The move toward cloud-provided-software-as-a-service (SaaS) key management systems (KMS) introduces new, pressing security threats of quantum computing.The novelty of this work is to hybrid combine CRYSTALS-Kyber, NIST standardised, and Dilithium algorithm both for key encapsulation and digital signature that offer a scalable quantum-resilient KMS as a SaaS in a pragmatic scenario.Major contributions include a real-world deployment architecture, describing REST API workflows for on-they-fly key generation and validation, carrying out performance comparison with classical KMS benchmarks showing security improvements and future-proofing of data protection.These systems rely primarily on traditional public-key cryptography, which is susceptible to attacks by large quantum computers.This poses an immediate security threat, particularly in the context of long-term data confidentiality, to which "Harvest Now, Decrypt Later" (HNDL) attacks are a prevalent threat.To mitigate this issue, we propose a practical and secure KMS architecture for quantum era that is provided as SaaS.We propose the use of standard post-quantum cryptography (PQC) using the NIST-approved CRYSTALS suite.It uses a hybrid cryptographic approach to deliver optimal performance and security.It generates AES-256 symmetric keys on-the-fly using a secured REST API.Then the keys are encapsulated with CRYSTALS-Kyber for post-quantum secret protection.For guarantees on integrity and authenticity, operations are digitally signed with CRYSTALS-Dilithium.The encapsulated keys and their associated signatures are secure in the cloud -which only you can access -via a unique identifier alongside robust OAuth2-based sign-ins.By integrating these PQC ingredients into an existing SaaS KMS blueprint, this study provides a gentle learning curve to organizations.It preserves simple and scalable use of modern cloud services while making sure that cryptographic key management is sufficiently secure against emerging threats such as those from quantum computing.This method is critically important, a practical means of maintaining long-term trust and protecting data.
The move toward cloud-provided-software-as-a-service (SaaS) key management systems (KMS) introduces new, pressing security threats of quantum computing.The novelty of this work is to hybrid combine CRYSTALS-Kyber, NIST standardised, and Dilithium algorithm both for key encapsulation and digital signature that offer a scalable quantum-resilient KMS as a SaaS in a pragmatic scenario.Major contributions include a real-world deployment architecture, describing REST API workflows for on-they-fly key generation and validation, carrying out performance comparison with classical KMS benchmarks showing security improvements and future-proofing of data protection.These systems rely primarily on traditional public-key cryptography, which is susceptible to attacks by large quantum computers.This poses an immediate security threat, particularly in the context of long-term data confidentiality, to which "Harvest Now, Decrypt Later" (HNDL) attacks are a prevalent threat.To mitigate this issue, we propose a practical and secure KMS architecture for quantum era that is provided as SaaS.We propose the use of standard post-quantum cryptography (PQC) using the NIST-approved CRYSTALS suite.It uses a hybrid cryptographic approach to deliver optimal performance and security.It generates AES-256 symmetric keys on-the-fly using a secured REST API.Then the keys are encapsulated with CRYSTALS-Kyber for post-quantum secret protection.For guarantees on integrity and authenticity, operations are digitally signed with CRYSTALS-Dilithium.The encapsulated keys and their associated signatures are secure in the cloud -which only you can access -via a unique identifier alongside robust OAuth2-based sign-ins.By integrating these PQC ingredients into an existing SaaS KMS blueprint, this study provides a gentle learning curve to organizations.It preserves simple and scalable use of modern cloud services while making sure that cryptographic key management is sufficiently secure against emerging threats such as those from quantum computing.This method is critically important, a practical means of maintaining long-term trust and protecting data.
As the advent of quantum computing threatens traditional cryptographic protocols, hybrid classical-quantum secure communication infrastructures have emerged as a critical frontier in cybersecurity. This paper explores the integration of post-quantum cryptographic algorithms—specifically CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures—into hybrid communication architectures designed to resist quantum-level attacks. Leveraging lattice-based cryptographic primitives, both algorithms have been selected for standardization by NIST due to their robust security and performance characteristics. This study evaluates their implementation in real-world communication stacks, assesses latency and throughput under hybrid channel configurations, and proposes a layered security architecture combining classical and quantum-resilient mechanisms. Furthermore, it examines key management, digital trust, and infrastructure scalability in a post-quantum context. Simulation results and hardware-based validations are used to determine practical deployment feasibility in critical sectors such as finance, defense, and healthcare. The findings offer a comprehensive framework for securing data in transitional computing eras, ensuring forward secrecy, and maintaining operational integrity against future adversarial quantum threats.
My research focuses on developing a post-quantum cryptography (PQC) framework for securing institutional email systems against future quantum computing threats, particularly the Harvest-Now, Decrypt-Later (HNDL) attack. The study addresses a critical cybersecurity challenge faced by governments, healthcare institutions, universities, and organizations that rely on long-term confidentiality of sensitive communications.The proposed framework integrates the NIST-standardized ML-KEM-768 (formerly CRYSTALS-Kyber) for key encapsulation and ML-DSA-65 (formerly CRYSTALS-Dilithium) for digital signatures to provide quantum-resistant encryption and authentication. A hybrid cryptographic architecture combines PQC with AES-256-GCM to secure email content while maintaining compatibility with existing communication systems.A prototype was implemented using the Open Quantum Safe (liboqs v0.15.0) library and evaluated on resource-constrained hardware representative of institutions in developing countries (3-core Intel Core i5 processor and 4 GB RAM). Performance was measured over 100 benchmark iterations, comparing PQC algorithms with traditional RSA-2048 and ECDSA. The results showed that ML-KEM-768 achieved significantly faster key generation than RSA-2048 while maintaining low computational overhead, requiring less than 2% CPU utilization, under 8 MB of memory, and an end-to-end email processing latency of only 11–16 ms.The research introduces a formally specified HNDL threat model, evaluates the security implications of quantum-resistant cryptography in constrained environments, and discusses deployment considerations including certificate management, side-channel resistance, hybrid migration strategies, and institutional adoption. The work also identifies current limitations, such as the absence of forward secrecy and live production deployment, and proposes future enhancements including PQC-based key ratcheting, TLS integration, and real-world pilot deployments.This research contributes an end-to-end, standards-aligned, open-source framework demonstrating that post-quantum email security is practical and computationally feasible for resource-constrained institutions, particularly in developing economies, providing a pathway toward secure communication infrastructures resilient to future quantum attacks.
The evolving potential disaster of quantum computing against the classical cryptographic methods requires the invention of immune post-quantum cryptographic (PQC) systems to cloud based key management system (CKMS). The proposed solution throughout this paper is considering the risk of existing public-key infrastructures when used in a cloud computing setup by incorporating lattice based post-quantum techniques i.e CRYSTALS-Kyber and CRYSTALS-Dilithium into cloud key management system structures. We came up with a prototype and simulated a hybrid CKMS structure encompassing classical and PQC protocols to secure backward contact and forward confidentiality. Benchmarking provides evidence that the PQC-enhanced CKMS registers 98.7 percent decrease of vulnerability to quantum attack vectors; its key generation time credit stays at 1.24 ms, and time to distribute keys at 5.6 ms, which is equivalent to RSA-2048 based systems. Comparative analysis provided an increase in computational efficiency by 34 percent and a decrease of bandwidth overhead by 22 percent using batch key encapsulation optimization. We have found that the given architecture does not only maintain the scalability of cloud environments but also implements long-term cryptographic resilience. The results show the feasibility and the strength of PQC on the integration into the existing cloud key management infrastructures.
The accelerating development of large-scale quantum computers poses an existential threat to the public-key cryptographic infrastructure that underpins modern digital communication. Algorithms such as RSA and Elliptic Curve Cryptography (ECC), which currently secure internet traffic, digital signatures, and data-at-rest, are vulnerable to Shor's algorithm running on a sufficiently powerful quantum processor. In response, the U.S. National Institute of Standards and Technology (NIST) finalized the first post-quantum cryptography (PQC) standards in August 2024—FIPS 203 (ML-KEM/Kyber), FIPS 204 (ML-DSA/Dilithium), and FIPS 205 (SLH-DSA/SPHINCS+)—marking the beginning of a global migration toward quantum-resistant cryptography. This paper presents a hybrid C++/Python secure storage and communication platform (source code available at https://github.com/Sujithb128989/Quantum-Safe-Backend) that implements NIST-selected PQC algorithms in a production-oriented architecture. The backend employs CRYSTALS-Dilithium5 for quantum-resistant transport authentication, Kyber for key encapsulation, and AES-256-GCM for symmetric encryption-at-rest, delivered through a dual-stack gRPC/HTTP architecture containerized with Docker. We describe the system's design rationale, detail the cryptographic pipeline from certificate generation to atomic key rotation, and discuss the engineering challenges of integrating post-quantum primitives into real-world software systems.
The rapid advancement of quantum computing poses a fundamental threat to classical cryptographic mechanisms that underpin modern digital security. Shor’s algorithm can efficiently solve integer factorization and discrete logarithm problems, thereby breaking widely used public-key cryptosystems such as RSA, ECC, and Diffie–Hellman. Grover’s algorithm also reduces the effective security of symmetric encryption and hash functions by half. This paper provides a systematic analysis of the impact of quantum attacks on current cryptographic infrastructures, including TLS, digital signatures, and blockchain. We then review the state of post-quantum cryptography (PQC) as standardized by NIST, focusing on three leading candidates: CRYSTALS-Kyber for key encapsulation, and CRYSTALS-Dilithium and FALCON for digital signatures. Through simulation using the Open Quantum Safe (liboqs) library on a standard x86_64 platform, we measure key generation time, encryption/signing speed, decryption/verification latency, and key/signature sizes. Our results show that Kyber-768 achieves key generation in <0.1 ms and produces public keys of about 1.2 KB, while Dilithium-3 generates signatures of ~2.7 KB with verification times under 0.3 ms. Compared to RSA-2048 and ECDSA-P256, PQC algorithms offer competitive performance at the cost of larger key and signature sizes. Based on these findings, we propose a hybrid transition roadmap that combines classical and PQC algorithms in parallel, minimizing risk while maintaining backward compatibility. The paper concludes that organizations should begin immediate preparations for the post-quantum era, especially for data requiring long-term confidentiality.
As quantum computing advances, modern cryptographic standards face an existential threat, necessitating a transition to post-quantum cryptography (PQC). The National Institute of Standards and Technology (NIST) has selected CRYSTALS-Kyber and CRYSTALS-Dilithium as standardized PQC algorithms for secure key exchange and digital signatures, respectively. This study conducts a comprehensive performance analysis of these algorithms by benchmarking execution times across cryptographic operations such as key generation, encapsulation, decapsulation, signing, and verification. Additionally, the impact of AVX2 optimizations is evaluated to assess hardware acceleration benefits. Our findings demonstrate that Kyber and Dilithium achieve efficient execution times, outperforming classical cryptographic schemes such as RSA and ECDSA at equivalent security levels. Beyond technical performance, the real-world deployment of PQC introduces challenges in telecommunications networks, where large-scale infrastructure upgrades, interoperability with legacy systems, and regulatory constraints must be addressed. This paper examines the feasibility of PQC adoption in telecom environments, highlighting key transition challenges, security risks, and implementation strategies. Through industry case studies, we illustrate how telecom operators are integrating PQC into 5G authentication, subscriber identity protection, and secure communications. Our analysis provides insights into the computational trade-offs, deployment considerations, and standardization efforts shaping the future of quantum-safe cryptographic infrastructure.