In this work, we study the hybrid key establishment protocol TutaCrypt as a concrete case of post-quantum cryptographic migration in practice. The protocol was developed by the end-to-end encrypted email provider Tuta and has been deployed to more than ten million users worldwide. We present the protocol in a form that enables rigorous cryptographic analysis and define two Bellare–Rogaway-style security models that precisely characterize the provided security guarantees. The two models capture that the security properties achieved in the pre-quantum setting are slightly stronger than in the post-quantum setting. We then give reduction-based security proofs that clarify under which assumptions the construction achieves security, and how its guarantees degrade if either the classical or the post-quantum component is compromised. Our results illustrate how formally grounded cryptographic models can capture real-world migration strategies and hybrid deployments. Such analyses help to understand the security properties of deployed cryptographic systems and help move cryptographic migration from best practice toward principled, verifiable design.
In this work, we study the hybrid key establishment protocol TutaCrypt as a concrete case of post-quantum cryptographic migration in practice. The protocol was developed by the end-to-end encrypted email provider Tuta and has been deployed to more than ten million users worldwide. We present the protocol in a form that enables rigorous cryptographic analysis and define two Bellare–Rogaway-style security models that precisely characterize the provided security guarantees. The two models capture that the security properties achieved in the pre-quantum setting are slightly stronger than in the post-quantum setting. We then give reduction-based security proofs that clarify under which assumptions the construction achieves security, and how its guarantees degrade if either the classical or the post-quantum component is compromised. Our results illustrate how formally grounded cryptographic models can capture real-world migration strategies and hybrid deployments. Such analyses help to understand the security properties of deployed cryptographic systems and help move cryptographic migration from best practice toward principled, verifiable design.
In 1994, Peter Shor developed a quantum algorithm that can efficiently solve the factorization and discrete logarithm problems. These problems are the foundation of modern cryptographic algorithms and the existence of an efficient algorithm for solving them threatens their security. Although large-scale quantum computers capable of breaking current cryptographic algorithms are not yet available, advances in quantum technology and the risk of “store now, decrypt later” attacks make it essential to prepare for migration to quantum-safe cryptography today. For the past decade, the cryptographic community has been actively developing algorithms that are not exploitable by Shor’s algorithm; such algorithms are said to be “quantum-safe” or “post-quantum.” However, cryptographic algorithms do not exist in isolation—they are components of larger cryptographic systems, such as protocols or other cryptographic primitives. Migrating these systems to use quantum-safe algorithms is therefore a complex task. This thesis studies the migration of several widely used cryptographic systems to post-quantum cryptography. In particular, we consider the migration of the public-key infrastructure (PKI), the TLS protocol, the XML Encryption and XML Signature standards, the SAML security framework, the Advanced Electronic Signature (AdES) standard, and the password-authenticated public-key encryption (PAPKE) primitive. For each topic, we analyze how the presence of quantum adversaries affects the security of existing constructions and identify components that rely on cryptographic assumptions vulnerable to quantum attacks. Based on this analysis, we propose approaches for adapting these systems to use post-quantum cryptographic algorithms. The proposed solutions are considered in two main forms: purely post-quantum and hybrid post-quantum. Purely post-quantum approaches rely exclusively on post-quantum algorithms, while hybrid post-quantum approaches combine classical and post-quantum mechanisms in order to provide security as long as at least one of the underlying assumptions remains secure. Hybrid post-quantum approaches are primarily motivated by uncertainty regarding the security of post-quantum algorithms. For each proposal, we discuss the advantages and disadvantages of the design, including deployment complexity, compatibility with existing systems, and performance considerations. In several cases, we also provide proof-of-concept implementations and evaluate their performance through benchmarks. We study post-quantum public-key infrastructures, which form a fundamental component of many other cryptographic systems. We show that constructing a purely post-quantum PKI does not fundamentally differ from constructing a classical PKI. For hybrid deployments, we propose two approaches—the composite hybrid and the parallel hybrid—which differ primarily in their implementation complexity. We also survey and analyze existing proposals for post-quantum TLS. In contrast, systems such as XML encryption and XML signatures, the SAML security framework, and the eIDAS-related AdES standard have received little attention in the context of post-quantum migration. For these systems, we outline possible migration approaches and provide proof-of-concept implementations. In addition, we present an example migration plan for a Trust Service Provider that relies on all of the discussed cryptographic systems, together with the methodology used to develop it. Finally, we consider the migration of the cryptographic primitive PAPKE. We propose a novel construction that replaces an ideal cipher with a half-ideal cipher, resulting in more efficient quantum-safe constructions and motivating the study of a new public-key encryption property called decryption robustness.
Cloud systems urgently need to switch to Post-Quantum Cryptography (PQC) since the majority of traditional cryptographic algorithms will become vulnerable due to the looming danger of quantum computing. The methodical approaches for switching from conventional cryptography (such as RSA and ECC) to PQC algorithms established by the National Institute of Standards and Technology (NIST) are examined in this study. We look at performance bottlenecks, cloud-native issues, migration phases customized for service-oriented architectures, hybrid deployment models that blend classical and quantum-resilient algorithms, and backward compatibility techniques. The trade-offs between security and performance are demonstrated through experimental research in a cloud setting, with a focus on protocol support, adaptive key management, and incremental migration. Our research aims to help security engineers and cloud architects implement PQC in practice while preserving scalability, compliance, and service quality.
New Challenges in Post-Quantum Cryptography presents a system-level perspective on the transition to post-quantum cryptography. Developed within the MSCA DN-ID QUARC consortium, the book examines how quantum computing challenges the security assumptions underlying modern cryptographic systems and explores the implications for communication networks, computing infrastructures, and digital trust frameworks. The book introduces the foundations of classical and post-quantum cryptography, discusses the quantum threat model, and examines migration strategies, hybrid cryptographic approaches, and crypto-agile system design. Particular attention is given to the deployment of post-quantum cryptography in networking environments, including protocols such as TLS, IPsec, and MACsec, as well as issues related to performance, scalability, hardware acceleration, virtualization, and secure communication infrastructures. Combining theoretical foundations with practical deployment considerations, the book explores how quantum-resilient security can be integrated into modern computing and communication infrastructures.
This thesis investigates the current state of Post-quantum cryptography (PQC) in the industry, with a particular focus on its practical deployment, integration challenges, and performance implications.The study combines a structured analysis of academic literature, standardization efforts, and industry guidance with an experimental evaluation of PQC integration in widely used security protocols. The analysis shows that, while significant progress has been made in the standardization of quantum-resistant algorithms such as ML-KEM, ML-DSA, and SLH-DSA, real-world adoption remains in an early and transitional phase. Organizations primarily focus on evaluation and pilot implementations, as deployment is constrained by interoperability issues, implementation maturity, and the complexity of migrating existing cryptographic infrastructures.To complement the conceptual analysis, experimental measurements were conducted for TLS, SSH, and IPsec to evaluate the performance impact of hybrid post-quantum cryptographic mechanisms. The results indicate that performance overhead is not uniform across components. In particular, post-quantum signature schemes introduce significant computational and network overhead, mainly due to increased key and certificate sizes. In contrast, hybrid key exchange mechanisms show only moderate performance impact across all evaluated protocols.The findings highlight that the primary challenge of PQC adoption lies not in algorithm design but in practical integration and large-scale migration. Hybrid cryptographic approaches emerge as the most viable strategy for enabling a gradual transition, balancing improved security against quantum threats with operational feasibility.Overall, this thesis demonstrates that PQC is transitioning from a theoretical research field to a practical engineering challenge, with significant implications for the future design of secure communication systems.
This preprint presents a systems-security and architectural analysis of post-quantum cryptography deployment challenges in modern API ecosystems. The paper examines hybrid TLS 1.3 integration, cryptographic agility, migration strategies, API gateway architectures, certificate management, and operational considerations surrounding quantum-resilient distributed systems. The work focuses on applied cryptographic engineering and migration planning rather than proposing new cryptographic primitives. It synthesizes current standards, adversarial models, implementation constraints, and deployment considerations relevant to practical post-quantum migration for API infrastructure. Keywords: post-quantum cryptography, API security, TLS 1.3, ML-KEM, cryptographic agility, hybrid TLS.