Quantum computing threatens the long-term security of widely deployed public-key cryptography used to protect medical image transfer. The Digital Imaging and Communications in Medicine (DICOM) standard is the dominant format and protocol suite for medical imaging workflows and is commonly transported over HTTPS. Conventional DICOM-over-HTTPS deployments rely on classical cryptographic primitives that are not resistant to quantum adversaries. This work evaluates the feasibility of integrating post-quantum cryptography (PQC) into existing DICOM transfer infrastructures without modifying DICOM applications or their cryptographic libraries. We present an empirical case study of xPIPE and RSNA MIRC-CTP as a widely deployed DICOM-over-HTTPS toolchain used in hospital environments. We propose a non-invasive proxy-based design that requires no modifications to the xPIPE client, the MIRC-CTP server, or their cryptographic libraries. The design encapsulates TLS-protected DICOM traffic within an additional PQC-secured tunnel, preserving the existing TLS channel while adding a quantum-resistant outer layer. We implement a proof of concept that preserves the existing Java TLS stack ( javax.net.ssl ) used by MIRC-CTP for the inner channel and adds a PQC-secured outer tunnel based on stunnel. We further compare alternative PQC integration strategies and discuss their security and operational trade-offs. Our results show that current PQC deployments impose an computational overhead and introduce integration constraints in heterogeneous environments. Nevertheless, the proposed approach enables incremental migration by maintaining compatibility with existing systems while providing an additional post-quantum security layer. • Non-invasive PQC Integration for Legacy Systems. • Quantum-Resistant Tunnel Layer Using OpenSSL and Stunnel. • Preservation of Regulatory Compliance. • PQC Migration Path Without System Disruption.
Quantum computing threatens the long-term security of widely deployed public-key cryptography used to protect medical image transfer. The Digital Imaging and Communications in Medicine (DICOM) standard is the dominant format and protocol suite for medical imaging workflows and is commonly transported over HTTPS. Conventional DICOM-over-HTTPS deployments rely on classical cryptographic primitives that are not resistant to quantum adversaries. This work evaluates the feasibility of integrating post-quantum cryptography (PQC) into existing DICOM transfer infrastructures without modifying DICOM applications or their cryptographic libraries. We present an empirical case study of xPIPE and RSNA MIRC-CTP as a widely deployed DICOM-over-HTTPS toolchain used in hospital environments. We propose a non-invasive proxy-based design that requires no modifications to the xPIPE client, the MIRC-CTP server, or their cryptographic libraries. The design encapsulates TLS-protected DICOM traffic within an additional PQC-secured tunnel, preserving the existing TLS channel while adding a quantum-resistant outer layer. We implement a proof of concept that preserves the existing Java TLS stack ( javax.net.ssl ) used by MIRC-CTP for the inner channel and adds a PQC-secured outer tunnel based on stunnel. We further compare alternative PQC integration strategies and discuss their security and operational trade-offs. Our results show that current PQC deployments impose an computational overhead and introduce integration constraints in heterogeneous environments. Nevertheless, the proposed approach enables incremental migration by maintaining compatibility with existing systems while providing an additional post-quantum security layer. • Non-invasive PQC Integration for Legacy Systems. • Quantum-Resistant Tunnel Layer Using OpenSSL and Stunnel. • Preservation of Regulatory Compliance. • PQC Migration Path Without System Disruption.
As developments in quantum computing threaten to break existing encryption techniques safeguarding sensitive patient information in cloud-based medical systems, the healthcare sector is confronting never-before-seen cryptographic difficulties. Addressing unique needs like multi-decade data retention demands, legacy medical device limitations, and real-time patient care demands, the framework provides a specialized quantum-secure cryptographic design created particularly for healthcare settings. Three innovations are at the basis: a tiered implementation plan that dynamically allocates post-quantum protection level by medical data sensitivity categorisation, application to edge computing architecture that allows quantum-resistant security with resource-constrained medical devices without hardware enhancements, and healthcare interoperability-aware hybrid protocols to ensure continuous data transfer between FHIR, HL7, and DICOM standards in the event of cryptographic switchovers. The model uses NIST-standardized post-quantum algorithms such as CRYSTALS-Kyber and CRYSTALS-Dilithium (digital signatures) and SPHINCS+ (long-term integrity verification) tailored to healthcare with competing requirements of the highest security and lowest operations latency. The implementation strategies will include the application of phase-based implementation approaches that will include the infrastructure preparation phase through full integration of the ecosystem, with a special focus on the optimization of HIPAA compliance and alignment of regulatory frameworks. Performance optimization techniques leverage characteristic healthcare data access patterns, including patient-centric workflows, clinical department batch processing, and medical imaging parallelization strategies. The quantum-safe infrastructure establishes foundational capabilities for next-generation healthcare innovations, including precision medicine genomics platforms, federated artificial intelligence systems, and global health collaboration networks requiring cryptographic security guarantees spanning decades or centuries against both classical and quantum computational threats.
Abstract The prospect of cryptanalytically relevant quantum computers (CRQCs) motivates a transition from classical cryptography to post-quantum cryptography (PQC). Shor’s algorithm threatens widely deployed public-key schemes used for key establishment and digital signatures, while Grover’s algorithm reduces effective security margins for symmetric-key and hash-based primitives. The harvest-now, decrypt-later (HNDL) threat further increases urgency because adversaries can store encrypted data today for future decryption, placing long-lived confidentiality requirements and trust infrastructure at risk. This survey frames PQC adoption as a standards-to-deployment program. We review the PQC design space and summarize deployment-critical constraints, including handshake and certificate size growth, latency under network loss, computational cost, memory and storage requirements, implementation complexity, and side-channel robustness. We then present an iterative migration pipeline covering cryptographic inventory, risk-based prioritization using data sensitivity and cryptoperiod, algorithm and parameter profile selection, hybrid classical and PQC constructions for backward compatibility, pilot validation with measurable go/no-go criteria, and long-term operations with crypto-agility. Finally, we connect standardization outputs to concrete integration surfaces and illustrate the workflow across transport layer security (TLS) and the web public key infrastructure (Web PKI), virtual private networks (VPNs) and internet protocol security (IPsec), and constrained Internet of things (IoT) deployments, and we summarize open challenges in interoperability, public key infrastructure (PKI) transition mechanics, implementation maturity and operational governance.
The accelerated advancements in quantum computing substantially threaten classical cryptographic systems, particularly those that rely on RSA, ECC, and other public key encryption methods. Particularly Shor's method shows how easily conventional cryptographic techniques might be broken; therefore quick development of quantum resistant substitutes is necessary. Rising as a potential answer with cryptographic algorithms meant to resist quantum attacks is post quantum cryptography (PQC). Nonetheless, performance trade-offs, compatibility problems, and the absence of standardized implementations make the shift to completely quantum-safe cryptographic systems very difficult. Hybrid PQC systems that combine conventional and quantum resistant cryptographic mechanisms have been suggested as a workable method for tackling these difficulties so guaranteeing security in the post quantum future. Emphasizing their security, performance, and practical implementations, this review article offers a thorough study of hybrid PQC methods. The resistance of many hybrid cryptographic models including lattice-based, code-based, and multivariate cryptographic techniques against quantum attacks is comprehensively investigated in this work methodologically, we review current PQC hybrid models, evaluate their computing efficiency, and examine security criteria grounded on recent research and standardizing initiatives like those under NIST. Our results show that hybrid PQC models create difficulties in terms of key management, computational overhead, and implementation complexity even if they improve security by reducing risks related with both conventional and quantum attacks. A comparative study shows among several hybrid systems the trade-offs in terms of encryption speed, key sizes, and resource use. Moreover showing the feasibility of PQC hybridizing in IoT, cloud computing, and block chain security are pragmatic uses of PQC hybridizing in which case appropriate protocols are needed for broad acceptance. At last, our work emphasizes the significant contribution hybrid PQC models provide in the transitional period producing a quantum secure environment. To enable basic integration into the present digital infrastructure, future research should focus on improving the efficiency of hybrid cryptosystems, optimizing key exchange mechanisms, and regulating standardization concerns. The findings of this study support the present discussion on post quantum security and provide data for academics and corporate leaders aiming for the next generation of cryptographic solutions. https://doi.org/10.5281/zenodo.17873992
Recent advances in quantum computing have prompted urgent consideration for the migration of classical cryptographic systems to post-quantum alternatives. However, it is impossible to fully understand the impact that migrating to current Post-Quantum Cryptography (PQC) algorithms will have on various applications without actual implementation of quantum-resistant cryptography. On the other hand, PQC algorithms come with complexity and long processing times, which may impact the Quality of Service (QoS) of many applications. Therefore, PQC-based protocols with practical implementation across various applications are essential. This paper introduces a new framework for PQC standalone and PQC-AES (Advanced Encryption Standard) hybrid Public Key Encryption (PKE) protocols. Building on prior results, we focus on securing applications such as file transfer, video streaming, and chat-based communication using enhanced PQC-based protocols. The extended PQC-based protocols use a sequence number-based mechanism to effectively counter replay and man-in-the-middle attacks and mitigate standard cybersecurity attack vectors. Experimental evaluations examined encryption/decryption speeds, throughput, and processing overhead for these standalone PQC and PQC-AES hybrid schemes, benchmarking them against traditional AES-256 in an existing client-server environment. The results demonstrate that the new approaches achieve a significant balance between security and system performance compared to conventional deployments. Furthermore, the comprehensive security analysis confirms the robustness and effectiveness of the proposed PQC-based protocols across diverse attack scenarios. Notably, the PQC-AES hybrid protocol demonstrates greater efficiency for applications handling larger data volumes (e.g., 10–100 KB) with reduced latency, underscoring the practical necessity of carefully balancing security and operational efficiency in the post-quantum migration process.
The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.
Objective: The authors propose and evaluate a novel cybersecurity architecture for telehealth that is resilient against future quantum computing cyber threats. By integrating post-quantum cryptography (PQC) with quantum key distribution (QKD) and privacy-preserving mechanisms, data confidentiality and immutability for patient records in a post-quantum era are ensured. Methods: A multi-layered design approach was adopted. The PQC algorithms (e.g. CRYSTALS-Dilithium) were integrated at the blockchain consensus layer to resist quantum attacks. A directed acyclic graph (DAG)-based ledger managed high transaction throughput and latency constraints typical of telehealth. A QKD-enhanced key management protocol leveraged quantum channels for secure exchanges. Zero-knowledge proofs (ZKPs) and secure multiparty computation (MPC) verified transactions without exposing sensitive patient data. A granular access control model used attribute-based encryption and smart contracts to govern which participants could view or modify encrypted medical records. Results: The prototype was developed within a simulated telehealth network comprising hospitals, clinics, and patient devices. The PQC signatures at the consensus layer provided effective resistance to both classical and anticipated quantum attacks. The QKD facilitated secure key distribution, while ZKPs and MPC enabled validation of healthcare transactions without compromising patient privacy. Despite increased computational overhead, the DAG approach efficiently handled parallel transactions, indicating improved scalability compared to traditional linear blockchains. Conclusion: A QKD-enhanced, PQC-driven framework successfully addresses critical security and privacy requirements, safeguarding medical data from emerging quantum threats. Although overhead and infrastructural costs are significant, sustained cryptographic resilience and robust patient confidentiality underscore its suitability for next-generation healthcare systems. Future studies should explore additional optimizations, homomorphic encryption, and larger-scale pilots under regulatory standards.