The rapid digitization of aviation communication and its dependent critical operations demand secure protocols that address domain-specific security requirements within the unique functional constraints of the aviation industry. These secure protocols must provide sufficient security against current and possible future attackers, given the inherent nature of the aviation community, that is highly complex and averse to frequent upgrades as well as its high safety and cost considerations. In this work we propose a pair of quantum-secure hybrid key exchange protocols (
PQAG-KEMand
PQAG-SIG) to secure communication between aircrafts in-flight and ground stations.
PQAG-KEMleverages post-quantum and classical Key Encapsulation Mechanisms (
KEMs) to ensure the hybrid security of the protocol against classical as well as future quantum adversaries.
PQAG-SIG, alternatively, uses quantum-safe digital signatures to achieve authentication security. We provide an implementation of both
PQAG-KEMand
PQAG-SIG, and compare favourably with current state-of-the-art secure avionic protocols. Finally, we provide a formal analysis of our new
PQAGprotocols in a strong hybrid key exchange framework.
. Quantum computing technology is developing at a pace that threatens classic public-key ciphers, including those based on integer factorization and elliptic-curve discrete logarithms. In response, it has been proposed to work towards a hybrid model that can be used in the short term and that is based on the combination of classical Elliptic-Curve Cryptography (ECC) and Post-Quantum Cryptographic (PQC) primitives, increasing security where classically secure key exchanges are used and found to be secure against quantum attacks. The proposed protocol combines ephemeral ECDH key exchange with Falcon-512 digital signatures to provide authenticated session establishment with forward secrecy. This work extends upon these results and assesses as well as justifies the construction of hybrid ECC-Lattice protocols, specifically ECC + Falcon, for quantum-safe authentication and authenticated key establishment. The results highlight that hybrid architecture provides a balanced trade-off between performance, interoperability, and robustness against quantum transition period, positioning them as an essential pathway in the global migration toward quantum-safe cryptography. The protocol was implemented and evaluated under controlled network conditions using 2000 protocol executions. Experimental results demonstrated an average handshake latency of 41.61 ms, a throughput of 24.03 handshakes per second, and a total communication overhead of 1434 bytes per handshake. The results indicate that the proposed Hybrid ECC–Falcon protocol achieves efficient authenticated key establishment while maintaining moderate communication costs. By combining ECDH-based forward secrecy with Falcon-512 post-quantum authentication, the protocol provides a practical solution for secure communications during the post-quantum transition period, particularly in post-quantum transition environments.
Since the security of post-quantum cryptography (PQC) algorithms is based on the hardness of mathematical problems, while the security of quantum key distribution (QKD) relies on the fundamental principles of quantum physics, each approach possesses distinct advantages and limitations that can complement one another. Consequently, recent studies have proposed hybrid schemes that combine QKD and PQC to establish a dual-layered security model. In response to this trend, this study proposes hybrid schemes that integrate QKD with the National Institute of Standards and Technology (NIST) standardized PQC algorithms. These hybrid schemes include two core components: a hybrid QKD-PQC key exchange protocol and a hybrid QKD-PQC digital signature scheme. For the hybrid key exchange protocol, this study combines Module-Lattice-based Key Encapsulation Mechanisms (ML-KEM) with QKD protocols, specifically BB84 and E91, to construct a secure key exchange protocol. In the design of the hybrid digital signature scheme, this study utilizes Module-Lattice-based Digital Signature Algorithms (ML-DSA) and Stateless Hash-based Digital Signature Algorithms (SLH-DSA) to generate signature reconstruction values. These values are verified using confirmation codes transmitted via the BB84 and E91 protocols. The proposed hybrid key exchange protocol is evaluated by examining the shared secret key it produces, particularly with respect to entropy and whether the output is independent and identically distributed (IID). Furthermore, the computation time and message lengths of the proposed hybrid schemes are evaluated.