Traditional public-key cryptography algorithms, such as Elliptic Curve Diffie-Hellman (ECDH), are vulnerable to quantum computing attacks. More critically, security protocols based on these algorithms are exposed to the “Harvest Now, Decrypt Later” threat, an ongoing risk that emphasizes the urgency of transitioning to post-quantum cryptography. This transition presents a significant challenge for lightweight security protocols, such as Ephemeral Diffie-Hellman over COSE (EDHOC), which are designed for IoT environments. To address this, a PQ/T hybrid key exchange construction for EDHOC is proposed, combining post-quantum mechanisms alongside traditional algorithms to mitigate future quantum threats while remaining secure against current threats using well-established classical cryptography. The scheme is evaluated on a CortexM4 processor, demonstrating the best performance with ML-KEM-512, with a slight increase in processing time, limited RAM overhead, and a roughly sevenfold increase in message size. Despite these trade-offs, the hybrid construction remains practical and represents a viable option for enhancing EDHOC security in anticipation of the post-quantum era in constrained environments.
Traditional public-key cryptography algorithms, such as Elliptic Curve Diffie-Hellman (ECDH), are vulnerable to quantum computing attacks. More critically, security protocols based on these algorithms are exposed to the “Harvest Now, Decrypt Later” threat, an ongoing risk that emphasizes the urgency of transitioning to post-quantum cryptography. This transition presents a significant challenge for lightweight security protocols, such as Ephemeral Diffie-Hellman over COSE (EDHOC), which are designed for IoT environments. To address this, a PQ/T hybrid key exchange construction for EDHOC is proposed, combining post-quantum mechanisms alongside traditional algorithms to mitigate future quantum threats while remaining secure against current threats using well-established classical cryptography. The scheme is evaluated on a CortexM4 processor, demonstrating the best performance with ML-KEM-512, with a slight increase in processing time, limited RAM overhead, and a roughly sevenfold increase in message size. Despite these trade-offs, the hybrid construction remains practical and represents a viable option for enhancing EDHOC security in anticipation of the post-quantum era in constrained environments.
The Ephemeral Diffie-Hellman over COSE (EDHOC) is a compact and lightweight key establishment protocol for constrained scenarios that provides end-to-end application layer security context. However, because of the vulnerability of the discrete logarithm problem to Shor’s algorithm, a quantum resistant replacement for Diffie-Hellman is required. This paper proposes an architecture to transform EDHOC into a quantum-resistant protocol, with an open-source implementation supporting various Post Quantum Cryptography (PQC) schemes from the National Institute of Standards and Technology (NIST) PQC standardization process. Necessary modifications to EDHOC are analyzed, integrating PQC Key Encapsulation Mechanisms (KEMs) and PQC digital signatures in a complete Post-Quantum (PQ) version of the EDHOC protocol (PQ-EDHOC). PQC operations often involve complex computations and require larger byte sizes, which can challenge resource-constrained devices designed for lightweight operation in constrained network environments. To evaluate the applicability of various PQC schemes in a realistic PQ EDHOC environment, various PQC KEM and Digital Signature combinations are assessed for execution time, energy consumption, memory usage, and network performance on an nRF52840 ARM Cortex-M4 platform with a 6LoWPAN (IPv6 over Low-Power Wireless Personal Area Networks) over BLE (Bluetooth LowEnergy) network. Results indicate that NIST standardized ML-KEM emerges as the only suitable KEM choice for resource-constrained environments, while promising new signature schemes, like HAWK, show significant performance improvement over the NIST standardized ML-DSA and selected for standardization FALCON.
Transport Layer Security (TLS) is considered to be the most used standard security protocol for the Internet of Things (IoT). However, as TLS was originally designed for computer networks, it is not optimal with respect to efficiency. Therefore, a new protocol called Object Security for Constrained RESTful Environments (OSCORE) has been standardized for securing constrained devices. Currently, the Ephemeral-Diffie-Hellman-Over-COSE (EDHOC) protocol, which is a key exchange protocol to define a session key used in OSCORE, is also in the process of being standardized. EDHOC consists of four authentication modes, each offering different security strengths and performance. However, these modes are not yet secure against quantum attacks. Since we are in a transition period and do not yet possess deeply analyzed post-quantum algorithms, we propose a generic hybrid protocol. As such, the protocol can easily update from one post-quantum algorithm to the other and becomes secure against either a post-quantum attack or a potential attack against a newly defined post-quantum algorithm. The proposed mode does not require any changes to the original EDHOC protocol and offers perfect backward compatibility. The security is ensured using Real-Or-Random (ROR) logic, and additional performance costs are analyzed using different variants of post-quantum algorithms.
Several lightweight protocols are being developed to secure communication in resource-constrained environments. Ephemeral Diffie-Hellman over COSE (EDHOC) plays a key role in this lightweight protocol family by managing the key establishment process. However, due to the vulnerability of the discrete logarithm problem to Shor’s algorithm, a quantum-resistant replacement for Diffie-Hellman is required. This work examines the quantum-resistant transition of EDHOC, focusing on its multiple authentication methods as a step toward enabling robust post-quantum security for IoT devices. A novel authentication method for EDHOC is introduced, utilizing Key Encapsulation Mechanisms (KEMs) as a replacement for the static Diffie-Hellman (DH) authentication method, providing a post-quantum signature-free alternative. Among existing post-quantum algorithms for both KEMs and signatures, the NIST-standardized ML-KEM offers the fastest implementation at the lowest memory cost, both of which are crucial for resource-constrained devices. While compatible with various post-quantum KEMs, the method can exploit the computational efficiency of ML-KEM to bring a PQ Signature-free EDHOC to highly constrained devices, providing the same security guarantees as classical EDHOC once the handshake is complete. Additionally, an efficient three-message handshake KEM-based EDHOC Initiator Known Responder (IKR) variant is proposed for environments with pre-established peer awareness.
Abstract - In the emerging era of quantum computing, traditional cryptographic algorithms such as RSA and Elliptic Curve Cryptography (ECC) are at risk from quantum-based attacks. These developments pose a significant threat to secure network communication systems that rely on classical key exchange mechanisms. To overcome this challenge, the proposed work introduces a Hybrid Quantum-Resistant Key Exchange Protocol that combines the strengths of both classical andpost-quantum cryptographic algorithms. The hybrid approach integrates Elliptic Curve Dif ie–Hellman (ECDH) with alattice-based post-quantum algorithm, Kyber, to establish a shared session key between communicating entities. This sharedkeyisthen utilized for symmetric encryption using AES to ensure confidentiality and data integrity. The system is implementedusingPython socket programming to demonstrate secure data transmission between client and server. Performance is analyzedinterms of key generation time, encryption and decryption speed, key size, and computational ef iciency. The results validatethatthe proposed hybrid model provides enhanced resistance against quantum attacks while maintaining acceptable performance, making it suitable for future secure communication systems. Keywords - elliptic curve dif ie–hellman, hybrid key exchange, kyber, post-quantum cryptography, quantum computing.
The advent of quantum computing poses a significant threat to conventional public-key cryptographic systems, particularly resource-constrained mobile and cyber-physical environments. To address this challenge, this study proposes an implementation-oriented unified hybrid key derivation framework that integrates the Elliptic Curve Diffie–Hellman Ephemeral (ECDHE-P256) and post-quantum ML-KEM-768 algorithm for quantum-resilient secure communication. The proposed approach combines independently generated classical and post-quantum shared secrets through a lightweight mixing step followed by HKDF-SHA256 extraction and expansion to derive a unified 256-bit session key. This design preserves forward secrecy while enhancing resilience against quantum adversaries without requiring substantial modifications to the existing communication infrastructures. The framework was implemented on a heterogeneous testbed consisting of an x86_64 client and ARM64-based Android device. Experimental evaluations were conducted across 27 test configurations under three network latency conditions (50, 150, and 500 ms) using payload sizes of 64, 1024, and 10240 KB. Each configuration was executed for 1000 iterations to ensure statistically reliable measurements. The results demonstrate that, compared with standalone ECDHE-P256 and standalone ML-KEM-768, the proposed hybrid framework introduces only minimal computational overhead while maintaining stable resource utilization. Furthermore, network latency contributes more significantly to end-to-end communication delay than cryptographic processing overhead, indicating that the integration of classical and post-quantum cryptographic mechanisms does not constitute a major performance bottleneck. Overall, the proposed implementation-oriented framework provides a practical and lightweight transition strategy to quantum-resilient secure communication in heterogeneous mobile, IoT, and cyber-physical environments.
As quantum computing technology transitions from theoretical frameworks to scalable physical implementations, the "Harvest Now, Decrypt Later" (HNDL) strategy has emerged as a primary existential threat to long-term digital security. Adversaries are currently intercepting and archiving encrypted sensitive data with the intent of performing retroactive cryptanalysis once cryptographically relevant quantum computers (CRQC) become available. This paper addresses the vulnerability of current Public Key Infrastructure (PKI), specifically RSA and Elliptic Curve Cryptography (ECC), which are susceptible to Shor’s algorithm. We propose "Aethelgard," a high-performance hybrid cryptographic framework that nests NIST-standardized Post-Quantum Cryptography (PQC), specifically ML-KEM (Kyber), within established classical key exchange protocols. By utilizing a dual-layered Key Encapsulation Mechanism (KEM), our framework ensures that data remains confidential even if one of the underlying mathematical primitives is compromised. We evaluate the framework’s efficacy through rigorous network simulations, measuring computational overhead, handshake latency, and packet fragmentation across diverse traffic profiles. Experimental results indicate that while the hybrid approach increases the public key size to approximately 1.2 KB, the overall handshake latency increases by a manageable 18% compared to classical-only protocols. This research demonstrates that hybridizing cryptographic primitives is the most viable path toward achieving immediate "crypto-agility" and mitigating the silent threat of HNDL without sacrificing the reliability of current production environments.