Background The advent of quantum computing poses significant challenges to traditional cryptographic methods employed in securing network protocols. Methods This study evaluates the vulnerabilities of Transport Layer Security (TLS), Internet Protocol Security (IPsec), and Domain Name System Security Extensions (DNSSEC) under quantum threat scenarios. Leveraging the STRIDE and PASTA threat modeling frameworks, the research categorizes threats and simulates attack scenarios to provide a comparative analysis of these protocols. Results The findings reveal critical vulnerabilities, particularly in public-key cryptography, and highlight the urgency of transitioning to quantum- resistant cryptographic solutions. Conclusions The study proposes practical mitigation strategies to enhance the resilience of these protocols, contributing to the advancement of post-quantum cryptography and secure digital communications.
Background The advent of quantum computing poses significant challenges to traditional cryptographic methods employed in securing network protocols. Methods This study evaluates the vulnerabilities of Transport Layer Security (TLS), Internet Protocol Security (IPsec), and Domain Name System Security Extensions (DNSSEC) under quantum threat scenarios. Leveraging the STRIDE and PASTA threat modeling frameworks, the research categorizes threats and simulates attack scenarios to provide a comparative analysis of these protocols. Results The findings reveal critical vulnerabilities, particularly in public-key cryptography, and highlight the urgency of transitioning to quantum- resistant cryptographic solutions. Conclusions The study proposes practical mitigation strategies to enhance the resilience of these protocols, contributing to the advancement of post-quantum cryptography and secure digital communications.
The advent of quantum computing poses significant threats to classical public-key cryptographic primitives such as RSA and elliptic-curve cryptography. As many critical network and security protocols depend on these primitives for key exchange and authentication, there is an urgent need to understand their quantum vulnerability and assess the progress made towards integrating post-quantum cryptography (PQC). This survey provides a detailed examination of nine widely deployed protocols - TLS, IPsec, BGP, DNSSEC, SSH, QUIC, OpenID Connect, OpenVPN, and Signal Protocol - analysing their cryptographic foundations, quantum risks, and the current state of PQC migration. We find that TLS and Signal lead the transition with hybrid post-quantum key exchange already deployed at scale, while IPsec and SSH have standardised mechanisms but lack widespread production adoption. DNSSEC and BGP face the most significant structural barriers, as post-quantum signature sizes conflict with fundamental protocol constraints. Across all protocols, key exchange proves consistently easier to migrate than authentication, and protocol-level limitations such as message size and fragmentation often dominate over raw algorithm performance. We also discuss experimental deployments and emerging standards that are shaping the path towards a quantum-resistant communication infrastructure.
The rise of large-scale quantum computing poses a significant threat to traditional cryptographic security measures. Quantum attacks, particularly targeting the mathematical foundations of current asymmetric cryptographic algorithms, render them ineffective. Even standard symmetric key cryptography is susceptible, albeit to a lesser extent, with potential security enhancements through longer keys or extended hash function outputs. Consequently, the cryptographic solutions currently employed to safeguard data will be inadequately secure and vulnerable to emerging quantum technology threats. In response to this impending quantum menace, organizations must chart a course towards quantum-safe environments, demanding robust business continuity plans and meticulous risk management throughout the migration process. This study provides an in-depth exploration of the challenges associated with migrating from a non-quantum-safe cryptographic state to one resilient against quantum threats. We introduce a comprehensive security risk assessment framework that scrutinizes vulnerabilities across algorithmic, certificate, and protocol layers, covering the entire migration journey, including pre-migration, through-migration, and post-migration stages. Our methodology links identified vulnerabilities to the well-established STRIDE threat model, establishing precise criteria for evaluating their potential impact and likelihood throughout the migration process. Moving beyond theoretical analysis, we address vulnerabilities practically, especially within critical components like cryptographic algorithms, public key infrastructures, and network protocols. Our study not only identifies potential attacks and vulnerabilities at each layer and migration stage but also suggests possible countermeasures and alternatives to enhance system resilience, empowering organizations to construct a secure infrastructure for the quantum era. Through these efforts, we establish the foundation for enduring security in networked systems amid the challenges of the quantum era.
The advent of quantum computing poses a significant challenge to classical cryptographic protocols, threatening to undermine the security of widely used security systems like RSA, ECC, and AES. This paper investigates the vulnerabilities of traditional public-key and symmetric cryptographic schemes to quantum decryption techniques, such as Shor’s and Grover’s algorithms, while analyzing the efficacy of post-quantum cryptography (PQC) as a mitigation strategy. Through a review of current literature and simulations of quantum attacks on legacy protocols, this research identifies critical gaps in preparedness and evaluates emergent quantumresistant solutions. The findings highlight the immediate risks of “store now, decrypt later” attacks, emphasizing the importance of transitioning to PQC algorithms. Despite promising advances, challenges related to performance, interoperability, and standardization remain. This study concludes with a call for collaborative efforts in research, policy development, and widespread adoption of quantum-safe practices to ensure the resilience of digital communications in the quantum era.
The Domain Name System (DNS), an important component of the Internet infrastructure, is vulnerable to various attacks that can jeopardize the security and privacy of Internet communications. While DNS over TLS (DoT) is widely used to improve DNS security, the advent of quantum computing poses a significant threat to the underlying cryptographic algorithms used in TLS. In this paper, we propose a comprehensive framework for DNS over Post-Quantum TLS (DoPQT) to address this challenge. Our framework integrates post-quantum cryptographic algorithms into DoT, ensuring robust security against both classical and quantum attacks. We introduce a hybrid key exchange mechanism and post-quantum authentication procedures to protect the confidentiality, integrity, and authenticity of DNS traffic. DoPQT has the potential to offer comparable performance to existing solutions while demonstrating superior quantum resistance. This research contributes to the development of a secure and resilient DNS infrastructure in the post-quantum era. It has been observed that the handshake process is most affected by increased DNS queries and is the main source of the bottleneck. On the other hand, the percentage loss in throughput when using the PQC algorithm (i.e., MLKEM) is about 33-40% for different DNS queries.
The emergence of quantum computing poses a formidable security challenge to network protocols traditionally safeguarded by classical cryptographic algorithms . This paper provides an exhaustive analysis of vulnerabilities introduced by quantum computing in a diverse array of widely utilized security protocols across the layers of the TCP/IP model, including TLS , IPsec , SSH, PGP, and more. Our investigation focuses on precisely identifying vulnerabilities susceptible to exploitation by quantum adversaries at various migration stages for each protocol while also assessing the associated risks and consequences for secure communication. We delve deep into the impact of quantum computing on each protocol, emphasizing potential threats posed by quantum attacks and scrutinizing the effectiveness of post-quantum cryptographic solutions. Through carefully evaluating vulnerabilities and risks that network protocols face in the post-quantum era, this study provides invaluable insights to guide the development of appropriate countermeasures. Our findings contribute to a broader comprehension of quantum computing’s influence on network security and offer practical guidance for protocol designers, implementers, and policymakers in addressing the challenges stemming from the advancement of quantum computing. This comprehensive study is a crucial step towards fortifying the security of networked environments in the quantum age.
The Domain Name System (DNS) plays a foundational role in Internet infrastructure, yet its core protocols remain vulnerable to compromise by quantum adversaries. As cryptographically relevant quantum computers become a realistic threat, ensuring DNS confidentiality, authenticity, and integrity in the post-quantum era is imperative. In this paper, we present a comprehensive system-level study of post-quantum DNS security across three widely deployed mechanisms: DNSSEC, DNS-over-TLS (DoT), and DNS-over-HTTPS (DoH). We propose Post-Quantum Cryptographic (PQC)-DNS, a unified framework for benchmarking DNS security under legacy, post-quantum, and hybrid cryptographic configurations. Our implementation leverages the Open Quantum Safe (OQS) libraries and integrates lattice- and hash-based primitives into BIND9 and TLS 1.3 stacks. We formalize performance and threat models and analyze the impact of post-quantum key encapsulation and digital signatures on end-to-end DNS resolution. Experimental results on a containerized testbed reveal that lattice-based primitives such as Module-Lattice-Based Key-Encapsulation Mechanism (MLKEM) and Falcon offer practical latency and resource profiles, while hash-based schemes like SPHINCS+ significantly increase message sizes and processing overhead. We also examine security implications including downgrade risks, fragmentation vulnerabilities, and susceptibility to denial-of-service amplification. Our findings inform practical guidance for deploying quantum-resilient DNS and contribute to the broader effort of securing core Internet protocols for the post-quantum future.