Abstract To ensure the long-term security of anonymous communication against quantum computing threats, this paper proposes a QKD-assisted quantum secure onion routing protocol. The scheme employs a hybrid architecture comprising a star-topology QKD network, a classical onion routing network, and a blockchain-based pseudonym mechanism. By splitting trust between the central cloud and blockchain, the system prevents any single entity from compromising the complete path or session keys, thus balancing anonymity with scalability. Specifically, a quantum secure key agreement sub-protocol is designed: communicating parties XOR locally generated nonces with quantum keys and employ a hash family to achieve trust splitting. This method prevents both the central cloud and the blockchain from recovering session keys. Furthermore, a complete onion packet encapsulation process is established for layered encryption. Comprehensive analyses of correctness, security, and performance under practical QKD key rate constraints are provided. The results indicate that, under semi-honest and non-colluding assumptions, the proposed protocol achieves quantum secure anonymous communication while maintaining practical scalability.
Abstract To ensure the long-term security of anonymous communication against quantum computing threats, this paper proposes a QKD-assisted quantum secure onion routing protocol. The scheme employs a hybrid architecture comprising a star-topology QKD network, a classical onion routing network, and a blockchain-based pseudonym mechanism. By splitting trust between the central cloud and blockchain, the system prevents any single entity from compromising the complete path or session keys, thus balancing anonymity with scalability. Specifically, a quantum secure key agreement sub-protocol is designed: communicating parties XOR locally generated nonces with quantum keys and employ a hash family to achieve trust splitting. This method prevents both the central cloud and the blockchain from recovering session keys. Furthermore, a complete onion packet encapsulation process is established for layered encryption. Comprehensive analyses of correctness, security, and performance under practical QKD key rate constraints are provided. The results indicate that, under semi-honest and non-colluding assumptions, the proposed protocol achieves quantum secure anonymous communication while maintaining practical scalability.
Anonymous communication networks (ACNs) enable Internet browsing in a way that prevents accessed content from being traced back to the user. This provides a high level of privacy, protecting individuals from being tracked by advertisers, governments, and other entities. The Tor network, a prominent example of such a network, uses a layered encryption scheme to encapsulate data packets, employing Tor nodes to obscure the routing process before the packets enter the public Internet. While Tor is capable of providing substantial privacy, its encryption relies on schemes such as RSA and Diffie-Hellman for distributing symmetric keys, which are vulnerable to quantum computing attacks and are currently in the process of being phased out. To overcome this threat, we propose a quantum resistant alternative to RSA and Diffie-Hellman for distributing symmetric keys, namely, quantum key distribution (QKD). Standard QKD networks depend on trusted nodes to relay keys across long distances. However, reliance on trusted nodes in the quantum network does not meet the criteria necessary for establishing a Tor circuit in the ACN. We address this issue by developing a protocol and network architecture that integrates QKD without the need for trusted nodes, thus meeting the requirements of the Tor network and creating a quantum secure anonymous communication network.
The advancement of quantum computing threatens classical cryptographic methods, necessitating the development of secure quantum key distribution (QKD) solutions for QKD Networks (QKDN). In this paper, a novel key distribution protocol, Onion Routing Relay (ORR), that integrates onion routing (OR) with post-quantum cryptography (PQC) in a key-relay (KR) model is evaluated for QKDNs. This approach increases the security by enhancing confidentiality, integrity, authenticity (CIA principles), and anonymity in quantum-secure communications. By employing PQC-based encapsulation, ORR aims to avoid the security risks posed by intermediate malicious nodes and ensures end-to-end security. Our results show a competitive performance of the basic ORR model, against current KR and trusted-node (TN) approaches, demonstrating its feasibility and applicability in high-security environments maintaining a consistent Quality of Service (QoS). The results also show that while basic ORR incurs higher encryption overhead, it provides substantial security improvements without significantly impacting the overall key distribution time. Nevertheless, the introduction of an end-to-end authentication extension (ORR-Ext) has a significant impact on the Quality of Service (QoS), thereby limiting its suitability to applications with stringent security requirements.
The advance of quantum computing poses a significant threat to classical cryptography, compromising the security of current encryption schemes such as RSA and ECC. In response to this challenge, two main approaches have emerged: quantum cryptography and post-quantum cryptography (PQC). However, both have implementation and security limitations. In this paper, we propose a secure key distribution protocol for Quantum Key Distribution Networks (QKDN), which incorporates encapsulation techniques in the key-relay model for QKDN inspired by onion routing and combined with PQC to guarantee confidentiality, integrity, authenticity and anonymity in communication. The proposed protocol optimizes security by using post-quantum public key encryption to protect the shared secrets from intermediate nodes in the QKDN, thereby reducing the risk of attacks by malicious intermediaries. Finally, relevant use cases are presented, such as critical infrastructure networks, interconnection of data centers and digital money, demonstrating the applicability of the proposal in critical highsecurity environments.
The onion routing (OR) network Tor provides anonymity to its users by routing their encrypted traf-fic through three proxies (or nodes). The key cryptographic challenge, here, is to establish symmetric session keys using a secure key exchange between the anonymous users and the selected nodes. The Tor network currently employs a one-way authenticated key exchange (1W-AKE) protocol ntor for this purpose. Nevertheless, ntor as well as other known 1W-AKE protocols rely solely on some classical Diffie-Hellman (DH) type assumptions for their (forward) security, and thus privacy of today’s anony-mous communication cannot be ensured once quantum computers arrive. In this paper, we demonstrate utility of quantum-secure lattice-based cryptography towards solving this problem for onion routing. In particular, we present a novel hybrid 1W-AKE protocol (HybridOR) that is secure under the lattice-based ring learning with error (ring-LWE) assumption as well as the gap DH assumption. Due to its hybrid design, HybridOR is not only resilient against quantum attacks but also allows the OR nodes to use the current DH public keys and subsequently requires no modification to the current Tor public key infrastructure. Moreover, thanks to the recent progress in lattice-based cryp-tography in the form of efficient ring-based constructions, our protocol is also computationally more efficient than the currently employed 1W-AKE protocol ntor, and it only introduces small and manage-able communication overhead to the Tor protocol.
Quantum Key Distribution (QKD) has emerged as a revolutionary technology for secure communication, leveraging the principles of quantum mechanics to ensure the inviolability of cryptographic keys. Conventional QKD protocols often rely on centralized systems, which present challenges related to scalability, trust, and single points of failure. This review explores the security enhancements introduced by adopting a decentralized approach to QKD protocols. We analyze various decentralized QKD frameworks that eliminate the need for trusted third parties, leveraging blockchain technology and other distributed systems to enhance security, transparency, and robustness. In addition to assessing their performance, we examine how these decentralized models mitigate vulnerabilities such as key interception, node compromise, and denial-of-service attacks, which are prevalent in traditional centralized systems. Our review highlights advancements in the integration of decentralized QKD with classical cryptographic techniques, offering a comprehensive view of its potential to revolutionize secure communications in critical sectors. The decentralized approach to QKD represents a promising evolution towards more secure, scalable, and resilient quantum cryptography systems.
This research focuses on enhancing the security of decentralized quantum key distribution (QKD) networks, where the absence of a central authority creates significant challenges such as malicious node infiltration, undetected key leakage, and unauthorized re-entry of revoked participants. Traditional authentication and trust models are insufficient for fully distributed QKD topologies, which remain highly vulnerable to insider threats and persistent compromise. To address these risks, let’s propose a layered security framework composed of three integrated components: Challenge-Response Authentication (CRA), Dynamic Trust Scoring (DTS), and Blockchain-Based Access Control (BBAC). CRA verifies node legitimacy through randomized quantum-state interactions, significantly reducing impersonation and quantum replay attacks. DTS implements real-time trust evaluation using anomaly detection to dynamically downgrade compromised nodes based on their behavioral deviations. BBAC maintains an immutable and tamper-proof trust ledger to block revoked nodes from re-entering under falsified identities and resists Sybil attacks using post-quantum cryptographic primitives. Simulation results confirm that the system improves detection rates of covert threats, ensures authentication latency under 10 ms, and reduces re-entry success to zero. The proposed architecture ensures long-term scalability and resilience, making it applicable to critical domains such as finance, national infrastructure, and military communication. This work contributes a novel, verifiable, and scalable solution to one of the most pressing open problems in distributed quantum networks