This paper presents QuanChan, a full-stack, post-quantum anonymous communication platform that builds upon the secure storage backend introduced in Part I. As NIST finalizes its first post-quantum cryptography (PQC) standards, the engineering challenge has shifted from theoretical implementation to real-world, deployable web applications. QuanChan addresses this by moving the cryptographic trust boundary directly into the user's browser. Key architectural features and contributions include: Browser-Resident Identity: User identity is rooted locally using ML-DSA-87, allowing deterministic cross-device recovery via a 12-word seed phrase without centralized username/password databases. Post-Quantum Direct Messaging: Client-side encryption utilizing ML-KEM-1024 for key encapsulation and AES-256-GCM for payload encryption ensures message secrecy independent of server trust. Application-Layer Integrity: Dilithium5-signed thread and message snapshots allow the frontend WASM module to independently verify content integrity. Cryptographic Honesty in Transport: Addresses real-world proxy challenges (e.g., Cloudflare TLS termination) by introducing runtime disclosure endpoints (/api/crypto/tls-proof) that report actual observed handshake properties rather than relying on assumed static configurations. Identity-Bound Moderation: Introduces an auditable, role-based moderation system (including founder tokens and persistent badges) tied entirely to stable cryptographic identity hashes. By integrating these standardized PQC primitives across the identity, messaging, and operational layers, QuanChan serves as a practical engineering case study for deploying verifiable, quantum-safe applications in modern proxied environments.
This paper presents QuanChan, a full-stack, post-quantum anonymous communication platform that builds upon the secure storage backend introduced in Part I. As NIST finalizes its first post-quantum cryptography (PQC) standards, the engineering challenge has shifted from theoretical implementation to real-world, deployable web applications. QuanChan addresses this by moving the cryptographic trust boundary directly into the user's browser. Key architectural features and contributions include: Browser-Resident Identity: User identity is rooted locally using ML-DSA-87, allowing deterministic cross-device recovery via a 12-word seed phrase without centralized username/password databases. Post-Quantum Direct Messaging: Client-side encryption utilizing ML-KEM-1024 for key encapsulation and AES-256-GCM for payload encryption ensures message secrecy independent of server trust. Application-Layer Integrity: Dilithium5-signed thread and message snapshots allow the frontend WASM module to independently verify content integrity. Cryptographic Honesty in Transport: Addresses real-world proxy challenges (e.g., Cloudflare TLS termination) by introducing runtime disclosure endpoints (/api/crypto/tls-proof) that report actual observed handshake properties rather than relying on assumed static configurations. Identity-Bound Moderation: Introduces an auditable, role-based moderation system (including founder tokens and persistent badges) tied entirely to stable cryptographic identity hashes. By integrating these standardized PQC primitives across the identity, messaging, and operational layers, QuanChan serves as a practical engineering case study for deploying verifiable, quantum-safe applications in modern proxied environments.
The accelerating development of large-scale quantum computers poses an existential threat to the public-key cryptographic infrastructure that underpins modern digital communication. Algorithms such as RSA and Elliptic Curve Cryptography (ECC), which currently secure internet traffic, digital signatures, and data-at-rest, are vulnerable to Shor's algorithm running on a sufficiently powerful quantum processor. In response, the U.S. National Institute of Standards and Technology (NIST) finalized the first post-quantum cryptography (PQC) standards in August 2024—FIPS 203 (ML-KEM/Kyber), FIPS 204 (ML-DSA/Dilithium), and FIPS 205 (SLH-DSA/SPHINCS+)—marking the beginning of a global migration toward quantum-resistant cryptography. This paper presents a hybrid C++/Python secure storage and communication platform (source code available at https://github.com/Sujithb128989/Quantum-Safe-Backend) that implements NIST-selected PQC algorithms in a production-oriented architecture. The backend employs CRYSTALS-Dilithium5 for quantum-resistant transport authentication, Kyber for key encapsulation, and AES-256-GCM for symmetric encryption-at-rest, delivered through a dual-stack gRPC/HTTP architecture containerized with Docker. We describe the system's design rationale, detail the cryptographic pipeline from certificate generation to atomic key rotation, and discuss the engineering challenges of integrating post-quantum primitives into real-world software systems.
The emergence of quantum computing poses a fundamental threat to current public key cryptographic systems. This threat is necessitating a transition to quantum resistant cryptographic alternatives in all the applications. In this work, we present the implementation of a practical hybrid end-to-end encryption system that combines classical and post-quantum cryptographic primitives to achieve both security and efficiency. Our system employs CRYSTALS-Kyber, a NIST-standardized lattice-based key encapsulation mechanism, for quantum-safe key exchange, coupled with AES-256-GCM for efficient authenticated symmetric encryption and SHA-256 for deterministic key derivation. The architecture follows a zero-trust model where a relay server facilitates communication without accessing plaintext messages or cryptographic keys. All encryption and decryption operations occur exclusively at client endpoints. The system demonstrates that NIST standardized post-quantum cryptography can be effectively integrated into practical messaging systems with acceptable performance characteristics, offering protection against both classical and quantum adversaries. As our focus is on implementation rather than on novelty, we also provide an open-source implementation to facilitate reproducibility and further research in post quantum secure communication systems.
The arrival of cryptographically relevant quantum computers threatens the public-key primitives (RSA, Diffie-Hellman, and elliptic-curve cryptography) that secure essentially all current file-transfer and key-exchange systems, including through harvest-now-decrypt-later attacks. This paper presents QuantumVault, a working web-based file-sharing platform whose entire key-establishment and authentication path is built on the post-quantum algorithms standardized by NIST: ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) for digital signatures, with AES-256-GCM for authenticated bulk encryption and a SHA-256 hash chain for tamper-evident auditing. We describe a hybrid sign-then-encrypt design in which each file is encrypted once under a random data-encryption key that is independently re-wrapped for every recipient using that recipient's post-quantum public key, enabling true multi-recipient sharing and constant-time revocation without re-encrypting file data. We report on the system architecture, the cryptographic workflow, an automated suite of 73 unit and end-to-end tests, an in-application cryptographic self-test, and the security properties the implementation enforces. We also state the system's boundaries candidly: encryption is performed server-side, and we outline a concrete path toward client-side end-to-end encryption as future work.
Post-quantum cryptography (PQC) is moving from evaluation to deployment as NIST finalizes standards for ML-KEM, ML-DSA, and SLH-DSA. This survey maps the space from foundations to practice. We first develop a taxonomy across lattice-, code-, hash-, multivariate-, isogeny-, and MPC-in-the-Head families, summarizing security assumptions, cryptanalysis, and standardization status. We then compare performance and communication costs using representative, implementation-grounded measurements, and review hardware acceleration (AVX2, FPGA/ASIC) and implementation security with a focus on side-channel resistance. Building upward, we examine protocol integration (TLS, DNSSEC), PKI and certificate hygiene, and deployment in constrained and high-assurance environments (IoT, cloud, finance, blockchain). We also discuss complementarity with quantum technologies (QKD, QRNGs) and the limits of near-term quantum computing. Throughout, we emphasize crypto-agility, hybrid migration, and evidence-based guidance for operators. We conclude with open problems spanning parameter agility, leakage-resilient implementations, and domain-specific rollout playbooks. This survey aims to be a practical reference for researchers and practitioners planning quantum-safe systems, bridging standards, engineering, and operations.
The emergence of cryptographically relevant quantum computers threatens the security ofclassical public-key cryptography, necessitating the transition toward post-quantum cryptographic (PQC)algorithms standardized by NIST. At the same time, modern Internet protocols such as HTTP/3—runningover the QUIC transport protocol—are becoming widely deployed, offering reduced latency and improvedreliability compared to traditional TCP+TLS stacks. Ensuring that HTTP/3 infrastructure remains secure inthe post-quantum era requires practical implementations that integrate PQC algorithms without causingprohibitive performance overheads. In this study, we present the development of a PQC–enabled Apacheweb server that supports HTTP/3 through a custom OpenSSL 3.5.4 provider embedding the NISTstandardized ML-KEM and ML-DSA algorithms. Our implementation integrates PQC primitives into theQUIC handshake via modified OpenSSL EVP interfaces and enables PQC-based certificates and keyencapsulation mechanisms within a Caddy reverse proxy + Apache server architecture. Performanceevaluations were conducted on heterogeneous hardware, including a Raspberry Pi 4 and an Intel-baseddesktop system, under realistic network conditions. Experimental results show that ML-KEM and MLDSA introduce moderate handshake latency (≈18%) and minimal throughput reduction (4–8%). Across allconfigurations, HTTP/3's multiplexed, UDP-based design mitigated PQC-related delays, maintaining morethan 90% of classical throughput. The results demonstrate that integrating standardized PQC algorithmsinto modern web servers is both feasible and efficient, validating HTTP/3 as a strong foundation forquantum-resilient Internet communication. This work provides an operational reference for deploying PQCwithin web infrastructures and highlights pathways for future enhancements such as hybrid key exchange,certificate compression, and hardware acceleration.
The emergence of fault-tolerant quantum computing poses an existential threat to classical public-key cryptographic systems, including RSA and Elliptic Curve Cryptography (ECC), through Shor's polynomial-time factorization algorithm. The Harvest Now, Decrypt Later (HNDL) attack paradigm further amplifies this threat by enabling adversaries to archive ciphertext today for future quantum-enabled decryption, rendering long-term data confidentiality immediately at risk. While the National Institute of Standards and Technology (NIST) finalized post-quantum cryptographic standards ML-KEM (FIPS 203) and ML-DSA (FIPS 204) in August 2024, their practical integration into complete application-level communication systems remains a largely unaddressed research gap. This paper presents QuantumShield, a hybrid post-quantum secure peer-to-peer communication platform that integrates ML-KEM-768 for quantum-safe key encapsulation, ML-DSA-65 for authenticated digital signatures, and AES-256-GCM for high-throughput symmetric encryption. Our primary research contribution is a rigorous empirical analysis of PQC integration overhead in a real-world communication pipeline, quantifying latency, key size, and security trade-offs against classical RSA-2048 and ECC-256 baselines under controlled experimental conditions. Experimental evaluation across 1,000 iterations demonstrates that ML-KEM-768 encapsulation completes in 2.8 ± 0.2 ms compared to 4.1 ± 0.3 ms for ECDH key agreement — a 32% latency reduction while providing NIST Level 3 post-quantum security. The complete secure transfer pipeline processes 1 MB files in under 22 ms on commodity hardware. The system further provides interactive cryptographic visualization, adversary threat modeling, tamper detection simulation, and a hybrid migration framework demonstrating practical transition from classical to post-quantum infrastructure. QuantumShield establishes that quantum-safe communication is not merely theoretical but deployable today with negligible performance compromise.