Securing tomorrow’s Secrets Today:A Post-Quantum Cryptography Defense Framework Using CRYSTALS-Dilithium and CRYSTALSKyber for Email Security in Resource-Constrained Institutions.
My research focuses on developing a post-quantum cryptography (PQC) framework for securing institutional email systems against future quantum computing threats, particularly the Harvest-Now, Decrypt-Later (HNDL) attack. The study addresses a critical cybersecurity challenge faced by governments, healthcare institutions, universities, and organizations that rely on long-term confidentiality of sensitive communications.The proposed framework integrates the NIST-standardized ML-KEM-768 (formerly CRYSTALS-Kyber) for key encapsulation and ML-DSA-65 (formerly CRYSTALS-Dilithium) for digital signatures to provide quantum-resistant encryption and authentication. A hybrid cryptographic architecture combines PQC with AES-256-GCM to secure email content while maintaining compatibility with existing communication systems.A prototype was implemented using the Open Quantum Safe (liboqs v0.15.0) library and evaluated on resource-constrained hardware representative of institutions in developing countries (3-core Intel Core i5 processor and 4 GB RAM). Performance was measured over 100 benchmark iterations, comparing PQC algorithms with traditional RSA-2048 and ECDSA. The results showed that ML-KEM-768 achieved significantly faster key generation than RSA-2048 while maintaining low computational overhead, requiring less than 2% CPU utilization, under 8 MB of memory, and an end-to-end email processing latency of only 11–16 ms.The research introduces a formally specified HNDL threat model, evaluates the security implications of quantum-resistant cryptography in constrained environments, and discusses deployment considerations including certificate management, side-channel resistance, hybrid migration strategies, and institutional adoption. The work also identifies current limitations, such as the absence of forward secrecy and live production deployment, and proposes future enhancements including PQC-based key ratcheting, TLS integration, and real-world pilot deployments.This research contributes an end-to-end, standards-aligned, open-source framework demonstrating that post-quantum email security is practical and computationally feasible for resource-constrained institutions, particularly in developing economies, providing a pathway toward secure communication infrastructures resilient to future quantum attacks.
My research focuses on developing a post-quantum cryptography (PQC) framework for securing institutional email systems against future quantum computing threats, particularly the Harvest-Now, Decrypt-Later (HNDL) attack. The study addresses a critical cybersecurity challenge faced by governments, healthcare institutions, universities, and organizations that rely on long-term confidentiality of sensitive communications.The proposed framework integrates the NIST-standardized ML-KEM-768 (formerly CRYSTALS-Kyber) for key encapsulation and ML-DSA-65 (formerly CRYSTALS-Dilithium) for digital signatures to provide quantum-resistant encryption and authentication. A hybrid cryptographic architecture combines PQC with AES-256-GCM to secure email content while maintaining compatibility with existing communication systems.A prototype was implemented using the Open Quantum Safe (liboqs v0.15.0) library and evaluated on resource-constrained hardware representative of institutions in developing countries (3-core Intel Core i5 processor and 4 GB RAM). Performance was measured over 100 benchmark iterations, comparing PQC algorithms with traditional RSA-2048 and ECDSA. The results showed that ML-KEM-768 achieved significantly faster key generation than RSA-2048 while maintaining low computational overhead, requiring less than 2% CPU utilization, under 8 MB of memory, and an end-to-end email processing latency of only 11–16 ms.The research introduces a formally specified HNDL threat model, evaluates the security implications of quantum-resistant cryptography in constrained environments, and discusses deployment considerations including certificate management, side-channel resistance, hybrid migration strategies, and institutional adoption. The work also identifies current limitations, such as the absence of forward secrecy and live production deployment, and proposes future enhancements including PQC-based key ratcheting, TLS integration, and real-world pilot deployments.This research contributes an end-to-end, standards-aligned, open-source framework demonstrating that post-quantum email security is practical and computationally feasible for resource-constrained institutions, particularly in developing economies, providing a pathway toward secure communication infrastructures resilient to future quantum attacks.
This study evaluates the feasibility of post-quantum cryptographic (PQC) algorithms in mitigating "Harvest Now, Decrypt Later" (HNDL) attacks as quantum computing advances threaten classical encryption. Using datasets from the NIST Post-Quantum Cryptography Project, Deloitte’s PQC Adoption Survey, and IBM & Google Quantum Roadmaps, the study applied statistical modeling, Monte Carlo simulations, and ARIMA forecasting to assess PQC security resilience, adoption readiness, and quantum decryption feasibility. The findings indicate that CRYSTALS-Kyber and CRYSTALS-Dilithium outperform RSA-2048 and ECC-256 in quantum resistance, with attack cost thresholds exceeding 1.91×10101.91 \times 10^{10}1.91×1010 compared to 2.24×1082.24 \times 10^82.24×108 for RSA-2048. Industry adoption varies, with government PQC implementation at 79%, finance at 67%, and healthcare lagging at 48%. Quantum decryption probability remains negligible until 2029 but rises to 78.6% by 2033. This study addresses the critical challenge of post-quantum cryptographic (PQC) adoption amid growing quantum threats, particularly "Harvest Now, Decrypt Later" (HNDL) attacks. By evaluating PQC security resilience, industry adoption, and quantum decryption feasibility, the findings provide strategic insights for policymakers and cybersecurity experts. Highlighting the vulnerabilities of CRYSTALS-Kyber to side-channel attacks, this research underscores the need for continuous cryptanalysis, hybrid encryption models, and adaptive security frameworks to future-proof data.Organizations must accelerate PQC adoption, integrate hybrid cryptographic models, enforce regulatory policies, and sustain cryptanalysis efforts to ensure long-term security.
As the advent of quantum computing threatens traditional cryptographic protocols, hybrid classical-quantum secure communication infrastructures have emerged as a critical frontier in cybersecurity. This paper explores the integration of post-quantum cryptographic algorithms—specifically CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures—into hybrid communication architectures designed to resist quantum-level attacks. Leveraging lattice-based cryptographic primitives, both algorithms have been selected for standardization by NIST due to their robust security and performance characteristics. This study evaluates their implementation in real-world communication stacks, assesses latency and throughput under hybrid channel configurations, and proposes a layered security architecture combining classical and quantum-resilient mechanisms. Furthermore, it examines key management, digital trust, and infrastructure scalability in a post-quantum context. Simulation results and hardware-based validations are used to determine practical deployment feasibility in critical sectors such as finance, defense, and healthcare. The findings offer a comprehensive framework for securing data in transitional computing eras, ensuring forward secrecy, and maintaining operational integrity against future adversarial quantum threats.
The accelerating development of large-scale quantum computers poses an existential threat to the public-key cryptographic infrastructure that underpins modern digital communication. Algorithms such as RSA and Elliptic Curve Cryptography (ECC), which currently secure internet traffic, digital signatures, and data-at-rest, are vulnerable to Shor's algorithm running on a sufficiently powerful quantum processor. In response, the U.S. National Institute of Standards and Technology (NIST) finalized the first post-quantum cryptography (PQC) standards in August 2024—FIPS 203 (ML-KEM/Kyber), FIPS 204 (ML-DSA/Dilithium), and FIPS 205 (SLH-DSA/SPHINCS+)—marking the beginning of a global migration toward quantum-resistant cryptography. This paper presents a hybrid C++/Python secure storage and communication platform (source code available at https://github.com/Sujithb128989/Quantum-Safe-Backend) that implements NIST-selected PQC algorithms in a production-oriented architecture. The backend employs CRYSTALS-Dilithium5 for quantum-resistant transport authentication, Kyber for key encapsulation, and AES-256-GCM for symmetric encryption-at-rest, delivered through a dual-stack gRPC/HTTP architecture containerized with Docker. We describe the system's design rationale, detail the cryptographic pipeline from certificate generation to atomic key rotation, and discuss the engineering challenges of integrating post-quantum primitives into real-world software systems.
The move toward cloud-provided-software-as-a-service (SaaS) key management systems (KMS) introduces new, pressing security threats of quantum computing.The novelty of this work is to hybrid combine CRYSTALS-Kyber, NIST standardised, and Dilithium algorithm both for key encapsulation and digital signature that offer a scalable quantum-resilient KMS as a SaaS in a pragmatic scenario.Major contributions include a real-world deployment architecture, describing REST API workflows for on-they-fly key generation and validation, carrying out performance comparison with classical KMS benchmarks showing security improvements and future-proofing of data protection.These systems rely primarily on traditional public-key cryptography, which is susceptible to attacks by large quantum computers.This poses an immediate security threat, particularly in the context of long-term data confidentiality, to which "Harvest Now, Decrypt Later" (HNDL) attacks are a prevalent threat.To mitigate this issue, we propose a practical and secure KMS architecture for quantum era that is provided as SaaS.We propose the use of standard post-quantum cryptography (PQC) using the NIST-approved CRYSTALS suite.It uses a hybrid cryptographic approach to deliver optimal performance and security.It generates AES-256 symmetric keys on-the-fly using a secured REST API.Then the keys are encapsulated with CRYSTALS-Kyber for post-quantum secret protection.For guarantees on integrity and authenticity, operations are digitally signed with CRYSTALS-Dilithium.The encapsulated keys and their associated signatures are secure in the cloud -which only you can access -via a unique identifier alongside robust OAuth2-based sign-ins.By integrating these PQC ingredients into an existing SaaS KMS blueprint, this study provides a gentle learning curve to organizations.It preserves simple and scalable use of modern cloud services while making sure that cryptographic key management is sufficiently secure against emerging threats such as those from quantum computing.This method is critically important, a practical means of maintaining long-term trust and protecting data.
The development of quantum computing technology is progressing very quickly, which poses a great threat to classical cryptographic algorithms like RSA and ECC, as they are based on mathematical problems that can be easily solved using quantum computing technology. To overcome the threat of quantum computing technology, the need for PQC algorithms like CRYSTALS Kyber, CRYSTALS Dilithium, Falcon, and SPHINCS+, which are standardized or recommended by NIST, has become essential in the era of cybersecurity. The feasibility of these algorithms in real time applications is the main focus of this thesis. A mixed approach is adopted for this purpose. Benchmark experiments were performed using the Open Quantum Safe library and PQC enabled OpenSSL for key generation, encryption, decryption, signature generation, signature verification, and TLS handshakes. Simulated environment and cloud environment were used for this purpose. Moreover, case studies were also conducted for cloud computing, financial sector, and IoT applications. Additionally, threat modeling is also performed for assessing the migration risks, i.e., “harvest now decrypt later.” The results indicate that the lattice-based methods, like Kyber and Dilithium, offer a robust trade off in terms of performance and security, albeit with increased key and signature sizes compared to classical methods. Hash based methods, like SPHINCS+, offer robust security, albeit with significant performance and size overheads, indicating that they are best used in specific circumstances. Hybrid approaches, using classical as well as quantum methods, were indicated as viable in the transition from classical to quantum methods, especially in circumstances that require backward compatibility. The paper concludes that NIST standardized PQC algorithms are technically viable for contemporary applications, especially in cloud computing and high-performance computing. However, for large-scale implementation, proper engineering and monitoring of developments in crypt analysis need to be performed. Future research should be directed towards implementation optimization, migration frameworks, and further studies in real-world implementations, especially for resource-constrained IoT and legacy system applications.
As quantum computing advances, modern cryptographic standards face an existential threat, necessitating a transition to post-quantum cryptography (PQC). The National Institute of Standards and Technology (NIST) has selected CRYSTALS-Kyber and CRYSTALS-Dilithium as standardized PQC algorithms for secure key exchange and digital signatures, respectively. This study conducts a comprehensive performance analysis of these algorithms by benchmarking execution times across cryptographic operations such as key generation, encapsulation, decapsulation, signing, and verification. Additionally, the impact of AVX2 optimizations is evaluated to assess hardware acceleration benefits. Our findings demonstrate that Kyber and Dilithium achieve efficient execution times, outperforming classical cryptographic schemes such as RSA and ECDSA at equivalent security levels. Beyond technical performance, the real-world deployment of PQC introduces challenges in telecommunications networks, where large-scale infrastructure upgrades, interoperability with legacy systems, and regulatory constraints must be addressed. This paper examines the feasibility of PQC adoption in telecom environments, highlighting key transition challenges, security risks, and implementation strategies. Through industry case studies, we illustrate how telecom operators are integrating PQC into 5G authentication, subscriber identity protection, and secure communications. Our analysis provides insights into the computational trade-offs, deployment considerations, and standardization efforts shaping the future of quantum-safe cryptographic infrastructure.