Introduction Zero-round-trip-time (0-RTT) resumption is a central performance feature of TLS 1.3, cutting reconnection latency by letting clients attach early application data to pre-shared keys derived from previously issued session tickets. Latency-sensitive deployments—web services, API gateways, IoT fleets-rely heavily on this mechanism. However, today's session tickets derive their symmetric keys from a purely classical X25519 exchange, leaving them exposed to Harvest-Now-Decrypt-Later (HNDL) attacks: an adversary who records the ticket exchange today gains the ability to decrypt all associated 0-RTT early data retroactively once a cryptographically capable quantum machine exists. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), which folds a hybrid X25519 + ML-KEM-768 encapsulation directly into the NewSessionTicket lifecycle, rendering tickets quantum-safe without adding any extra round trip. Methods At the core of HQRT is a Hybrid Resumption Master Secret, constructed jointly from classical and post-quantum shared secrets and integrated into the existing TLS 1.3 key schedule as a drop-in addition. The paper supports this construction with a formal, game-based security model proving HNDL resistance, and extends the replay-protection analysis to quantum adversaries. A working proof-of-concept was implemented on OpenSSL 3.x via the OQS provider, with benchmarking conducted across server, desktop, and IoT hardware. Results The latency penalty introduced by HQRT is just 4–9%, with a throughput loss of 6.5% relative to classical 0-RTT-a stark contrast to the 81–89% overhead imposed by full post-quantum handshakes. Across multi-session workloads, the amortised overhead falls by 34–97%, and latency-distribution tails diverge from the classical baseline by under a millisecond. Discussion These results demonstrate that HQRT offers a deployable, incremental route to quantum-safe TLS resumption, delivering HNDL resistance and quantum-safe replay protection at a fraction of the cost of full post-quantum handshakes, while leaving existing certificate infrastructure untouched.
Introduction Zero-round-trip-time (0-RTT) resumption is a central performance feature of TLS 1.3, cutting reconnection latency by letting clients attach early application data to pre-shared keys derived from previously issued session tickets. Latency-sensitive deployments—web services, API gateways, IoT fleets-rely heavily on this mechanism. However, today's session tickets derive their symmetric keys from a purely classical X25519 exchange, leaving them exposed to Harvest-Now-Decrypt-Later (HNDL) attacks: an adversary who records the ticket exchange today gains the ability to decrypt all associated 0-RTT early data retroactively once a cryptographically capable quantum machine exists. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), which folds a hybrid X25519 + ML-KEM-768 encapsulation directly into the NewSessionTicket lifecycle, rendering tickets quantum-safe without adding any extra round trip. Methods At the core of HQRT is a Hybrid Resumption Master Secret, constructed jointly from classical and post-quantum shared secrets and integrated into the existing TLS 1.3 key schedule as a drop-in addition. The paper supports this construction with a formal, game-based security model proving HNDL resistance, and extends the replay-protection analysis to quantum adversaries. A working proof-of-concept was implemented on OpenSSL 3.x via the OQS provider, with benchmarking conducted across server, desktop, and IoT hardware. Results The latency penalty introduced by HQRT is just 4–9%, with a throughput loss of 6.5% relative to classical 0-RTT-a stark contrast to the 81–89% overhead imposed by full post-quantum handshakes. Across multi-session workloads, the amortised overhead falls by 34–97%, and latency-distribution tails diverge from the classical baseline by under a millisecond. Discussion These results demonstrate that HQRT offers a deployable, incremental route to quantum-safe TLS resumption, delivering HNDL resistance and quantum-safe replay protection at a fraction of the cost of full post-quantum handshakes, while leaving existing certificate infrastructure untouched.
TLS 1.3 zero-round-trip-time (0-RTT) resumption reduces reconnection latency by allowing clients to transmit early application data using pre-shared keys (PSK) derived from previously established session tickets. This mechanism is pivotal for latency-sensitive web services, API gateways, and IoT applications. However, the cryptographic foundations of current session tickets—symmetric keys derived from classical X25519 key exchange—are fundamentally vulnerable to Harvest-Now-Decrypt-Later (HNDL) quantum attacks: an adversary capturing session ticket exchanges today can retroactively decrypt PSKs and all 0-RTT early data once a cryptographically relevant quantum computer (CRQC) becomes available. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), a protocol-level framework that embeds a hybrid X25519 + ML-KEM-768 key encapsulation into the TLS 1.3 NewSessionTicket lifecycle, producing quantum-safe session tickets without additional handshake round trips. HQRT defines a Hybrid Resumption Master Secret (HRMS) derived from both classical and post-quantum shared secrets and integrates it into the TLS 1.3 key schedule as a drop-in extension of the Resumption Master Secret. We provide: (i) a formal security model for quantum-safe 0-RTT resumption with game-based HNDL-resistance proofs; (ii) an extended replay protection analysis under quantum adversaries; (iii) a proof-of-concept implementation on OpenSSL 3.x with the OQS provider; and (iv) comprehensive benchmarks across server, desktop, and IoT platforms demonstrating only 4–9% latency overhead and 6.5% throughput reduction relative to classical 0-RTT, versus the 81–89% overhead of full post-quantum handshakes. A cumulative cost-benefit analysis over multi-session workloads demonstrates 34–97% amortised overhead reduction compared to per-reconnection PQC handshakes, with latency distributions exhibiting sub-millisecond tail divergence from classical baselines. HQRT provides a practical, incrementally deployable pathway for quantum-safe TLS resumption compatible with existing certificate infrastructure.
If two parties want to communicate over an insecure channel, they typically execute an interactive cryptographic handshake to establish a shared secret, before any application data is sent. In contrast, zero round-trip time (0-RTT) protocols allow a sender to immediately send encrypted application data (0-RTT data) to a receiver without executing an interactive handshake. One of the major challenges when designing 0-RTT protocols is to guarantee forward security for the 0-RTT data. Forward security ensures that compromise of a communicating party does not impact security of past communications. However, the lack of interactivity in 0-RTT protocols renders it difficult to achieve forward security for the 0-RTT data. Only recently, novel techniques to overcome this challenge have been discovered. This thesis investigates design approaches to 0-RTT protocols and proposes new constructions of 0-RTT protocols with forward security for all sent data. This thesis starts with a discussion on the concept of forward security in noninteractive settings. Traditionally, forward security can be achieved if communication partners interactively agree on fresh secrets. However, this view limits the understanding of what forward security should mean in a non-interactive setting. Hence, we propose new terminology for a unified treatment of forward security, capturing both interactive and non-interactive communication settings. The remainder of this thesis can be split into two parts. The first part focuses on the design of 0-RTT key exchange protocols. We investigate how to build 0-RTT key exchange protocols from Bloom filter key encapsulation mechanisms, and describe the first mechanism with constant-size ciphertexts. We then use this scheme to construct the first multi-hop 0-RTT protocol for efficient connection establishment in the context of anonymous communications. The second part of this thesis focuses in 0-RTT session resumption protocols. Session resumption protocols require an already established secret shared between sender and recipient. This secret can then be used to re-establish a secure connection. Despite prior belief, we present the first 0-RTT session resumption protocol that indeed achieves forward security for all messages. In contrast to existing 0-RTT key exchange protocols, our 0-RTT session resumption protocol is highly efficient as it only relies on symmetric primitives. We show that our protocol can be incorporated into the recently standardized TLS 1.3 handshake without modifications to client-side implementations. This means that our protocol is immediately deployable by content providers without requiring changes to the standard.
The advancement of quantum computing creates a big threat to classical cryptographic protocols, including TLS, which is responsible for secure internet communications. While recent industry and academic efforts have focused on integrating lattice-based post-quantum key encapsulation mechanisms (KEMs) such as Kyber+X25519 into hybrid TLS handshakes, these approaches often prioritize performance at the cost of cryptanalytic diversity. Code-based KEMs, despite their proven security measure they remain underexplored in hybrid frameworks due to some limitations like large key sizes and integration complexity. This paper proposes a novel hybrid TLS framework that explicitly incorporates code-based post-quantum cryptography—specifically McEliece—alongside classical key exchange mechanisms. The framework introduces a dual-handshake mechanism, adaptive parameter selection, and seamless fallback negotiation, enabling flexible deployment across heterogeneous networks while ensuring backward compatibility. Integration with Quantum Random Number Generators (QRNGs) and multifactor authentication further increases entropy quality and session security. We implemented and evaluated the framework using an OpenSSL-OQS integration. We measure handshake latency, CPU utilization, memory usage, and throughput across emulated and real-world testbeds. Results show that the proposed hybrid approach achieves up to 30% lower latency and significantly reduced resource overhead compared to pure post-quantum TLS variants, while maintaining near-classical efficiency levels. Mathematical modeling formalizes these trade-offs which offers a foundation for optimizing deployment in both resource-constrained IoT devices and high-performance servers. By advancing cryptographic diversity and aligning with emerging NIST and IETF standardization efforts, the proposed framework provides a practical pathway toward quantum-resilient secure communication.It shows that code-based post-quantum cryptography can be added to current TLS systems without any problems, keeping security, performance, and compatibility in mind as we get ready for the quantum age.
Quantum computing poses a significant threat to classical cryptographic schemes widely used in modern networks, particularly RSA and ECC, which are vulnerable to Shor’s algorithm. To address this challenge, this study conducts a post-quantum security evaluation of TLS 1.3 by implementing hybrid X25519+Kyber key exchange and ML-DSA digital signatures. The objective is to assess the performance, overhead, and effectiveness of hybrid TLS in ensuring long-term data confidentiality within enterprise environments. The research method involves building a server–client testbed using OpenSSL with the oqs-provider, applying network load simulations under various latencies, and measuring key metrics including handshake latency, CPU utilization, certificate size, and client compatibility. The results indicate that hybrid TLS 1.3 with X25519+Kyber introduces only moderate handshake latency, while ML-DSA increases certificate size but remains manageable for deployment in modern enterprise systems. The conclusion of this study is that combining X25519+Kyber with ML-DSA offers an effective transition path towards quantum-safe networks without significantly sacrificing system performance..
The accelerating maturation of quantum computing technology-exemplified by IBM's Eagle, Osprey, and Condor processors surpassing 1,000+ physical qubits-represents a strategic and existential threat to the public-key cryptographic foundations of modern digital infrastructure.The mathematical intractability assumptions underlying RSA (integer factorization), Diffie-Hellman (discrete logarithm), and Elliptic Curve Cryptography (elliptic curve discrete logarithm problem) are rendered computationally negligible by Shor's polynomial-time quantum algorithm.Simultaneously, Grover's unstructured quantum search algorithm halves the effective security of all symmetric encryption schemes, requiring doubling of key lengths.The consequent "Harvest Now, Decrypt Later" (HNDL) attack paradigm-wherein encrypted communications are archived today for future quantum decryption-transforms post-quantum cryptographic migration from a future concern into an immediate operational imperative for all communications with confidentiality lifetimes exceeding five years.This paper presents a comprehensive Hybrid Post-Quantum Cryptographic (HPQC) framework that systematically integrates NIST-finalized post-quantum algorithms-CRYSTALS-Kyber (FIPS 203) for Key Encapsulation Mechanisms, CRYSTALS-Dilithium (FIPS 204) and SPHINCS+ (FIPS 205) for digital signatureswith classical cryptographic primitives (ECDH P-256/X25519, ECDSA, AES-256-GCM) in a layered, crypto-agile, formally proven, and operationally deployable security architecture.Twenty mathematical formulae are derived and presented, covering Shor/Grover complexity bounds, Module-LWE and Module-SIS hardness parameters, hybrid HKDF-SHA-512 key derivation, IND-CCA2 and EUF-CMA security reductions, forward secrecy entropy bounds, and crypto-agility rotation period calculations.Formal Theorems 1 and 2 establish the security of the hybrid KEM and hybrid signature constructions respectively.Simulated performance benchmarks across three hardware tiers (Intel Xeon server, ARM Cortex-A72 edge gateway, ARM Cortex-M4 IoT device) demonstrate 23-31% TLS 1.3 handshake latency overhead over classical baselines with full quantum resistance.Seven comparative tables and five architectural figures support the engineering-ready deployment guidance provided across 5G/6G, massive IoT, SDN, and cloud-native environments.A four-phase crypto-agile migration roadmap aligned with NIST FIPS 203/204/205, NIST SP 800-208, NSA CNSA 2.0, BSI TR-02102, and ENISA PQC guidance is presented for enterprise network operators and security architects.
TLS 1.3 is a crucial protocol for securing modern internet communications. To facilitate a smooth transition to post-quantum security, hybrid key exchange, which combines classical key exchange algorithms with post-quantum key encapsulation mechanisms (KEMs), is proposed to enhance the security of the current TLS 1.3 handshake. However, existing drafts and implementations of hybrid key exchange for TLS 1.3 primarily rely on CCA-secure KEMs (i.e., secure against chosen-ciphertext attacks) based on the Fujisaki-Okamoto (FO) transform. The re-encryption step in their decapsulation algorithms not only introduces additional performance overhead but also raises the risk of side-channel attacks. Although Huguenin-Dumittan and Vaudenay (Eurocrypt 2022) and Zhou et al. (Asiacrypt 2024) demonstrated that the weaker CPA-secure KEMs (i.e., secure against chosen-plaintext attacks) suffice for constructing a secure TLS 1.3 handshake, their analyses were limited to single-KEM settings and did not consider the hybrid key exchange scenario. This work challenges the necessity of CCA security by proving that CPA-secure KEMs are sufficient for the TLS 1.3 handshake even in the hybrid key exchange setting. We provide the first formal security proofs for this claim, covering both the classical random oracle model (ROM) and the quantum random oracle model (QROM), thereby ensuring security against quantum adversaries. To validate the practical benefits, we conduct an extensive performance evaluation based on the latest OpenSSL implementation. Our results show that using CPA-secure KEMs yields up to 44.8% performance improvement at the key exchange layer and up to approximately 9% acceleration for the full TLS 1.3 handshake. Beyond performance gains, this approach reduces the codebase's attack surface by eliminating the re-encryption step, thereby mitigating a class of side-channel vulnerabilities. Our work positions CPA-secure KEMs as a secure, efficient, and practical alternative for standardizing and deploying post-quantum TLS 1.3 even with hybrid key exchange.