This research paper addresses the growing challenge of maintaining data confidentiality in a future where quantum-enabled attackers can undermine the cryptographic foundations of existing security systems. While emerging post-quantum standards mainly aim to replace classical public-key primitives, they leave critical gaps in managing symmetric key lifecycles, enabling secure encrypted search, and supporting multi-party access control. To bridge these gaps, this work proposes a unified post-quantum confidentiality framework built on a punctual-ratchet lattice-based encapsulation scheme. The design combines module-LWE key encapsulation with a punctual symmetric ratchet, establishing a quantum-resistant bootstrap secret and enabling continuous forward secrecy. Key evolution is achieved through a puncturable PRF mechanism that allows selective invalidation of prior decryption keys with minimal overhead and compact verifiability. Using the same ratchet state, an encrypted indexing layer is constructed to support efficient, privacy-preserving querying across large ciphertext repositories while limiting long-term query pattern leakage. The framework preserves confidentiality even when devices face delayed compromise, and it scales effectively through lightweight client-side rekey capsules compatible with high-throughput infrastructures. Experimental results show that encapsulation costs can be amortized, ratchet steps remain lightweight, and metadata growth stays sublinear. Overall, the proposed system provides a practical and secure foundation for future post-quantum cybersecurity architectures.
This research paper addresses the growing challenge of maintaining data confidentiality in a future where quantum-enabled attackers can undermine the cryptographic foundations of existing security systems. While emerging post-quantum standards mainly aim to replace classical public-key primitives, they leave critical gaps in managing symmetric key lifecycles, enabling secure encrypted search, and supporting multi-party access control. To bridge these gaps, this work proposes a unified post-quantum confidentiality framework built on a punctual-ratchet lattice-based encapsulation scheme. The design combines module-LWE key encapsulation with a punctual symmetric ratchet, establishing a quantum-resistant bootstrap secret and enabling continuous forward secrecy. Key evolution is achieved through a puncturable PRF mechanism that allows selective invalidation of prior decryption keys with minimal overhead and compact verifiability. Using the same ratchet state, an encrypted indexing layer is constructed to support efficient, privacy-preserving querying across large ciphertext repositories while limiting long-term query pattern leakage. The framework preserves confidentiality even when devices face delayed compromise, and it scales effectively through lightweight client-side rekey capsules compatible with high-throughput infrastructures. Experimental results show that encapsulation costs can be amortized, ratchet steps remain lightweight, and metadata growth stays sublinear. Overall, the proposed system provides a practical and secure foundation for future post-quantum cybersecurity architectures.
To meet the performance and scalability demands of current cloud systems, cryptographic systems should be resistant to both quantum and classical adversaries, especially considering the future potential provided by quantum computing. The presented manuscript provides an integrated, quantum-resistant, cloud-based encryption architecture built on the combination of post-quantum authentication, scalable, multi-tenant, key-management methods, and side-channel-conscious design in a cloud-native paradigm. The lattice-based post-quantum key-encapsulation scheme to derive the long-lived and tenant-specific cryptographic key is built into the system to remove all possible single-point failure sources. Long-lived and tenant-specific cryptographic keys are subsequently replicated in a threshold-based key-management service (KMS) cluster. Lightweight symmetric primitives are used to compute session keys thus reducing client-side latency on resource-constrained devices. The AES -256-GCM or Ascon encryption schemes are deployed to guarantee confidentiality of data. Moreover, the architecture uses the symmetric message authentication codes and lattice-signature schemes produced using quantum-safe primitives to ensure the data integrity and authenticity. By distributing key computations across isolated KMS nodes and restricting direct use of long-lived secrets to bounded and infrequent operations, the implementation utilizes leakage-resilient techniques. The system, which is designed for elastic scalability, provides fine-grained access control through configurable lattice-based attribute-based encryption and dynamically allocates keys for new tenants. Experimental benchmarks show that the technique attains strong multi-tenant isolation and side-channel information leakage resistance while minimizing handshake latency by considerable amounts over per-session post-quantum exchanges. This model surmounts the shortcomings of current post-quantum, multi-tenant, and cloud-native security systems by integrating quantum-resistant cryptographical principles, distributed mechanisms for trust, and lightweight operational techniques and thus offers a practical and flexible solution for secure protection of sensitive cloud-hosted data in the future quantum era.
Abstract To meet the performance and scalability demands of current cloud systems, cryptographic systems should be resistant to both quantum and classical adversaries, especially considering the future potential provided by quantum computing. The presented manuscript provides an integrated, quantum-resistant, cloud-based encryption architecture built on the combination of post-quantum authentication, scalable, multi-tenant, key-management methods, and side-channel-conscious design in a cloud-native paradigm. The lattice-based post-quantum key-encapsulation scheme to derive the long-lived and tenant-specific cryptographic key is built into the system to remove all possible single-point failure sources. Long-lived and tenant-specific cryptographic keys are subsequently replicated in a threshold-based key-management service (KMS) cluster. Lightweight symmetric primitives are used to compute session keys thus reducing client-side latency on resource-constrained devices. The AES − 256-GCM or Ascon encryption schemes are deployed to guarantee confidentiality of data. Moreover, the architecture uses the symmetric message authentication codes and lattice-signature schemes produced using quantum-safe primitives to ensure the data integrity and authenticity. By distributing key computations across isolated KMS nodes and restricting direct use of long-lived secrets to bounded and infrequent operations, the implementation utilizes leakage-resilient techniques. The system, which is designed for elastic scalability, provides fine-grained access control through configurable lattice-based attribute-based encryption and dynamically allocates keys for new tenants. Experimental benchmarks show that the technique attains strong multi-tenant isolation and side-channel information leakage resistance while minimizing handshake latency by considerable amounts over per-session post-quantum exchanges. This model surmounts the shortcomings of current post-quantum, multi-tenant, and cloud-native security systems by integrating quantum-resistant cryptographical principles, distributed mechanisms for trust, and lightweight operational techniques and thus offers a practical and flexible solution for secure protection of sensitive cloud-hosted data in the future quantum era.
The impending advent of cryptographically relevant quantum computers threatens classical public-key primitives that underpin 5G and IoT security, including key exchange, authentication, and device onboarding. Ultra-dense networks, constrained endpoints, and long device lifetimes heighten exposure to “harvest-now, decrypt-later” risks. Mobile operators and IoT platform providers need migration ready cryptography that fits radio-access latency budgets, scales to billions of low-power nodes, and integrates cleanly with 3GPP and IETF protocols without degrading quality of service. Many post quantum options impose prohibitive bandwidth and compute costs or lack deployment guidance tuned to network slices and massive machine-type communications. We propose a lattice-based encryption and key-encapsulation framework grounded in Module-LWE/LWR assumptions. The design pairs an IND-CCA-secure KEM for control plane bootstrapping with lightweight AEAD for user-plane data, delivered through a hybrid handshake combining classical ECDH with a post-quantum KEM to ensure continuity during transition. Parameter tiers align with eMBB, URLLC, and mMTC device classes. Implementation emphasizes constant-time polynomial arithmetic, NTT-accelerated convolution, centered-binomial noise sampling, public-key compression, and stateless hash-based signatures for attestation. A gNB-assisted enrollment workflow and session-key rotation via 5G NAS/RRC are specified. Analytical modeling and prototype measurements indicate sub-millisecond encapsulation on ARM Cortex-M33 microcontrollers and ~1.5 ms on RAN baseband paths, while handshake message growth remains within existing NAS and RRC budgets. In ns-3 simulations of dense mMTC topologies, the hybrid handshake achieves >99.99% success under 1% packet loss, and energy profiling shows <5% battery impact for weekly rekeying. Security analysis demonstrates resistance to known lattice attacks at NIST Levels 3–5, forward secrecy via ephemeral KEMs, downgrade resistance through authenticated algorithm negotiation, and post compromise security with frequent rekeying.
The rapid development of quantum computing presents a substantial threat to traditional cryptographic algorithms, particularly those relying on mathematical problems such as integer factorization and elliptic curve operations. As a response, the cryptographic community has accelerated the design of post-quantum cryptographic schemes that can withstand attacks from both classical and quantum computers. However, many of these new schemes exhibit inherent trade-offs between performance, key sizes, and implementation complexity. To address this, we propose a novel hybrid cryptographic framework tailored for secure and efficient data transmission in future quantum-aware environments. The proposed system combines three algorithmic paradigms: a lattice-based encryption method for fast and lightweight data protection, a hash-based signature mechanism for authenticity, and a code-based key exchange method to ensure session confidentiality. This layered integration is designed to capitalize on each algorithm’s strengths while mitigating individual limitations. The system is implemented using modular components in a testbed simulating real-world deployments, and its performance is benchmarked across multiple metrics including encryption latency, signature generation time, key sizes, and throughput. Comparative results indicate that the hybrid approach outperforms monolithic schemes in critical areas such as execution time and cryptographic strength under quantum adversary models. The findings support the practicality of using multiple post-quantum primitives in tandem to build robust communication systems. This research contributes a realistic implementation and evaluation of post-quantum security models and highlights key directions for future research and standardization efforts as the global transition to quantum-safe infrastructure begins.
Quantum computing poses a growing challenge to conventional public-key cryptographic systems, particularly those relying on integer factorization and discrete logarithm problems. Widely deployed schemes such as RSA and elliptic curve cryptography are expected to become vulnerable as large-scale quantum computing capabilities emerge. This concern has intensified the demand for communication frameworks capable of maintaining long-term confidentiality in the presence of both classical and quantum-enabled adversaries. This paper presents a Hybrid Quantum-Resilient Key Exchange Algorithm (HKEA) that combines classical cryptographic mechanisms with lattice-based post-quantum cryptographic techniques to establish secure session keys. The proposed framework employs a dual-layer key establishment process in which classical and post-quantum shared secrets are integrated to generate a strengthened hybrid session key. The design aims to preserve compatibility with existing communication infrastructures while improving resistance to future quantum attacks and mitigating risks associated with Harvest-Now-Decrypt-Later (HNDL) threats. A prototype implementation was developed using Python-based cryptographic and post-quantum security libraries. The framework was evaluated using key generation time, latency, throughput, computational overhead, and security strength as performance indicators. Comparative analysis against conventional cryptographic approaches indicates that the proposed HKEA provides enhanced quantum resilience with only a modest increase in computational cost. The proposed approach offers a practical pathway toward secure and scalable communication systems for next-generation quantum-era network environments.
Deploying post-quantum cryptography on highly constrained devices remains challenging due to the large key sizes and substantial storage and memory-traffic demands of leading lattice-based schemes. Although constructions such as Kyber, Dilithium, and NTRU offer strong resistance against quantum adversaries, their multi-kilobyte public keys and intensive memory access patterns limit practical adoption in microcontrollers, smart cards, and low-power edge environments. This work proposes a hybrid key-encapsulation mechanism that integrates a compact, seed-generated Module-LWE structure with a quantum-secure hash-based authentication layer. The design employs a small public seed to instantiate lattice matrices on demand via a lightweight pseudorandom generator and incorporates a Merkle-tree commitment to represent compressed auxiliary error information. Additional design considerations—including sparsity-aware secret keys, SIMD-friendly polynomial operations, and cache-efficient decryption paths—are intended to reduce runtime memory usage and computational overhead. The security of the proposed construction is analysed under both Module-LWE and hash-based one-way assumptions, with further consideration of constant-time execution and cache-line alignment to mitigate side-channel risks. This hybrid approach outlines a design pathway toward post-quantum key-encapsulation mechanisms suitable for deployment on memory-limited and energy-constrained platforms.