A Hybrid Post-Quantum Cryptosystem for Resource-Constrained IoT Communications: Design, Security Analysis, and Migration Framework
Chloe Tully
A Hybrid Post-Quantum Cryptosystem for Resource-Constrained IoT Communications: Design, Security Analysis, and Migration Framework C. J. Tully https://orcid.org/0009-0007-5661-7332 Independent Researcher, Australia ttg41postquantum@gmail.com --- Abstract Long-lived Internet-of-Things (IoT) devices require migration paths from classical public-key cryptography to post-quantum mechanisms while operating under strict memory, bandwidth, and energy constraints. This paper proposes a hybrid cryptosystem that combines an ephemeral classical key exchange with ML-KEM (FIPS 203), configurable classical or ML-DSA (FIPS 204) authentication, and AES-256-GCM authenticated encryption. The design specifies transcript-bound suite negotiation, domain-separated HKDF key derivation, direction-specific traffic keys, replay protection, nonce-management rules, and bounded fragmentation for low-MTU links. Security claims are stated conditionally on the underlying primitives, secure randomness, correct transcript authentication, and erasure of ephemeral secrets. A resource-analysis framework identifies implementation variables for 32-bit embedded platforms, while a five-phase migration process supports crypto-agility from legacy elliptic-curve deployments to post-quantum-capable operation. Keywords Post-Quantum Cryptography, Hybrid Key Exchange, IoT Security, ML-KEM, ML-DSA
•Sep 29, 2026•0 citations