The proliferation of Internet of Things (IoT) devices that use the Message Queuing Telemetry Transport (MQTT) protocol poses significant security challenges in the emerging quantum computing era. Current Transport Layer Security (TLS) implementations rely on classical cryptographic algorithms vulnerable to Shor's algorithm. This paper proposes PQ-MQTT, a hybrid post-quantum secure communication protocol that integrates ML-KEM-768 with X25519 for key encapsulation and a lightweight session-key derivation mechanism optimized for resource-constrained IoT publishers. We present a formal security analysis under the Quantum Random Oracle Model (QROM), demonstrating resilience against store-now-decryptlater attacks. Experimental evaluation on the Raspberry Pi 4, ESP32, and Arduino Nano 33 platforms shows that PQ-MQTT achieves handshake latencies of$127.3 ~\text{ms}, 412.7 ~\text{ms}$, and$1,847.2 ~\text{ms}$, respectively, with 18.2 KB of additional memory overhead. A comparative analysis of pure post-quantum and classical TLS implementations shows energy reductions of$23.5 \%-40.5 \%$relative to pure PQC, achieved through our hybrid optimization approach, while maintaining 94.2 % throughput efficiency.
The proliferation of Internet of Things (IoT) devices that use the Message Queuing Telemetry Transport (MQTT) protocol poses significant security challenges in the emerging quantum computing era. Current Transport Layer Security (TLS) implementations rely on classical cryptographic algorithms vulnerable to Shor's algorithm. This paper proposes PQ-MQTT, a hybrid post-quantum secure communication protocol that integrates ML-KEM-768 with X25519 for key encapsulation and a lightweight session-key derivation mechanism optimized for resource-constrained IoT publishers. We present a formal security analysis under the Quantum Random Oracle Model (QROM), demonstrating resilience against store-now-decryptlater attacks. Experimental evaluation on the Raspberry Pi 4, ESP32, and Arduino Nano 33 platforms shows that PQ-MQTT achieves handshake latencies of127.3ms,412.7ms, and1,847.2ms, respectively, with 18.2 KB of additional memory overhead. A comparative analysis of pure post-quantum and classical TLS implementations shows energy reductions of23.5%−40.5%relative to pure PQC, achieved through our hybrid optimization approach, while maintaining 94.2 % throughput efficiency.
The emergence of quantum computing poses an existential threat to current Internet of Things security infrastructure, which relies predominantly on RSA and elliptic curve cryptography for confidentiality and authentication. Shor's algorithm enables polynomial-time factorization that can break these classical cryptographic primitives, necessitating urgent migration to quantum-resistant alternatives. This paper presents the first comprehensive performance evaluation of six NISTstandardized and candidate post-quantum key encapsulation mechanisms (ML-KEM-512, ML-KEM-768, NTRU-Prime-hrss, BIKE-L1, HQC-128, Classic-McEliece-348864) integrated into the MQTT protocol across 4,608 experimental configurations spanning diverse real-world network conditions. We systematically evaluate connection establishment latency, message delivery reliability, decryption computational overhead, and throughput stability under systematically varied network latency (10-150 ms representing LAN to satellite links), packet loss rates (0-10% spanning excellent to degraded connectivity), payload sizes (128-1024 bytes covering sensor telemetry to multimedia streams), and message transmission rates (1-10 Hz from periodic monitoring to real-time control). Statistical analysis of 622,080 MQTT messages totaling 384 hours of simulation time reveals that NTRU-Prime-hrss achieves optimal performance-security balance with 98.1% delivery ratio and 26.1 ms median handshake latency across all tested conditions, while Classic-McEliece exhibits 278.3 ms handshake overhead rendering it impractical for resourceconstrained deployments despite offering conservative security margins. We demonstrate through generalized linear modeling that transport-layer effects (TCP retransmissions, TLS record framing overhead) dominate post-quantum cryptographic computational costs, accounting for approximately 70% of endto-end latency in high-loss scenarios. Our novel three-gate decision framework provides quantitative deployment criteria for IoT operators balancing security requirements against operational constraints. Complete implementation, experimental dataset, and analysis scripts available at https://github.com/ vssk18/PQSM-RESEARCH.
Message Queue Telemetry Transport (MQTT) is a common communication protocol used in the Internet of Things (IoT). MQTT is a simple, lightweight messaging protocol used to establish communication between multiple devices relying on the publish–subscribe model. However, the protocol does not provide authentication, and most proposals to incorporate it lose their lightweight feature and do not consider the future risk of quantum attacks. IoT devices are generally resource-constrained, and postquantum cryptography is often more computationally resource-intensive compared to current cryptographic standards, adding to the complexity of the transition. In this paper, we use the postquantum digital signature scheme CRYSTALS-Dilithium to provide authentication for MQTT and determine what the CPU, memory and disk usage are when doing so. We further investigate another possibility to provide authentication when using MQTT, namely a key encapsulation mechanism (KEM) trick proposed in 2020 for transport level security (TLS). Such a trick is claimed to save up to 90% in CPU cycles. We use the postquantum KEM scheme CRYSTALS-KYBER and compare the resulting CPU, memory and disk usages with traditional authentication. We found that the use of KEM for authentication resulted in a speed increase of 25 ms, a saving of 71%. There were some extra costs for memory but this is minimal enough to be acceptable for most IoT devices.
The rapid expansion of Internet of Things (IoT) ecosystems has increased the need for communication mechanisms that can remain secure against emerging computational threats. Conventional asymmetric cryptographic schemes, including RSA and Elliptic Curve Cryptography (ECC), are vulnerable to advances in quantum computing due to the ability of Shor's algorithm to undermine their underlying mathematical assumptions. To address these challenges, this paper presents PQ-IoT SecureCom, a quantum-resistant communication framework built using NIST-standardized post-quantum cryptographic primitives. The proposed framework employs ML-KEM (derived from Kyber) for secure key encapsulation and ML-DSA (derived from Dilithium) for digital authentication, combined with AESGCM to ensure data confidentiality and integrity. Additional security mechanisms, including PQC-based device certification, periodic session key updates, and nonce-based timestamp validation, are incorporated to mitigate replay and impersonation attacks. The framework also supports a hybrid operational mode that enables performance comparison between classical and postquantum cryptographic schemes. System behavior is monitored using a real-time dashboard that records cryptographic overhead, communication metrics, and detected security events. Experimental evaluation shows that ML-KEM and ML-DSA significantly enhance security while introducing computational overhead that remains acceptable for contemporary IoT devices. Through automated attack simulations and detailed event logging, PQ-IoT SecureCom demonstrates the practical feasibility of deploying scalable post-quantum security in IoT communication systems.
The use of the MQTT (Message Queuing Telemetry Transport) communication protocol in the Industry 4.0 faces the challenge of data protection. The security layer provided by Transport Layer Security (TLS) is threatened by the emergence of quantum computers, accelerating the need for MQTT to sup-port post-quantum algorithms. This work evaluates secure imple-mentations of MQTT with pre-quantum cryptography algorithms (those used nowadays) and with hybrid algorithms, combining pre and post-quantum techniques. In both cases, the system performance is assessed in terms of memory consumption and CPU cycles, identifying the main challenges for the deployment of hybrid cryptography in an industrial Internet of Things context.
The rapid advancement of quantum computing poses significant threats to classical cryptographic methods, such as Rivest–Shamir–Adleman (RSA) and Elliptic Curve Cryptography (ECC), which currently secure Internet of Things (IoT) and cloud communications. Post-Quantum Cryptography (PQC), particularly lattice-based schemes, has emerged as a promising alternative. CRYSTALS-Kyber, standardized by the National Institute of Standards and Technology (NIST) as ML-KEM, has shown efficiency and practicality for constrained IoT devices. Most existing research has focused on PQC within the Transport Layer Security (TLS) protocol. Consequently, a critical gap exists in understanding PQC’s performance in lightweight IoT protocols. These are Message Queuing Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP), particularly under adverse network conditions. To address this gap, this paper provides a systematic review of the literature on the network resilience and performance of CRYSTALS-Kyber when integrated into these protocols operating over lossy and high-latency networks. Additional challenges include non-standardized integration, resource limitations, and side-channel vulnerabilities. This review provides a structured synthesis of current knowledge, highlights unresolved trade-offs between security and efficiency, and outlines future research directions, including protocol-level optimization, lightweight signature schemes, and resilience testing of PQC-secured IoT protocols under realistic conditions.
In this paper, we deal with the deployment of Post-Quantum Cryptography (PQC) in Internet of Things (IoT). Concretely, we focus on the MQTT (Message Queuing Telemetry Transport) protocol that is widely used in IoT services. The paper presents our novel quantum-resistant security proposal for the MQTT protocol that supports secure broadcast. Our solution omits using TLS with the handshake causing delay and is suitable for sending irregular short messages. Finally, we show how our solution can practically affect concrete use cases by the performance results of the proposed solution.