Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Lecture notes in computer science

Post-quantum TLS 1.3 Handshake from CPA-Secure KEMs with Tighter Reductions

Jinrong Chen, Biming Zhou, Rongmao Chen, Haodong Jiang, Yi Rong Wang, Xinyi Huang, Yunlei Zhao, Moti M. Yung

Published Jan 1, 2026• 0 citations
Publisher
DOI
10.1007/978-3-032-25317-0_17

Related papers

CPA-Secure KEMs are also Sufficient for Post-quantum TLS 1.3

Biming Zhou, Haodong Jiang, Yunlei Zhao

Lecture notes in computer science•Dec 11, 2024•5 citations

2-Pass Key Exchange Protocols from CPA-Secure KEM

Kaoru Kurosawa, Jun Furukawa

Lecture notes in computer science•Jan 1, 2014•11 citations

On the Security and Efficiency of TLS 1.3 Handshake with Hybrid Key Exchange from CPA-Secure KEMs

Jinrong Chen, Wei Peng, Yi Wang +1 more

TLS 1.3 is a crucial protocol for securing modern internet communications. To facilitate a smooth transition to post-quantum security, hybrid key exchange, which combines classical key exchange algorithms with post-quantum key encapsulation mechanisms (KEMs), is proposed to enhance the security of the current TLS 1.3 handshake. However, existing drafts and implementations of hybrid key exchange for TLS 1.3 primarily rely on CCA-secure KEMs (i.e., secure against chosen-ciphertext attacks) based on the Fujisaki-Okamoto (FO) transform. The re-encryption step in their decapsulation algorithms not only introduces additional performance overhead but also raises the risk of side-channel attacks. Although Huguenin-Dumittan and Vaudenay (Eurocrypt 2022) and Zhou et al. (Asiacrypt 2024) demonstrated that the weaker CPA-secure KEMs (i.e., secure against chosen-plaintext attacks) suffice for constructing a secure TLS 1.3 handshake, their analyses were limited to single-KEM settings and did not consider the hybrid key exchange scenario. This work challenges the necessity of CCA security by proving that CPA-secure KEMs are sufficient for the TLS 1.3 handshake even in the hybrid key exchange setting. We provide the first formal security proofs for this claim, covering both the classical random oracle model (ROM) and the quantum random oracle model (QROM), thereby ensuring security against quantum adversaries. To validate the practical benefits, we conduct an extensive performance evaluation based on the latest OpenSSL implementation. Our results show that using CPA-secure KEMs yields up to 44.8% performance improvement at the key exchange layer and up to approximately 9% acceleration for the full TLS 1.3 handshake. Beyond performance gains, this approach reduces the codebase's attack surface by eliminating the re-encryption step, thereby mitigating a class of side-channel vulnerabilities. Our work positions CPA-secure KEMs as a secure, efficient, and practical alternative for standardizing and deploying post-quantum TLS 1.3 even with hybrid key exchange.

Entropy•Dec 8, 2025•6 citations

Benchmarking Post-quantum Cryptography in TLS

Christian Paquin, Douglas Stebila, Goutam Tamvada

Lecture notes in computer science•Jan 1, 2020•167 citations

Challenges and Strategies for Transitioning TLS to Post-Quantum Cryptography

Moritz Beckel

•Sep 8, 2026•0 citations

Comparative analysis of post-quantum handshake performance in QUIC and TLS protocols

José Antonio Montenegro, Rubén Rı́os, Javier Bonilla

The rapid advancement of quantum computing threatens the security foundations of today’s communication protocols. On the web, the traditional approach to securing web traffic has been to couple HTTP with TLS over TCP, but QUIC over UDP has recently emerged as an alternative to reduce latency and improve performance over unreliable networks. The need for an urgent transition to quantum-resistant web protocols demands further examination of both stacks. Consequently, in this work we evaluate their performance when combined with post-quantum primitives. To this end, we devise a practical evaluation framework that integrates the cryptographic primitives into TLS and QUIC implementations. Our analysis focuses on comparing the impact of hybrid and post-quantum primitives on TLS and QUIC under both ideal and realistic network conditions, providing quantitative insights into the performance cost and feasibility of transitioning toward a post-quantum web. Our results indicate that hybrid KEMs incur the highest handshake latency and bandwidth overhead, while pure post-quantum KEMs offer a favorable trade-off between security and performance, with only moderate costs. Moreover, QUIC consistently reduces the performance penalty of post-quantum primitives compared to TLS, especially in lossy network environments.

Computer Networks•Dec 23, 2025•10 citations
TLS 1.3 is a crucial protocol for securing modern internet communications. To facilitate a smooth transition to post-quantum security, hybrid key exchange, which combines classical key exchange algorithms with post-quantum key encapsulation mechanisms (KEMs), is proposed to enhance the security of the current TLS 1.3 handshake. However, existing drafts and implementations of hybrid key exchange for TLS 1.3 primarily rely on CCA-secure KEMs (i.e., secure against chosen-ciphertext attacks) based on the Fujisaki-Okamoto (FO) transform. The re-encryption step in their decapsulation algorithms not only introduces additional performance overhead but also raises the risk of side-channel attacks. Although Huguenin-Dumittan and Vaudenay (Eurocrypt 2022) and Zhou et al. (Asiacrypt 2024) demonstrated that the weaker CPA-secure KEMs (i.e., secure against chosen-plaintext attacks) suffice for constructing a secure TLS 1.3 handshake, their analyses were limited to single-KEM settings and did not consider the hybrid key exchange scenario. This work challenges the necessity of CCA security by proving that CPA-secure KEMs are sufficient for the TLS 1.3 handshake even in the hybrid key exchange setting. We provide the first formal security proofs for this claim, covering both the classical random oracle model (ROM) and the quantum random oracle model (QROM), thereby ensuring security against quantum adversaries. To validate the practical benefits, we conduct an extensive performance evaluation based on the latest OpenSSL implementation. Our results show that using CPA-secure KEMs yields up to 44.8% performance improvement at the key exchange layer and up to approximately 9% acceleration for the full TLS 1.3 handshake. Beyond performance gains, this approach reduces the codebase's attack surface by eliminating the re-encryption step, thereby mitigating a class of side-channel vulnerabilities. Our work positions CPA-secure KEMs as a secure, efficient, and practical alternative for standardizing and deploying post-quantum TLS 1.3 even with hybrid key exchange.
The rapid advancement of quantum computing threatens the security foundations of today’s communication protocols. On the web, the traditional approach to securing web traffic has been to couple HTTP with TLS over TCP, but QUIC over UDP has recently emerged as an alternative to reduce latency and improve performance over unreliable networks. The need for an urgent transition to quantum-resistant web protocols demands further examination of both stacks. Consequently, in this work we evaluate their performance when combined with post-quantum primitives. To this end, we devise a practical evaluation framework that integrates the cryptographic primitives into TLS and QUIC implementations. Our analysis focuses on comparing the impact of hybrid and post-quantum primitives on TLS and QUIC under both ideal and realistic network conditions, providing quantitative insights into the performance cost and feasibility of transitioning toward a post-quantum web. Our results indicate that hybrid KEMs incur the highest handshake latency and bandwidth overhead, while pure post-quantum KEMs offer a favorable trade-off between security and performance, with only moderate costs. Moreover, QUIC consistently reduces the performance penalty of post-quantum primitives compared to TLS, especially in lossy network environments.