MRS-AUTH RESEARCH PHASE/ASSUMPTIONS — NO NIST/IETF CERTIFICATION post-quantum security with a novel cryptographic layer derived from the theory of linear Diophantine representation systems. The construction combines three components: (1) a post-quantum KEM (Kyber) for key encapsulation, (2) an MRS chain, a deterministic structured traversal of the solution space of N = 19A + 9B — as an entropy source fed through HKDF modelled as a Random Oracle. And (3) AES-GCM for authenticated encryption. The session key is formed as the XOR of the KEM-derived key and the MRS-derived master key. The central mathematical insight is that the minimal coefficient A₀ of any representation N = 19A + 9B equals the digital root dr(N), a consequence of the congruence 19 ≡ 1 (mod 9). This property is scale-invariant and extends canonically to three-dimensional systems pA + qB + rC under mild divisibility conditions. The resulting MRS chain is fully deterministic yet cryptographically opaque after HKDF compression, bridging structural predictability with entropic security. The MRS-AUTH-KEM achieves IND-CCA2 security under three standard assumptions: IND-CCA2 security of the underlying KEM, the Random Oracle Model for HKDF, and IND-CPA security of AES-GCM. The security reduction proceeds via a four-game hybrid argument, formalized in EasyCrypt. The adversary's advantage is bounded by 2 · negl(λ), and breaking the scheme requires simultaneously defeating both Kyber and the MRS chain providing a concrete, quantifiable security margin beyond existing hybrid constructions. Domain separation between HKDF contexts prevents cross-context collisions, and the scale-invariance of the digital root ensures that the anchor A₀ remains stable under all system extensions. RESEARCH PHASE — NO NIST/IETF CERTIFICATION
MRS-AUTH RESEARCH PHASE/ASSUMPTIONS — NO NIST/IETF CERTIFICATION post-quantum security with a novel cryptographic layer derived from the theory of linear Diophantine representation systems. The construction combines three components: (1) a post-quantum KEM (Kyber) for key encapsulation, (2) an MRS chain, a deterministic structured traversal of the solution space of N = 19A + 9B — as an entropy source fed through HKDF modelled as a Random Oracle. And (3) AES-GCM for authenticated encryption. The session key is formed as the XOR of the KEM-derived key and the MRS-derived master key. The central mathematical insight is that the minimal coefficient A₀ of any representation N = 19A + 9B equals the digital root dr(N), a consequence of the congruence 19 ≡ 1 (mod 9). This property is scale-invariant and extends canonically to three-dimensional systems pA + qB + rC under mild divisibility conditions. The resulting MRS chain is fully deterministic yet cryptographically opaque after HKDF compression, bridging structural predictability with entropic security. The MRS-AUTH-KEM achieves IND-CCA2 security under three standard assumptions: IND-CCA2 security of the underlying KEM, the Random Oracle Model for HKDF, and IND-CPA security of AES-GCM. The security reduction proceeds via a four-game hybrid argument, formalized in EasyCrypt. The adversary's advantage is bounded by 2 · negl(λ), and breaking the scheme requires simultaneously defeating both Kyber and the MRS chain providing a concrete, quantifiable security margin beyond existing hybrid constructions. Domain separation between HKDF contexts prevents cross-context collisions, and the scale-invariance of the digital root ensures that the anchor A₀ remains stable under all system extensions. RESEARCH PHASE — NO NIST/IETF CERTIFICATION
The fast development of cyber communications, multimedia distribution, remote working have promoted the demand to transmit sensitive information through secure means in both the public and the private networks. The advent of massive quantum computers is rendering traditional cryptographic algorithms like RSA and Elliptic Curve Cryptography (ECC) insecure because they can crack the classical public-key algorithms like the Shor and Grover algorithms. This brings an immediate need of hybrid cryptographic systems, which integrate classical, quantum, and post-quantum algorithms to provide confidentiality, integrity, authentication, and future security beyond the quantum threat horizon.The paper is a proposal of a Hybrid Quantum-Post-Quantum Cryptographic Framework of transmitting files safely. It starts by aggregating files, which is a process to compress several files, images, videos, and multimedia files that users have chosen into one file to minimize redundancy and ease encryption. The AES-256 encrypted file is in GCM mode and provides confidentiality and integrity of the compressed file.The dual-layer mechanism ensures key establishment security. To begin with, Quantum Key Distribution (QKD) based on the protocols of BB84/E91 allows the Sender and the Receiver to generate a Quantum Secret Key (QSK) by exchanging quantum bits in quantum channel. Constant monitoring of the error rate facilitates automatic eavesdropping detection, and guarantees the keys generation is made when the conditions are secure, as well as the safeguarding of interception and man-in-the-middle attacks.A post-quantum layer is provided to ensure long-term security against quantum cryptanalysis, which uses Kyber, a NIST-approved lattice-based Key Encapsulation Mechanism (KEM). The Receiver creates a key pair of Kyber and disseminates the public key to the Sender. By using encapsulation, the Sender gets a PQC ciphertext and a Shared Secret (SS), with decapsulation on the Receiver side giving ensure that only participants of good faith get the same secret value.The hybridization phase consists of combining the QSK of QKD and SS of Kyber with the help of HKDF-SHA256 to obtain a Final Wrap Key (FWK). AES-GCM encrypts the key of file encryption by wrapping it with FWK which allows a secure and authenticated transfer of the key. The Sender sends four messages: encrypted file, Kyber ciphertext, wrapped AES key and the initialisation vector. At Receiver end, FWK is calculated once again with the help of QSK and SS so that the original data can be decrypted with the help of AES key.The suggested framework provides a defense-in-depth solution based on the combination of quantum security, post-quantum resilience and authenticated symmetric encryption. It can be analyzed that there is a strong resistance to classical and quantum adversaries, scalability, and compatibility with the existing communication networks. This renders the model to be appropriate to secure government communication, military systems, data exchange in healthcare environments, cloud storage and financial infrastructures. Keywords— Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), Kyber,Key Encapsulation Mechanism (KEM), HKDF-SHA256, Quantum Secret Key (QSK), GCM Mode.
The accelerating maturation of quantum computing technology-exemplified by IBM's Eagle, Osprey, and Condor processors surpassing 1,000+ physical qubits-represents a strategic and existential threat to the public-key cryptographic foundations of modern digital infrastructure.The mathematical intractability assumptions underlying RSA (integer factorization), Diffie-Hellman (discrete logarithm), and Elliptic Curve Cryptography (elliptic curve discrete logarithm problem) are rendered computationally negligible by Shor's polynomial-time quantum algorithm.Simultaneously, Grover's unstructured quantum search algorithm halves the effective security of all symmetric encryption schemes, requiring doubling of key lengths.The consequent "Harvest Now, Decrypt Later" (HNDL) attack paradigm-wherein encrypted communications are archived today for future quantum decryption-transforms post-quantum cryptographic migration from a future concern into an immediate operational imperative for all communications with confidentiality lifetimes exceeding five years.This paper presents a comprehensive Hybrid Post-Quantum Cryptographic (HPQC) framework that systematically integrates NIST-finalized post-quantum algorithms-CRYSTALS-Kyber (FIPS 203) for Key Encapsulation Mechanisms, CRYSTALS-Dilithium (FIPS 204) and SPHINCS+ (FIPS 205) for digital signatureswith classical cryptographic primitives (ECDH P-256/X25519, ECDSA, AES-256-GCM) in a layered, crypto-agile, formally proven, and operationally deployable security architecture.Twenty mathematical formulae are derived and presented, covering Shor/Grover complexity bounds, Module-LWE and Module-SIS hardness parameters, hybrid HKDF-SHA-512 key derivation, IND-CCA2 and EUF-CMA security reductions, forward secrecy entropy bounds, and crypto-agility rotation period calculations.Formal Theorems 1 and 2 establish the security of the hybrid KEM and hybrid signature constructions respectively.Simulated performance benchmarks across three hardware tiers (Intel Xeon server, ARM Cortex-A72 edge gateway, ARM Cortex-M4 IoT device) demonstrate 23-31% TLS 1.3 handshake latency overhead over classical baselines with full quantum resistance.Seven comparative tables and five architectural figures support the engineering-ready deployment guidance provided across 5G/6G, massive IoT, SDN, and cloud-native environments.A four-phase crypto-agile migration roadmap aligned with NIST FIPS 203/204/205, NIST SP 800-208, NSA CNSA 2.0, BSI TR-02102, and ENISA PQC guidance is presented for enterprise network operators and security architects.
Introduction Session establishment, the process by which two parties authenticate each other and derive a shared secret key, forms the foundation for secure digital communication. Quantum computers threaten this foundation by breaking classical public-key primitives such as RSA and elliptic-curve Diffie–Hellman (ECDH), thereby enabling harvest-now–decrypt-later (HNDL) attacks that endanger long-term confidentiality. Methods This paper presents the design, implementation, and evaluation of an authenticated, quantum-resistant session protocol that replaces these vulnerable mechanisms with their post-quantum counterparts. The proposed protocol integrates ML-KEM-1024 (FIPS 203; CRYSTALS, Kyber) for ephemeral key exchange, ML-DSA-65 (FIPS 204; CRYSTALS, Dilithium) for endpoint authentication, and AES-256-GCM for symmetric protection. A transcript-bound HKDF–SHA3-256 key schedule and a 96-bit GCM nonce construction with conservative rekey limits are used to ensure forward secrecy, downgrade resistance, and message integrity. A Python/C prototype (PQClean ML-KEM-1024 with PyCryptodome AES-256-GCM) was benchmarked over 1,000 iterations on commodity hardware. Results The results show that sub-millisecond cryptographic overhead ML-KEM-1024 matches the performance of X25519 while vastly outperforming RSA-3072 in secure session establishment, and symmetric encryption remains cost effective. Nonces are unique 96-bit values, never reused across directions or beyond 2³² records, following NIST SP 800-38D; when nonce-misuse resistance is required, AES-256-GCM-SIV (RFC 8452) is supported as a drop-in alternative. Empirical tests under both local and WAN-emulated ( ≈ 40 ms RTT) network conditions confirm that the additional post-quantum cost maintains the handshake cryptographic latency in the 0.50–0.70 ms range. Discussion These results demonstrate that fully authenticated, forward-secure, quantum-resistant session negotiation is practical for real-world deployments.
Rapid advances in quantum computing, together with the announcement by the National Institute of Standards and Technology (NIST) to define new standards for digitalsignature, encryption, and key-establishment protocols, have created significant interest in post-quantum cryptographic schemes. This paper introduces Kyber (part of CRYSTALS - Cryptographic Suite for Algebraic Lattices - a package submitted to NIST post-quantum standardization effort in November 2017), a portfolio of post-quantum cryptographic primitives built around a key-encapsulation mechanism (KEM), based on hardness assumptions over module lattices. Our KEM is most naturally seen as a successor to the NEWHOPE KEM (Usenix 2016). In particular, the key and ciphertext sizes of our new construction are about half the size, the KEM offers CCA instead of only passive security, the security is based on a more general (and flexible) lattice problem, and our optimized implementation results in essentially the same running time as the aforementioned scheme. We first introduce a CPA-secure public-key encryption scheme, apply a variant of the Fujisaki-Okamoto transform to create a CCA-secure KEM, and eventually construct, in a black-box manner, CCA-secure encryption, key exchange, and authenticated-key-exchange schemes. The security of our primitives is based on the hardness of Module-LWE in the classical and quantum random oracle models, and our concrete parameters conservatively target more than 128 bits of postquantum security.
Driven by advances in the standardization of NIST’s Post-Quantum Cryptography (PQC) algorithms, research on constructing Password Authenticated Key Exchange (PAKE) protocols using Key Encapsulation Mechanisms (KEMs) has gained considerable attention. Several PAKE protocols have established precise security requirements for the underlying KEM. Arriaga et al. introduced a PAKE protocol called CHIC, which requires the KEM to achieve anonymity under plaintext-checkable attacks (ANO-1PCA). An anonymous KEM does not leak any information about which public key was used for encryption. It protects the identities and privacy of participants and is critical in preventing identity-guessing attacks, therefore, anonymity is also called key-privacy. The anonymity of NIST PQC Round-3 candidates has recently been analyzed, some of which satisfied ANO-CCA.Huguenin-Dumittan and Vaudenay proposed two efficient constructions, TCHand TH, to create KEM from public-key encryption (PKE) schemes. Jiang et al. introduced TRHbased on TH. These constructions can transform any OW-CPA PKE into an IND-qCCA KEM efficiently and avoid re-encryption. However, prior to this work, no research has been conducted to determine whether these constructions preserve or lift anonymity.In this paper, we proved that for any OW-CPA, DS-IND PKE, the construction KEMRH= TRH[PKE,H] achieves ANO1-CCA in the quantum random oracle model (QROM). We then construct a KEM called KyberRH, and provide an algorithm for the CHIC protocol using KyberRH.
The emergence of quantum computing poses a fundamental threat to current public key cryptographic systems. This threat is necessitating a transition to quantum resistant cryptographic alternatives in all the applications. In this work, we present the implementation of a practical hybrid end-to-end encryption system that combines classical and post-quantum cryptographic primitives to achieve both security and efficiency. Our system employs CRYSTALS-Kyber, a NIST-standardized lattice-based key encapsulation mechanism, for quantum-safe key exchange, coupled with AES-256-GCM for efficient authenticated symmetric encryption and SHA-256 for deterministic key derivation. The architecture follows a zero-trust model where a relay server facilitates communication without accessing plaintext messages or cryptographic keys. All encryption and decryption operations occur exclusively at client endpoints. The system demonstrates that NIST standardized post-quantum cryptography can be effectively integrated into practical messaging systems with acceptable performance characteristics, offering protection against both classical and quantum adversaries. As our focus is on implementation rather than on novelty, we also provide an open-source implementation to facilitate reproducibility and further research in post quantum secure communication systems.