TLS 1.3 zero-round-trip-time (0-RTT) resumption reduces reconnection latency by allowing clients to transmit early application data using pre-shared keys (PSK) derived from previously established session tickets. This mechanism is pivotal for latency-sensitive web services, API gateways, and IoT applications. However, the cryptographic foundations of current session tickets—symmetric keys derived from classical X25519 key exchange—are fundamentally vulnerable to Harvest-Now-Decrypt-Later (HNDL) quantum attacks: an adversary capturing session ticket exchanges today can retroactively decrypt PSKs and all 0-RTT early data once a cryptographically relevant quantum computer (CRQC) becomes available. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), a protocol-level framework that embeds a hybrid X25519 + ML-KEM-768 key encapsulation into the TLS 1.3 NewSessionTicket lifecycle, producing quantum-safe session tickets without additional handshake round trips. HQRT defines a Hybrid Resumption Master Secret (HRMS) derived from both classical and post-quantum shared secrets and integrates it into the TLS 1.3 key schedule as a drop-in extension of the Resumption Master Secret. We provide: (i) a formal security model for quantum-safe 0-RTT resumption with game-based HNDL-resistance proofs; (ii) an extended replay protection analysis under quantum adversaries; (iii) a proof-of-concept implementation on OpenSSL 3.x with the OQS provider; and (iv) comprehensive benchmarks across server, desktop, and IoT platforms demonstrating only 4–9% latency overhead and 6.5% throughput reduction relative to classical 0-RTT, versus the 81–89% overhead of full post-quantum handshakes. A cumulative cost-benefit analysis over multi-session workloads demonstrates 34–97% amortised overhead reduction compared to per-reconnection PQC handshakes, with latency distributions exhibiting sub-millisecond tail divergence from classical baselines. HQRT provides a practical, incrementally deployable pathway for quantum-safe TLS resumption compatible with existing certificate infrastructure.
TLS 1.3 zero-round-trip-time (0-RTT) resumption reduces reconnection latency by allowing clients to transmit early application data using pre-shared keys (PSK) derived from previously established session tickets. This mechanism is pivotal for latency-sensitive web services, API gateways, and IoT applications. However, the cryptographic foundations of current session tickets—symmetric keys derived from classical X25519 key exchange—are fundamentally vulnerable to Harvest-Now-Decrypt-Later (HNDL) quantum attacks: an adversary capturing session ticket exchanges today can retroactively decrypt PSKs and all 0-RTT early data once a cryptographically relevant quantum computer (CRQC) becomes available. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), a protocol-level framework that embeds a hybrid X25519 + ML-KEM-768 key encapsulation into the TLS 1.3 NewSessionTicket lifecycle, producing quantum-safe session tickets without additional handshake round trips. HQRT defines a Hybrid Resumption Master Secret (HRMS) derived from both classical and post-quantum shared secrets and integrates it into the TLS 1.3 key schedule as a drop-in extension of the Resumption Master Secret. We provide: (i) a formal security model for quantum-safe 0-RTT resumption with game-based HNDL-resistance proofs; (ii) an extended replay protection analysis under quantum adversaries; (iii) a proof-of-concept implementation on OpenSSL 3.x with the OQS provider; and (iv) comprehensive benchmarks across server, desktop, and IoT platforms demonstrating only 4–9% latency overhead and 6.5% throughput reduction relative to classical 0-RTT, versus the 81–89% overhead of full post-quantum handshakes. A cumulative cost-benefit analysis over multi-session workloads demonstrates 34–97% amortised overhead reduction compared to per-reconnection PQC handshakes, with latency distributions exhibiting sub-millisecond tail divergence from classical baselines. HQRT provides a practical, incrementally deployable pathway for quantum-safe TLS resumption compatible with existing certificate infrastructure.
Introduction Zero-round-trip-time (0-RTT) resumption is a central performance feature of TLS 1.3, cutting reconnection latency by letting clients attach early application data to pre-shared keys derived from previously issued session tickets. Latency-sensitive deployments—web services, API gateways, IoT fleets-rely heavily on this mechanism. However, today's session tickets derive their symmetric keys from a purely classical X25519 exchange, leaving them exposed to Harvest-Now-Decrypt-Later (HNDL) attacks: an adversary who records the ticket exchange today gains the ability to decrypt all associated 0-RTT early data retroactively once a cryptographically capable quantum machine exists. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), which folds a hybrid X25519 + ML-KEM-768 encapsulation directly into the NewSessionTicket lifecycle, rendering tickets quantum-safe without adding any extra round trip. Methods At the core of HQRT is a Hybrid Resumption Master Secret, constructed jointly from classical and post-quantum shared secrets and integrated into the existing TLS 1.3 key schedule as a drop-in addition. The paper supports this construction with a formal, game-based security model proving HNDL resistance, and extends the replay-protection analysis to quantum adversaries. A working proof-of-concept was implemented on OpenSSL 3.x via the OQS provider, with benchmarking conducted across server, desktop, and IoT hardware. Results The latency penalty introduced by HQRT is just 4–9%, with a throughput loss of 6.5% relative to classical 0-RTT-a stark contrast to the 81–89% overhead imposed by full post-quantum handshakes. Across multi-session workloads, the amortised overhead falls by 34–97%, and latency-distribution tails diverge from the classical baseline by under a millisecond. Discussion These results demonstrate that HQRT offers a deployable, incremental route to quantum-safe TLS resumption, delivering HNDL resistance and quantum-safe replay protection at a fraction of the cost of full post-quantum handshakes, while leaving existing certificate infrastructure untouched.
The advancement of quantum computing creates a big threat to classical cryptographic protocols, including TLS, which is responsible for secure internet communications. While recent industry and academic efforts have focused on integrating lattice-based post-quantum key encapsulation mechanisms (KEMs) such as Kyber+X25519 into hybrid TLS handshakes, these approaches often prioritize performance at the cost of cryptanalytic diversity. Code-based KEMs, despite their proven security measure they remain underexplored in hybrid frameworks due to some limitations like large key sizes and integration complexity. This paper proposes a novel hybrid TLS framework that explicitly incorporates code-based post-quantum cryptography—specifically McEliece—alongside classical key exchange mechanisms. The framework introduces a dual-handshake mechanism, adaptive parameter selection, and seamless fallback negotiation, enabling flexible deployment across heterogeneous networks while ensuring backward compatibility. Integration with Quantum Random Number Generators (QRNGs) and multifactor authentication further increases entropy quality and session security. We implemented and evaluated the framework using an OpenSSL-OQS integration. We measure handshake latency, CPU utilization, memory usage, and throughput across emulated and real-world testbeds. Results show that the proposed hybrid approach achieves up to 30% lower latency and significantly reduced resource overhead compared to pure post-quantum TLS variants, while maintaining near-classical efficiency levels. Mathematical modeling formalizes these trade-offs which offers a foundation for optimizing deployment in both resource-constrained IoT devices and high-performance servers. By advancing cryptographic diversity and aligning with emerging NIST and IETF standardization efforts, the proposed framework provides a practical pathway toward quantum-resilient secure communication.It shows that code-based post-quantum cryptography can be added to current TLS systems without any problems, keeping security, performance, and compatibility in mind as we get ready for the quantum age.
The imminent threat of cryptographically relevant quantum computers (CRQCs) to RSA and elliptic curve cryptography — combined with the 'harvest now, decrypt later' attack paradigm — necessitates an urgent enterprise PKI migration to post quantum cryptographic (PQC) algorithms. This paper presents a comprehensive hybrid PKI framework enabling phased, backward compatible migration from classical to post quantum certificate chains. The framework embeds dual signatures (ECDSA + CRYSTALS Dilithium3) within X.509v3 certificates following the emerging RFC 9480 composite certificate standard. We provide Algorithm 2 (HybridCertIssue) specifying the complete certificate generation and verification protocol, and a migration roadmap structured across five phases from 2021 to 2035+. Experimental evaluation on a 10,000 node enterprise PKI demonstrates: TLS handshake overhead of +4.6 KB, latency increase of +38ms (LAN p50), and Dilithium3 signing throughput of 800 ops/sec on FIPS 140 3 HSMs. Security proofs establish that the hybrid scheme is secure if either the classical or PQC scheme is unforgeable — requiring an adversary to simultaneously break both ECDSA and Dilithium3. The migration cost model scales O(n log n) for n node PKI hierarchies. A 30 organization survey quantifies migration readiness: only 41% have completed cryptographic asset inventory, representing the critical first blocker.
Quantum computing poses a significant threat to classical cryptographic schemes widely used in modern networks, particularly RSA and ECC, which are vulnerable to Shor’s algorithm. To address this challenge, this study conducts a post-quantum security evaluation of TLS 1.3 by implementing hybrid X25519+Kyber key exchange and ML-DSA digital signatures. The objective is to assess the performance, overhead, and effectiveness of hybrid TLS in ensuring long-term data confidentiality within enterprise environments. The research method involves building a server–client testbed using OpenSSL with the oqs-provider, applying network load simulations under various latencies, and measuring key metrics including handshake latency, CPU utilization, certificate size, and client compatibility. The results indicate that hybrid TLS 1.3 with X25519+Kyber introduces only moderate handshake latency, while ML-DSA increases certificate size but remains manageable for deployment in modern enterprise systems. The conclusion of this study is that combining X25519+Kyber with ML-DSA offers an effective transition path towards quantum-safe networks without significantly sacrificing system performance..
Quantum computing threatens current public-key cryptography. New quantum-safe communication protocols are needed to address this threat. PQConnect is a tunnelling protocol designed for automated, end-to-end secure communication that resists quantum attacks while remaining compatible with existing infrastructure. It employs a hybrid handshake integrating classical and post-quantum primitives to establish shared keys. This thesis analyses PQConnect’s handshake, which uses a nested hybrid key exchange combining three schemes. It layers Classic McEliece (a code-based key encapsulation), X25519 (Curve25519 elliptic-curve Diffie–Hellman), and SNTRUP761 (Streamlined NTRU Prime) key encapsulations. These are being utilized as Key Encapsulation Mechanisms (KEMs). The layers are nested so that each inner exchange is concealed by outer layers, making any single layer difficult to break. The analysis details how each layer contributes to key establishment and how fresh ephemeral keys ensure forward secrecy. Additional PQConnect mechanisms are examined, including streaming verification of hand-shake data and DNS-based key distribution. Streaming verification processes large hand-shake records incrementally, reducing memory usage. For key distribution, PQConnect retrieves hashed server public keys via authenticated DNS records: a client fetches a hash of the server’s long-term key from DNS and verifies it before initiating the handshake, avoiding reliance on centralized certificates. A ratcheting key schedule derives new chain keys for each time epoch and per-packet encryption keys, limiting key exposure and extending forward secrecy beyond the initial handshake. For performance evaluation, packet-level traffic was captured using Wireshark for both PQConnect and traditional TLS sessions. Captured packets were analyzed to compare handshake flows and performance metrics such as packet size and total transmitted data. The results show that PQConnect introduces only a modest increase in packet sizes and overall data volume, with no significant latency overhead. Streaming verification and DNS-based lookup were confirmed to function correctly without noticeable delay. In conclusion, the study finds that PQConnect can establish quantum-secure tunnels with minimal performance penalty. Its hybrid handshake effectively integrates post-quantum primitives while maintaining compatibility with current infrastructure. DNS-based key distribution and streaming verification enhance trust and efficiency. The ratchet mechanism provides robust forward secrecy. These findings suggest that PQConnect is a practical and future-ready solution for secure tunnelling.
Due to the increasing attainability of quantum computers, the threat to traditional cryptographic algorithms is more relevant than ever before. However, the field of Post-Quantum Cryptography (PQC) to address this is still young and may potentially exhibit security vulnerabilities. In this paper, the role of Pre-Shared Keys (PSK) is analyzed in an attack scenario with both traditional and post-quantum algorithms potentially broken. We present a scheme for improved integration of external PSKs into a PQC-secured TLS 1.3 handshake, with a focus on no security compromises and broad deployment options. In that context, the protection of long-term secrets on dedicated security tokens and the integration of Quantum Key Distribution (QKD) are elaborated. For QKD integration, our scheme enables a deployment without QKD-specific changes to TLS. In addition to the scheme itself, a reference implementation is presented and evaluated to demonstrate its technical viability. Our results indicate that the general integration of PSKs into the TLS handshake adds negligible overhead while substantially increasing the achieved security level. Although deployments using dedicated security tokens or QKD systems have a significant influence on handshake times, specific applications could benefit greatly from the added security guarantees.