The arrival of cryptographically relevant quantum computers threatens the public-key primitives (RSA, Diffie-Hellman, and elliptic-curve cryptography) that secure essentially all current file-transfer and key-exchange systems, including through harvest-now-decrypt-later attacks. This paper presents QuantumVault, a working web-based file-sharing platform whose entire key-establishment and authentication path is built on the post-quantum algorithms standardized by NIST: ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) for digital signatures, with AES-256-GCM for authenticated bulk encryption and a SHA-256 hash chain for tamper-evident auditing. We describe a hybrid sign-then-encrypt design in which each file is encrypted once under a random data-encryption key that is independently re-wrapped for every recipient using that recipient's post-quantum public key, enabling true multi-recipient sharing and constant-time revocation without re-encrypting file data. We report on the system architecture, the cryptographic workflow, an automated suite of 73 unit and end-to-end tests, an in-application cryptographic self-test, and the security properties the implementation enforces. We also state the system's boundaries candidly: encryption is performed server-side, and we outline a concrete path toward client-side end-to-end encryption as future work.
The arrival of cryptographically relevant quantum computers threatens the public-key primitives (RSA, Diffie-Hellman, and elliptic-curve cryptography) that secure essentially all current file-transfer and key-exchange systems, including through harvest-now-decrypt-later attacks. This paper presents QuantumVault, a working web-based file-sharing platform whose entire key-establishment and authentication path is built on the post-quantum algorithms standardized by NIST: ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) for digital signatures, with AES-256-GCM for authenticated bulk encryption and a SHA-256 hash chain for tamper-evident auditing. We describe a hybrid sign-then-encrypt design in which each file is encrypted once under a random data-encryption key that is independently re-wrapped for every recipient using that recipient's post-quantum public key, enabling true multi-recipient sharing and constant-time revocation without re-encrypting file data. We report on the system architecture, the cryptographic workflow, an automated suite of 73 unit and end-to-end tests, an in-application cryptographic self-test, and the security properties the implementation enforces. We also state the system's boundaries candidly: encryption is performed server-side, and we outline a concrete path toward client-side end-to-end encryption as future work.
Abstract Ensuring the long-term security and accessibility of digital resources is a critical challenge for libraries and archives. Traditional cryptographic methods, including RSA and elliptic curve schemes, are threatened by advances in quantum computing, which could compromise the confidentiality and authenticity of stored data. To address this, we present a Post-Quantum Digital Preservation and Secure File Sharing Framework that safeguards archival materials while enabling controlled user access. The framework integrates three core components: (i) a key encapsulation mechanism (KEM) for secure session key distribution; (ii) AES-GCM for efficient and file encryption; and (iii) digital signatures for authenticity verification. A dual-application design supports both repository operators and end-users: Repository operators encrypt, sign, and package digital assets into bundles, while users verify signatures, decrypt files, and restore content through a dedicated receiver GUI. Although the prototype employs X25519 and Ed25519 as placeholders, its architecture is fully compatible with NIST-standardized post-quantum algorithms such as Kyber (KEM) and Dilithium (signatures). By combining preservation with secure file sharing, the framework ensures confidentiality, authenticity, integrity, and resistance to quantum-era threats, offering a practical and forward-looking solution for Digital repositories.
This paper presents QuantumShield, a hybrid post-quantum secure file transfer and peer-to-peer communication system designed to address emerging quantum threats. The system integrates ML-KEM (FIPS 203) for secure key encapsulation, ML-DSA (FIPS 204) for digital signatures, and AES-256-GCM for efficient and authenticated data encryption. A full-stack implementation using FastAPI and React demonstrates secure file transfer, encrypted real-time chat, and protocol visualization. The system follows a KEM-DEM architecture and incorporates forward secrecy to mitigate “Harvest Now, Decrypt Later” attacks. Performance evaluation shows that the proposed approach provides strong security with practical latency, enabling a smooth transition from classical cryptography to quantum-resistant communication systems.
The fast development of cyber communications, multimedia distribution, remote working have promoted the demand to transmit sensitive information through secure means in both the public and the private networks. The advent of massive quantum computers is rendering traditional cryptographic algorithms like RSA and Elliptic Curve Cryptography (ECC) insecure because they can crack the classical public-key algorithms like the Shor and Grover algorithms. This brings an immediate need of hybrid cryptographic systems, which integrate classical, quantum, and post-quantum algorithms to provide confidentiality, integrity, authentication, and future security beyond the quantum threat horizon.The paper is a proposal of a Hybrid Quantum-Post-Quantum Cryptographic Framework of transmitting files safely. It starts by aggregating files, which is a process to compress several files, images, videos, and multimedia files that users have chosen into one file to minimize redundancy and ease encryption. The AES-256 encrypted file is in GCM mode and provides confidentiality and integrity of the compressed file.The dual-layer mechanism ensures key establishment security. To begin with, Quantum Key Distribution (QKD) based on the protocols of BB84/E91 allows the Sender and the Receiver to generate a Quantum Secret Key (QSK) by exchanging quantum bits in quantum channel. Constant monitoring of the error rate facilitates automatic eavesdropping detection, and guarantees the keys generation is made when the conditions are secure, as well as the safeguarding of interception and man-in-the-middle attacks.A post-quantum layer is provided to ensure long-term security against quantum cryptanalysis, which uses Kyber, a NIST-approved lattice-based Key Encapsulation Mechanism (KEM). The Receiver creates a key pair of Kyber and disseminates the public key to the Sender. By using encapsulation, the Sender gets a PQC ciphertext and a Shared Secret (SS), with decapsulation on the Receiver side giving ensure that only participants of good faith get the same secret value.The hybridization phase consists of combining the QSK of QKD and SS of Kyber with the help of HKDF-SHA256 to obtain a Final Wrap Key (FWK). AES-GCM encrypts the key of file encryption by wrapping it with FWK which allows a secure and authenticated transfer of the key. The Sender sends four messages: encrypted file, Kyber ciphertext, wrapped AES key and the initialisation vector. At Receiver end, FWK is calculated once again with the help of QSK and SS so that the original data can be decrypted with the help of AES key.The suggested framework provides a defense-in-depth solution based on the combination of quantum security, post-quantum resilience and authenticated symmetric encryption. It can be analyzed that there is a strong resistance to classical and quantum adversaries, scalability, and compatibility with the existing communication networks. This renders the model to be appropriate to secure government communication, military systems, data exchange in healthcare environments, cloud storage and financial infrastructures. Keywords— Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), Kyber,Key Encapsulation Mechanism (KEM), HKDF-SHA256, Quantum Secret Key (QSK), GCM Mode.
The accelerating development of large-scale quantum computers poses an existential threat to the public-key cryptographic infrastructure that underpins modern digital communication. Algorithms such as RSA and Elliptic Curve Cryptography (ECC), which currently secure internet traffic, digital signatures, and data-at-rest, are vulnerable to Shor's algorithm running on a sufficiently powerful quantum processor. In response, the U.S. National Institute of Standards and Technology (NIST) finalized the first post-quantum cryptography (PQC) standards in August 2024—FIPS 203 (ML-KEM/Kyber), FIPS 204 (ML-DSA/Dilithium), and FIPS 205 (SLH-DSA/SPHINCS+)—marking the beginning of a global migration toward quantum-resistant cryptography. This paper presents a hybrid C++/Python secure storage and communication platform (source code available at https://github.com/Sujithb128989/Quantum-Safe-Backend) that implements NIST-selected PQC algorithms in a production-oriented architecture. The backend employs CRYSTALS-Dilithium5 for quantum-resistant transport authentication, Kyber for key encapsulation, and AES-256-GCM for symmetric encryption-at-rest, delivered through a dual-stack gRPC/HTTP architecture containerized with Docker. We describe the system's design rationale, detail the cryptographic pipeline from certificate generation to atomic key rotation, and discuss the engineering challenges of integrating post-quantum primitives into real-world software systems.
The emergence of quantum computing poses a fundamental threat to current public key cryptographic systems. This threat is necessitating a transition to quantum resistant cryptographic alternatives in all the applications. In this work, we present the implementation of a practical hybrid end-to-end encryption system that combines classical and post-quantum cryptographic primitives to achieve both security and efficiency. Our system employs CRYSTALS-Kyber, a NIST-standardized lattice-based key encapsulation mechanism, for quantum-safe key exchange, coupled with AES-256-GCM for efficient authenticated symmetric encryption and SHA-256 for deterministic key derivation. The architecture follows a zero-trust model where a relay server facilitates communication without accessing plaintext messages or cryptographic keys. All encryption and decryption operations occur exclusively at client endpoints. The system demonstrates that NIST standardized post-quantum cryptography can be effectively integrated into practical messaging systems with acceptable performance characteristics, offering protection against both classical and quantum adversaries. As our focus is on implementation rather than on novelty, we also provide an open-source implementation to facilitate reproducibility and further research in post quantum secure communication systems.
The emergence of fault-tolerant quantum computing poses an existential threat to classical public-key cryptographic systems, including RSA and Elliptic Curve Cryptography (ECC), through Shor's polynomial-time factorization algorithm. The Harvest Now, Decrypt Later (HNDL) attack paradigm further amplifies this threat by enabling adversaries to archive ciphertext today for future quantum-enabled decryption, rendering long-term data confidentiality immediately at risk. While the National Institute of Standards and Technology (NIST) finalized post-quantum cryptographic standards ML-KEM (FIPS 203) and ML-DSA (FIPS 204) in August 2024, their practical integration into complete application-level communication systems remains a largely unaddressed research gap. This paper presents QuantumShield, a hybrid post-quantum secure peer-to-peer communication platform that integrates ML-KEM-768 for quantum-safe key encapsulation, ML-DSA-65 for authenticated digital signatures, and AES-256-GCM for high-throughput symmetric encryption. Our primary research contribution is a rigorous empirical analysis of PQC integration overhead in a real-world communication pipeline, quantifying latency, key size, and security trade-offs against classical RSA-2048 and ECC-256 baselines under controlled experimental conditions. Experimental evaluation across 1,000 iterations demonstrates that ML-KEM-768 encapsulation completes in 2.8 ± 0.2 ms compared to 4.1 ± 0.3 ms for ECDH key agreement — a 32% latency reduction while providing NIST Level 3 post-quantum security. The complete secure transfer pipeline processes 1 MB files in under 22 ms on commodity hardware. The system further provides interactive cryptographic visualization, adversary threat modeling, tamper detection simulation, and a hybrid migration framework demonstrating practical transition from classical to post-quantum infrastructure. QuantumShield establishes that quantum-safe communication is not merely theoretical but deployable today with negligible performance compromise.