This paper describes a hybrid key-encapsulation mechanism (KEM): a way for two parties to agree on a shared 32-byte secret that stays safe as long as either of two very different building blocks remains unbroken. The first building block is classical RSA-2048. The second is ML-KEM-768, the lattice-based KEM that NIST standardized as FIPS 203. We run both, then mix their two secrets with HKDF-SHA-256 to produce one session key. The pay-off is simple: an attacker has to break both RSA and ML-KEM to learn the session key, so the scheme protects you today (when RSA is strong) and continues to protect you after a quantum computer breaks RSA (when ML-KEM carries the load). A second, independent idea appears here only as an engineering optimization: the Furui 6n±1 sieve, a fast way to generate RSA primes. We are explicit that the sieve contributes nothing to security — it just makes classical key generation cheaper during the migration period, when systems keep minting new RSA keys. We prove this carefully so that no reader mistakes a performance trick for a security feature. The paper is written for engineers who want to deploy a hybrid KEM correctly. The main text explains the construction, the threat model, and how to implement it safely. The appendices give the full formal security reduction, the statistical validation of the sieve, and a reproducible benchmark methodology for readers who want the underlying detail.
This paper describes a hybrid key-encapsulation mechanism (KEM): a way for two parties to agree on a shared 32-byte secret that stays safe as long as either of two very different building blocks remains unbroken. The first building block is classical RSA-2048. The second is ML-KEM-768, the lattice-based KEM that NIST standardized as FIPS 203. We run both, then mix their two secrets with HKDF-SHA-256 to produce one session key. The pay-off is simple: an attacker has to break both RSA and ML-KEM to learn the session key, so the scheme protects you today (when RSA is strong) and continues to protect you after a quantum computer breaks RSA (when ML-KEM carries the load). A second, independent idea appears here only as an engineering optimization: the Furui 6n±1 sieve, a fast way to generate RSA primes. We are explicit that the sieve contributes nothing to security — it just makes classical key generation cheaper during the migration period, when systems keep minting new RSA keys. We prove this carefully so that no reader mistakes a performance trick for a security feature. The paper is written for engineers who want to deploy a hybrid KEM correctly. The main text explains the construction, the threat model, and how to implement it safely. The appendices give the full formal security reduction, the statistical validation of the sieve, and a reproducible benchmark methodology for readers who want the underlying detail.
Classical public-key cryptography, mainly RSA, is at risk from the emergence of quantum computers. A complete shift to Post-Quantum Cryptography (PQC) faces vulnerabilities due to implementation and trust issues, despite NIST's approval of standards such as ML-KEM (Kyber). This paper presented a performance and bandwidth trade-off study of a proposed Hybrid Key Encapsulation Mechanism that fused the NIST-standardized ML-KEM-768 (FIPS 203) with the traditional RSA-3072. Two separate secret keys S1 and S2 were produced and encapsulated utilizing both classical and post-quantum public keys in our dual-layered model. In order to create a strong session key that ensures trust transition and backward compatibility with current network infrastructures, these secrets were then combined using a Hybrid Key Derivation Function (HKDF). In comparison to standalone systems, the study assessed the computational cost and communication latency brought about by this hybrid overhead. According to experimental data, the hybrid architecture offers a crucial security fail-safe against both classical flaws and future quantum threats without prohibitively high performance, even though it increases ciphertext size.
The emergence of fault-tolerant quantum computing poses an existential threat to classical public-key cryptographic systems, including RSA and Elliptic Curve Cryptography (ECC), through Shor's polynomial-time factorization algorithm. The Harvest Now, Decrypt Later (HNDL) attack paradigm further amplifies this threat by enabling adversaries to archive ciphertext today for future quantum-enabled decryption, rendering long-term data confidentiality immediately at risk. While the National Institute of Standards and Technology (NIST) finalized post-quantum cryptographic standards ML-KEM (FIPS 203) and ML-DSA (FIPS 204) in August 2024, their practical integration into complete application-level communication systems remains a largely unaddressed research gap. This paper presents QuantumShield, a hybrid post-quantum secure peer-to-peer communication platform that integrates ML-KEM-768 for quantum-safe key encapsulation, ML-DSA-65 for authenticated digital signatures, and AES-256-GCM for high-throughput symmetric encryption. Our primary research contribution is a rigorous empirical analysis of PQC integration overhead in a real-world communication pipeline, quantifying latency, key size, and security trade-offs against classical RSA-2048 and ECC-256 baselines under controlled experimental conditions. Experimental evaluation across 1,000 iterations demonstrates that ML-KEM-768 encapsulation completes in 2.8 ± 0.2 ms compared to 4.1 ± 0.3 ms for ECDH key agreement — a 32% latency reduction while providing NIST Level 3 post-quantum security. The complete secure transfer pipeline processes 1 MB files in under 22 ms on commodity hardware. The system further provides interactive cryptographic visualization, adversary threat modeling, tamper detection simulation, and a hybrid migration framework demonstrating practical transition from classical to post-quantum infrastructure. QuantumShield establishes that quantum-safe communication is not merely theoretical but deployable today with negligible performance compromise.
Hybrid key establishment runs a post-quantum key-encapsulation mechanism (KEM) alongside a classical Diffie-Hellman primitive, so that the session key stays secure while either component resists attack. This design is now standardized in the Transport Layer Security protocol, Secure Shell, and the Internet Key Exchange, with the standardized module-lattice KEM (ML-KEM) as the post-quantum component. A hybrid KEM secures the derived key, but not the integrity of the negotiation that selects which primitives are used. Full protocols authenticate that negotiation through a handshake transcript; a hybrid KEM deployed as a standalone drop-in primitive, or inside a minimal handshake without transcript authentication, inherits no such guarantee, and an active attacker can strip the post-quantum option. We ask what the key schedule alone must contain to make downgrade resilience a local property of the combiner. We give a game-based definition at the combiner layer and prove a two-sided separation: a combiner that ignores the transcript is downgraded with certainty, whereas one that binds the session key and the confirmation tag to a hash of the transcript blocks every such attempt, up to a term negligible for a 256-bit transcript hash. We also give an explicit strongest-link security bound. Using a calibrated cost model composed from published Cortex-M4 measurements, transcript binding adds one hash per party - about 11.8% of handshake computation but only 1.5% of radio-inclusive energy - and adds no messages or bytes on the wire. Every reported number is produced by a released harness that passes a 30-check validation gate.
Many companies are working to build a powerful quantum computer.Once quantum computer with large qubits is reality, asymmetric-key cryptosystem will be vulnerable for Shor's algorithm.The transition from one cryptosystem to another is very slow process and consumes many years.National Institute of Standards and Technology (NIST) is working on standardization of post-quantum cryptographic (PQC) algorithms.Security of current PQC algorithms cannot be fully verified today.So, in coming years we need to rely on both traditional algorithms and PQC algorithms.Hybrid mode consisting of one traditional algorithm and one post quantum algorithm is a best solution for smooth migration to quantum-safe cryptosystem.For key exchange, it means using two or more key exchange encapsulation algorithms for generating session key [Meher and Midhunchakkaravarthy (2019)].For authentication, it means using two or more digital signature algorithms [Meher and Midhunchakkaravarthy (2019)].There are number of approaches to combine secret key from traditional algorithm and PQC algorithm to make key encapsulation mechanism quantum-proof.In the paper we propose a new approach of using secret master key generated from one of the KEM algorithm as a salt for hashbased key derivation function (HKDF) to drive session keys from secret master key generated from another KEM algorithm.
Abstract The rapid progress of quantum computing threatens widely deployed public-key cryptosystems such as RSA and Diffie–Hellman, accelerating the transition toward post-quantum cryptography (PQC). During this migration, hybrid key encapsulation mechanisms (KEMs) that combine classical and post-quantum primitives are strongly recommended by standardization bodies and cybersecurity agencies. However, existing hybrid designs mainly focus on combining post-quantum KEMs with Diffie–Hellman–style constructions, while the systematic integration of standardized classical public-key encryption (PKE) schemes with post-quantum KEMs remains largely unexplored. In this work, we introduce two generic hybrid constructions, and , that combine a classical PKE scheme with a post-quantum KEM satisfying ciphertext second-preimage resistance (C2PRI). We prove that both constructions achieve IND-CCA security in the standard model. The refined construction additionally relies on a new security notion of the classical PKE scheme, termed partial ciphertext second-preimage resistance (PC2PRI), which captures second-preimage resistance when a designated ciphertext component is fixed. This new property enables shared-key derivation from only a designated PKE ciphertext component in . Finally, we provide a systematic analysis of the PC2PRI property for several standardized classical encryption schemes, including ECIES, PSEC, and SM2.
Introduction Session establishment, the process by which two parties authenticate each other and derive a shared secret key, forms the foundation for secure digital communication. Quantum computers threaten this foundation by breaking classical public-key primitives such as RSA and elliptic-curve Diffie–Hellman (ECDH), thereby enabling harvest-now–decrypt-later (HNDL) attacks that endanger long-term confidentiality. Methods This paper presents the design, implementation, and evaluation of an authenticated, quantum-resistant session protocol that replaces these vulnerable mechanisms with their post-quantum counterparts. The proposed protocol integrates ML-KEM-1024 (FIPS 203; CRYSTALS, Kyber) for ephemeral key exchange, ML-DSA-65 (FIPS 204; CRYSTALS, Dilithium) for endpoint authentication, and AES-256-GCM for symmetric protection. A transcript-bound HKDF–SHA3-256 key schedule and a 96-bit GCM nonce construction with conservative rekey limits are used to ensure forward secrecy, downgrade resistance, and message integrity. A Python/C prototype (PQClean ML-KEM-1024 with PyCryptodome AES-256-GCM) was benchmarked over 1,000 iterations on commodity hardware. Results The results show that sub-millisecond cryptographic overhead ML-KEM-1024 matches the performance of X25519 while vastly outperforming RSA-3072 in secure session establishment, and symmetric encryption remains cost effective. Nonces are unique 96-bit values, never reused across directions or beyond 2³² records, following NIST SP 800-38D; when nonce-misuse resistance is required, AES-256-GCM-SIV (RFC 8452) is supported as a drop-in alternative. Empirical tests under both local and WAN-emulated ( ≈ 40 ms RTT) network conditions confirm that the additional post-quantum cost maintains the handshake cryptographic latency in the 0.50–0.70 ms range. Discussion These results demonstrate that fully authenticated, forward-secure, quantum-resistant session negotiation is practical for real-world deployments.