Established threat-modeling frameworks contain no dedicated axis for quantum-compute threats. The individual threats are well studied, harvest-now-decrypt-later, Grover/Shor capability escalation, quantum side-channels, and circuit fingerprinting each have an active literature, but they are scattered across separate research communities and are not consolidated into a taxonomy usable within a standard data-flow threat-modeling process alongside STRIDE and LINDDUN. This work introduces QUANTA, a quantum-compute threat axis of seven categories (Q1 harvest-now-decrypt-later, Q2 superposition manipulation, Q3 cross-framework convergence attack, Q5 capability escalation, Q6 collapse side-channel, Q7 algorithm identification; Q4 is reassigned to the companion morphic axis). The contribution is stated narrowly and honestly: the novelty is the axis. The consolidation and framing, not the individual threats, most of which are prior art. The work further distinguishes, explicitly, between categories that can be demonstrated as executable attacks in a simulator environment and those that cannot. Two categories: superposition manipulation (Q2) and a cross-framework convergence attack (Q3) are demonstrated as real, reproducible exploits against a live PennyLane/Qiskit cross-framework verification engine, with a benign control that correctly reads as defended. The remaining categories require a cryptographically-relevant quantum computer or physical quantum hardware and are explicitly out of scope for empirical demonstration; they are not claimed. Of the two demonstrated, the convergence attack (Q3) is the one genuinely quantum-specific and apparently-novel threat: it exists only because two quantum frameworks with opposite qubit-ordering conventions are cross-checked, allowing a real divergence to hide behind a benign convention gap. Keywords and subjects:threat modeling; moving-target defense; polymorphism; cyber deception; morphic security; adversarial robustness; STRIDE; LINDDUN; reproducible security research; post-quantum signatures; MASQUE; MASQUARAIDE QUANTA is one of two original axes in the MASQUE threat model within the MASQUARAIDE project, alongside the morphic-polymorphic axis CHIRAGE. This deposit includes the paper, the attack-demonstration harness, the cross-framework engine, and machine-readable results, released with an SHA3-256 file manifest and an ML-DSA-65 (FIPS 204) signature over the manifest anchor, so that every verdict can be reproduced or refuted.
Established threat-modeling frameworks contain no dedicated axis for quantum-compute threats. The individual threats are well studied, harvest-now-decrypt-later, Grover/Shor capability escalation, quantum side-channels, and circuit fingerprinting each have an active literature, but they are scattered across separate research communities and are not consolidated into a taxonomy usable within a standard data-flow threat-modeling process alongside STRIDE and LINDDUN. This work introduces QUANTA, a quantum-compute threat axis of seven categories (Q1 harvest-now-decrypt-later, Q2 superposition manipulation, Q3 cross-framework convergence attack, Q5 capability escalation, Q6 collapse side-channel, Q7 algorithm identification; Q4 is reassigned to the companion morphic axis). The contribution is stated narrowly and honestly: the novelty is the axis. The consolidation and framing, not the individual threats, most of which are prior art. The work further distinguishes, explicitly, between categories that can be demonstrated as executable attacks in a simulator environment and those that cannot. Two categories: superposition manipulation (Q2) and a cross-framework convergence attack (Q3) are demonstrated as real, reproducible exploits against a live PennyLane/Qiskit cross-framework verification engine, with a benign control that correctly reads as defended. The remaining categories require a cryptographically-relevant quantum computer or physical quantum hardware and are explicitly out of scope for empirical demonstration; they are not claimed. Of the two demonstrated, the convergence attack (Q3) is the one genuinely quantum-specific and apparently-novel threat: it exists only because two quantum frameworks with opposite qubit-ordering conventions are cross-checked, allowing a real divergence to hide behind a benign convention gap. Keywords and subjects:threat modeling; moving-target defense; polymorphism; cyber deception; morphic security; adversarial robustness; STRIDE; LINDDUN; reproducible security research; post-quantum signatures; MASQUE; MASQUARAIDE QUANTA is one of two original axes in the MASQUE threat model within the MASQUARAIDE project, alongside the morphic-polymorphic axis CHIRAGE. This deposit includes the paper, the attack-demonstration harness, the cross-framework engine, and machine-readable results, released with an SHA3-256 file manifest and an ML-DSA-65 (FIPS 204) signature over the manifest anchor, so that every verdict can be reproduced or refuted.
The emergence of quantum computing represents one of the most significant paradigm shifts in the history of computation, with profound implications for offensive security and cyber warfare. This comprehensive research paper presents a systematic analysis of quantum-enabled offensive capabilities, novel attack vectors targeting quantum systems themselves, and the evolving threat landscape at the intersection of quantum computing and artificial intelligence. We introduce the Q-THREAT Framework, a novel temporal risk assessment model that quantifies the "Harvest Now, Decrypt Later" threat across different data confidentiality lifetimes and sectoral exposures. This research synthesizes and categorizes recently documented attack vectors including quantum Rowhammer exploits, timing-based side-channel vulnerabilities in cloud quantum services, and multi-tenant quantum system intrusions. Recent research demonstrates that current quantum cloud platforms from major providers including IBM, Rigetti, and others exhibit significant security vulnerabilities that could be exploited by adversaries to compromise computational integrity, extract sensitive circuit information, and disrupt quantum computations. Furthermore, we analyze the convergence of quantum computing and artificial intelligence as a force multiplier for offensive cyber operations. We present evidence that quantum machine learning algorithms can demonstrate competitive or superior performance in certain cybersecurity applications compared to classical approaches in controlled experimental settings, with recent studies reporting high accuracies in tasks such as malware detection and intrusion detection on benchmark datasets. Our analysis of nation-state quantum programs reveals an accelerating global quantum arms race with significant implications for national security. Based on our findings, we propose a comprehensive defensive framework incorporating post-quantum cryptographic standards, crypto-agility principles, and quantum-safe architectural patterns. This research contributes to the nascent field of quantum cybersecurity by establishing foundational threat models, identifying critical research gaps, and providing actionable recommendations for organizations preparing for the quantum era.
The advent of cryptographically relevant quantum computers (CRQCs) poses a fundamental threat to public-key cryptography securing modern digital communications. The most immediate danger is not direct decryption but the harvest-now-decrypt-later (HNDL) attack, wherein adversaries passively collect and archive encrypted traffic today for retrospective decryption once a CRQC becomes operational. This threat is structurally difficult to counter because the collection phase generates no host- or account-level signals detectable by conventional intrusion-detection systems.Simultaneously, migration to NIST-standardized post-quantum cryptography (PQC) specifically ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) introduces new vulnerabilities, including chosen-ciphertext side-channel attacks, fault-injection attacks, and protocol downgrade attacks arising during hybrid deployment periods.Existing security tooling addresses cryptographic inventory, encrypted-traffic anomaly detection, and PQC readiness as isolated problems, leaving a critical operational gap. To address this, we propose QCAD (Quantum Cryptographic Attack Detection), a unified multi-plane detection framework integrating four complementary detection planes: (A) flow-metadata behavioral analytics targeting HNDL collection indicators; (B) host- and protocol-level telemetry for PQC implementation flaws and downgrade attacks; (C) continuous crypto-agility monitoring with per-asset Mosca-inequality risk scoring; and (D) quantum-vulnerable deception canaries. These planes feed a unified correlation layer that maps observations to MITRE ATT&CK techniques and produces risk-ranked alerts.Evaluation against synthetic HNDL and PQC-attack benchmarks demonstrates that cross-plane fusion achieves a recall of 0.97 at a 5% false-positive rate (F1 = 0.90, ROC-AUC = 0.99), substantially outperforming any individual plane, confirming that no single observable captures all attack families.A key boundary condition remains: HNDL detection is inherently a probabilistic behavioral-inference problem, and interception occurring on transit infrastructure beyond the defender's perimeter may remain undetectable regardless of sensor deployment.
Abstract Quantum computing promises unprecedented computational power, posing fundamental threats and offering novel solutions to modern cryptography and cybersecurity. This survey paper reviews the rapidly evolving landscape of quantum-resistant and quantum-native security protocols. By analyzing foundational computational security models and the unique vulnerabilities introduced by quantum algorithms, this work proposes a structured evaluation framework for assessing the robustness of cryptographic systems. Ultimately, this survey highlights the critical transition from classical cryptographic infrastructures to quantum-secure paradigms, ensuring data confidentiality and integrity in the post-quantum era. Keywords: Quantum Computing, Security Protocol, Vulnerabilities 1.Introduction The emergence of quantum computing represents a paradigm shift in both computational physics and information technology. Quantum algorithms, particularly Shor's and Grover's algorithms, inherently challenge the mathematical foundations of classical public-key cryptography. As a result, securing communication channels against quantum-empowered adversaries has become an urgent priority for global infrastructure and national security. The motivation for this survey stems from the immediate need to bridge the gap between theoretical quantum mechanics and applied cybersecurity, ensuring that secure communications can withstand the computational leaps expected in the next decade. The core problem addressed in this paper is the comprehensive evaluation of security protocols under the threat model of a fully scalable quantum computer. The scope encompasses both post-quantum cryptographic (PQC) protocols and inherently quantum protocols, such as those relying on physical quantum states for key distribution. Existing classical approaches are insufficient for two main reasons. First, classical computational security models often rely on mathematical hardness assumptions (like integer factorization) that are rapidly undermined by theoretical quantum algorithms. Second, current software tools for designing secure classical protocols fail to account for quantum state phenomena, such as superposition and entanglement, rendering classical verification methods inadequate for quantum threat models. To address these structural challenges, this paper presents the following contributions: We provide a comprehensive taxonomy of vulnerabilities in both classical and quantum security protocols, mapping specific algorithmic advantages to protocol failure points. We propose a structured, multi-module framework for simulating, attacking, and verifying the security of hybrid quantum-classical cryptographic architectures. 2.Foundations of Classical Protocol Analysis The rigorous analysis of security protocols has traditionally relied on well-defined computational and symbolic models (Toorani, 2016). Researchers have extensively mapped out the taxonomy of attacks on authenticated key exchange (AKE) protocols and password-authenticated key exchange (PAKE) systems, establishing the mathematical groundwork for secure communication. The core idea of these foundational works is to establish provable security bounds that distinguish between information-theoretic and computational security. While this traditional paradigm offers strong mathematical guarantees against classical adversaries, its primary weakness is the failure to incorporate quantum attack vectors into the adversary's capability profile. Our work builds upon these classical models by explicitly injecting quantum algorithmic capabilities into standard protocol verification routines. 2.1.Quantum Algorithm Development and Simulation A significant body of literature focuses on the theoretical development and computational simulation of quantum algorithms capable of compromising or enhancing network security. Academic overviews have formalized algorithms like Grover's and Shor's, demonstrating their theoretical efficiency over classical counterparts in breaking cryptographic primitives. Furthermore, researchers have developed advanced design automation tools, such as decision diagrams, to simulate and verify complex quantum circuits. The strength of these simulation tools lies in their ability to model complex quantum states without requiring expensive physical hardware. However, a notable weakness is that they often abstract away the physical noise and hardware constraints that exist in real-world cryptographic deployments. This survey contextualizes these simulation techniques specifically within the framework of adversarial security testing, bridging theoretical algorithms with practical protocol defense. 3.Physical Implementations and Hardware Considerations Beyond algorithmic theory, the physical realization of quantum states directly impacts the practical security of any quantum protocol. Research into cavity quantum electrodynamics (QED) has demonstrated the complete mathematical construction of fundamental quantum gates, such as the controlled-controlled NOT gate, operating in the weak coupling regime (Fujii et al., 2005). Additionally, methods like Quantum Computed Moments (QCM) address the hardware constraints and noise typical of Near-Term Intermediate Scale Quantum (NISQ) devices, estimating ground state properties even with suboptimal trial states. The strength of this hardware-focused research is its realism regarding current technological limits; however, it often lacks a direct bridge to high-level network protocol verification. Compared to these purely physical studies, our survey integrates physical noise models into a generalized, software-driven protocol verification framework. 4.Approach To systematically evaluate quantum computing security protocols, we propose a structured Quantum Protocol Verification Framework (QPVF). The first module is the "Threat Modeling Engine," which defines the adversary's capabilities, ranging from classical data interception to full quantum memory manipulation. The second module is the "Quantum Circuit Synthesizer," which leverages decision diagram-based tools to translate high-level cryptographic operations into verifiable quantum circuits. The final module is the "Vulnerability Analyzer," which subjects the synthesized circuits to simulated quantum attacks, effectively distinguishing between idealized computational security and realistic hardware-constrained security. This modular pipeline allows security engineers to isolate specific vulnerabilities at both the abstract algorithmic layer and the simulated physical implementation layer. A key design choice in the QPVF is the utilization of decision diagrams for circuit simulation. This choice is predicated on the fact that decision diagrams efficiently handle the exponential state space of quantum systems during complex verification tasks (Wille et al., 2021). Furthermore, our framework explicitly incorporates noise models derived from current NISQ hardware limitations, ensuring that the security evaluation reflects realistic physical constraints rather than purely idealized environments (Vallury & Hollenberg, 2023). To evaluate this framework, we propose a hypothetical benchmarking plan using an artificially generated dataset of 10,000 hybrid quantum-classical cryptographic key exchanges. We will measure the success rate of simulated Grover-based brute-force attacks against varying key sizes and simulated environmental noise levels. This evaluation will compare the theoretical vulnerability threshold of a protocol against the practical threshold observed when quantum noise severely degrades the adversary's computational capabilities. The operational flow of the QPVF is designed to provide end-to-end security verification for next-generation networks. It bridges the critical gap between abstract protocol design and simulated hardware execution. The methodology can be summarized by the following numbered pipeline: Protocol Ingestion: The classical or quantum protocol is parsed into a standardized symbolic representation. Adversary Assignment: The user assigns a precise computational profile, selecting between traditional classical algorithms or advanced quantum capabilities. Circuit Generation: Protocol steps are mapped to equivalent quantum decision diagrams for scalable software simulation. Execution & Attack: Simulated quantum algorithms are executed against the mapped circuits to test for cryptographic resilience. Output Generation: The system outputs a vulnerability score and highlights specific failure points caused by either algorithmic weaknesses or simulated hardware noise. 5.Discussion The transition to quantum-secure protocols carries profound practical implications for global information infrastructure and enterprise deployment. Deploying these advanced protocols requires immense updates to existing software toolkits, as current digital systems are not fundamentally designed to handle the complexity of quantum states. Furthermore, organizations must consider the massive educational and workforce development efforts needed to train software engineers in quantum cryptography, a requirement already highlighted by international hackathons and educational initiatives. Integrating quantum-resistant protocols into complex domains like high-energy physics networks or global banking systems will require bridging the gap between theoretical quantum mechanics and applied computer engineering. Consequently, practical deployment must occur in hybrid phases, maintaining classical cryptographic wrappers while dedicated quantum infrastructure matures. Despite the robust theoretical design of proposed quantum security frameworks, several limitations and failure modes persist in practical applications. First, physical implementation attacks, such as side-channel attacks on the lasers and cavities used in physical quantum gates can bypass theoretical software security guarant
Abstract Classical computing architectures cannot reasonably solve computationally challenging problems, such as those of RSA public-key encryption, Diffie-Hellman key exchange, and elliptic curve cryptography, which form the cryptographic foundations of modern enterprise information security. Superposition and entanglement phenomena can be used to make quantum computers efficient in solving these problems, which are efficiently solved by Shor's algorithm and Grover's algorithm, and make existing cryptographic infrastructure entirely insecure. While quantum computing is fault-tolerant and still under development, the 'harvest now, decrypt later' threat model by which adversaries can harvest encrypted data now to be decrypted later when they can operate quantum systems signals that the cryptographic threat is present, not future. The objective of this study is to examine the current state of enterprise cryptographic readiness against threats in the quantum era and to create a model for organizational transition to the new cryptographic standards in the quantum era, which is called the Quantum-Resilient Security Architecture (QRSA) Framework. It uses a mixed-methods research methodology, consisting of a systematic literature review, an expert Delphi survey of 38 cybersecurity practitioners from 16 countries, and a qualitative analysis of five enterprise organizations, to examine the state of quantum-capable cryptographic protocols, the readiness of organizations in the technical, governance and capability aspects, and the most important enablers and blockers for the post-quantum migration. The key findings include that: 94 percent of enterprise systems assessed are today still using quantum-vulnerable cryptographic primitives; less than 12 percent of organizations surveyed have started formal planning efforts for quantum migration; and, in most of the cases analyzed, the National Institute of Standards and Technology (NIST) post-quantum cryptography standardization process has not made significant impacts on enterprise security roadmaps. The QRSA Framework offers a staged migration architecture based on the NIST standardized algorithms such as CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+ that integrates with the enterprise security infrastructure. Contributions include cybersecurity governance scholarship, enterprise risk management theory, and information security policy.
Abstract—The advent of fault-tolerant Cryptanalytically Relevant Quantum Computers (CRQCs) presents an existential threat to modern information security. Shor's polynomial-time quantum algorithm renders widely deployed public-key cryptographic primitives—including RSA, Diffie-Hellman (DH), and Elliptic Curve Cryptography (ECDH/ECDSA)—completely vulnerable to private key derivation. Furthermore, 'Harvest Now, Decrypt Later' (HNDL) adversarial campaigns actively intercept and store encrypted enterprise telemetry today, anticipating future quantum decryption capabilities. In response, the National Institute of Standards and Technology (NIST) finalized its primary Post-Quantum Cryptography (PQC) standards in FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). However, transitioning complex enterprise IT ecosystems to quantum-resistant primitives introduces severe architectural and computational disruptions: public key and signature sizes increase by several orders of magnitude, cryptographic handshake latencies escalate, network packets experience Maximum Transmission Unit (MTU) fragmentation, and legacy Hardware Security Modules (HSMs) lack microarchitectural support for lattice-based polynomial arithmetic. This paper provides an exhaustive, mathematically grounded technical survey and architectural roadmap for enterprise PQC migration. We formalize the Module Learning with Errors (M-LWE) and Module Short Integer Solution (M-SIS) hardness foundations, evaluate hybrid classical/post-quantum cryptographic transition models across standard transport protocols (TLS 1.3, IKEv2/IPsec, SSH), and formulate an enterprise Crypto-Agility Maturity Model. Furthermore, we construct an empirical enterprise testbed measuring throughput, connection establishment latency, memory footprints, and packet fragmentation across legacy and quantum-resistant suites. Our results show that while ML-KEM-768 achieves microsecond-level encapsulation, its 1,088-byte ciphertext expands TLS ClientHello payloads into multiple TCP segments under constrained networks. Finally, we establish open research directions in post-quantum identity federations, stateful hash signature tracking, and hardware-accelerated polynomial arithmetic. Index Terms—Post-Quantum Cryptography (PQC), FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), Crypto-Agility, TLS 1.3, Lattice-Based Cryptography, Harvest Now Decrypt Later, Hardware Security Modules (HSM), Enterprise Migration.
The arrival of cryptographically relevant quantum computers (CRQCs) represents an existential threat to the public-key cryptographic infrastructure underpinning global enterprise operations. Enterprise security today relies on RSA and elliptic-curve cryptography (ECC) for TLS, VPNs, PKI, code signing, and identity systems—all of which are fundamentally broken by Shor's algorithm on a sufficiently powerful quantum computer. The defining risk is time-shifted compromise: adversaries can harvest encrypted traffic today and decrypt it once CRQCs exist, a threat already underway according to U.S. intelligence assessments. NIST finalized three post-quantum cryptographic (PQC) standards in August 2024 (FIPS 203/204/205) and mandates deprecation of quantum-vulnerable algorithms by 2035. Yet only 5% of organizations have implemented quantum-safe encryption and 95% lack formal quantum transition plans. This paper provides a comprehensive, threat-driven analysis across seven dimensions: quantum algorithm impact, harvest-now-decrypt-later (HNDL) threat models, enterprise asset risks (PKI, TLS, VPNs, code signing, cloud, IoT, identity, blockchain, supply chain), sector-specific vulnerabilities (financial services, healthcare, critical infrastructure), cryptographic primitive analysis, migration standards and roadmaps, and enterprise readiness gaps. The convergence of HNDL attacks already underway, multi-decade data sensitivity windows, and 12–15 year enterprise migration timelines means the migration deadline has, for most sectors, already passed.