical cryptography. The scheme is evaluated on a CortexM4 processor, demonstrating the best performance with ML-KEM-512, with a slight increase in processing time, limited RAM overhead, and a roughly sevenfold increase in message size. Despite these trade-offs, the hybrid construction remains practical and represents a viable option for enhancing EDHOC security in anticipation of the post-quantum era in constrained environments.
The advent of quantum computing poses significant threats to classical public-key cryptographic systems such as RSA and Elliptic Curve Cryptography, necessitating quantum-safe migration paths for Internet of Things (IoT) communication. The Ephemeral Diffie-Hellman Over COSE (EDHOC) protocol provides lightweight authenticated key exchange for resource-constrained IoT devices but lacks quantum-safe security and formally verified implementations. This thesis introduces KEMEDHOC, a KEM-based, signature-free, post-quantum variant of EDHOC that achieves mutual authentication through optimized integration of Key Encapsulation Mechanisms (KEMs). Compared to the direct adaptation, KEMEDHOC reduces noticeably message size (by over \textbf{33\%}) and handshake time (by \textbf{15\%}), while maintaining comparable security levels. Formal verification, at design-level, using ProVerif confirms that KEMEDHOC preserve all core EDHOC security properties, including mutual authentication, confidentiality, and forward secrecy. Verified implementations (EDHOC* and KEMEDHOC*) developed in F* and Low* ensure functional correctness, memory safety, and timing constant-time behavior, down to verified C code through KaRaMel compiler. Overall, this thesis delivers the first end-to-end formally verified post-quantum variant of EDHOC, demonstrating that formal assurance and post-quantum security can be obtained efficiently in lightweight key exchange protocols.
The security of state-of-the-art Bluetooth pairing relies on Elliptic Curve Diffie–Hellman (ECDH), which is vulnerable to quantum attacks. However, the feasibility of integrating standardized Post-Quantum Cryptographic (PQC) primitives into the controller-level Bluetooth Classic (BC) protocol stack remains an open question. This paper presents the first comprehensive evaluation of integrating a post-quantum secure key exchange for BC pairing. We analyze the impact of replacing the existing ECDH-based key establishment with NIST-standardized PQC Key Encapsulation Mechanisms (KEMs), focusing on protocol-level packetization, over-the-air transmission overhead, and execution performance in constrained hardware. Using BC’s Link Manager Protocol (LMP) and DM1 packet structure, we quantify Public Parameter Transmission (PPT) latency for classical and post-quantum schemes. We further benchmark ECDH and ML-KEM implementations on an ARM Cortex-M4 microcontroller with characteristics comparable to those of constrained Bluetooth controllers. Our results show that ML-KEM is computationally feasible on such hardware, often matching or outperforming classical ECDH in execution time. However, PQC significantly increases over-the-air overhead. Under ML-KEM, PPT accounts for 60–75% of total key exchange latency, compared to less than 10% for ECDH. Code-based schemes such as HQC are shown to be impractical due to excessive memory and transmission requirements under provided hardware constraints. These findings indicate that the primary obstacle to post-quantum Bluetooth pairing is not computation but wireless packetization, reliability, and energy consumption; facilitating a safe and efficient quantum-secure migration of resource-constrained wireless communication settings.
Introduction Session establishment, the process by which two parties authenticate each other and derive a shared secret key, forms the foundation for secure digital communication. Quantum computers threaten this foundation by breaking classical public-key primitives such as RSA and elliptic-curve Diffie–Hellman (ECDH), thereby enabling harvest-now–decrypt-later (HNDL) attacks that endanger long-term confidentiality. Methods This paper presents the design, implementation, and evaluation of an authenticated, quantum-resistant session protocol that replaces these vulnerable mechanisms with their post-quantum counterparts. The proposed protocol integrates ML-KEM-1024 (FIPS 203; CRYSTALS, Kyber) for ephemeral key exchange, ML-DSA-65 (FIPS 204; CRYSTALS, Dilithium) for endpoint authentication, and AES-256-GCM for symmetric protection. A transcript-bound HKDF–SHA3-256 key schedule and a 96-bit GCM nonce construction with conservative rekey limits are used to ensure forward secrecy, downgrade resistance, and message integrity. A Python/C prototype (PQClean ML-KEM-1024 with PyCryptodome AES-256-GCM) was benchmarked over 1,000 iterations on commodity hardware. Results The results show that sub-millisecond cryptographic overhead ML-KEM-1024 matches the performance of X25519 while vastly outperforming RSA-3072 in secure session establishment, and symmetric encryption remains cost effective. Nonces are unique 96-bit values, never reused across directions or beyond 2³² records, following NIST SP 800-38D; when nonce-misuse resistance is required, AES-256-GCM-SIV (RFC 8452) is supported as a drop-in alternative. Empirical tests under both local and WAN-emulated ( ≈ 40 ms RTT) network conditions confirm that the additional post-quantum cost maintains the handshake cryptographic latency in the 0.50–0.70 ms range. Discussion These results demonstrate that fully authenticated, forward-secure, quantum-resistant session negotiation is practical for real-world deployments.