Cryptographic algorithms such as RSA, ECDSA, and HMAC-SHA256 underpin modern secure communication, relying on the difficulty of solving complex mathematical problems in polynomial time. However, with quantum computers, Shor’s and Grover’s algorithms may break RSA and ECDSA in polynomial time. Even without quantum computers, adversaries can adopt a “harvest now, decrypt later” approach, prompting research on the standardization of quantum-safe, or post-quantum, cryptography (PQC). This paper proposes a CRYSTALS-Dilithium-driven framework for securing API endpoints. The proposed framework secures APIs using Dilithium-signed JWTs with nonces for authorization claims and request payloads, utilizing Dilithium FIPS-204 “ML-DSA-44,” “ML-DSA-65,” and “ML-DSA-87” from the Open Quantum Safe project. Analysis shows that only legitimate parties can issue and verify tokens; JWTs and keys resist quantum and classical attacks, replay attacks, and offer non-repudiation, data integrity, and authenticity. The protocol was compared with classical algorithms for key generation, signing, decoding, and storage overhead. Benchmarking results indicate that MLDSA-44 (NIST strength category 2) offers the ideal balance between performance, reliability, and quantum readiness. Tamarin-Prover, with its ability to model the unique mathematical structures, larger key sizes, and specific failure modes inherent to PQC algorithms, was used for formal analysis. The proposed framework provides an approach to securing JWTs and APIs with PQC Dilithium, backed by formal guarantees.
Cryptographic algorithms such as RSA, ECDSA, and HMAC-SHA256 underpin modern secure communication, relying on the difficulty of solving complex mathematical problems in polynomial time. However, with quantum computers, Shor’s and Grover’s algorithms may break RSA and ECDSA in polynomial time. Even without quantum computers, adversaries can adopt a “harvest now, decrypt later” approach, prompting research on the standardization of quantum-safe, or post-quantum, cryptography (PQC). This paper proposes a CRYSTALS-Dilithium-driven framework for securing API endpoints. The proposed framework secures APIs using Dilithium-signed JWTs with nonces for authorization claims and request payloads, utilizing Dilithium FIPS-204 “ML-DSA-44,” “ML-DSA-65,” and “ML-DSA-87” from the Open Quantum Safe project. Analysis shows that only legitimate parties can issue and verify tokens; JWTs and keys resist quantum and classical attacks, replay attacks, and offer non-repudiation, data integrity, and authenticity. The protocol was compared with classical algorithms for key generation, signing, decoding, and storage overhead. Benchmarking results indicate that MLDSA-44 (NIST strength category 2) offers the ideal balance between performance, reliability, and quantum readiness. Tamarin-Prover, with its ability to model the unique mathematical structures, larger key sizes, and specific failure modes inherent to PQC algorithms, was used for formal analysis. The proposed framework provides an approach to securing JWTs and APIs with PQC Dilithium, backed by formal guarantees.
The rapid advancement of quantum computing poses a fundamental threat to classical cryptographic mechanisms that underpin modern digital security. Shor’s algorithm can efficiently solve integer factorization and discrete logarithm problems, thereby breaking widely used public-key cryptosystems such as RSA, ECC, and Diffie–Hellman. Grover’s algorithm also reduces the effective security of symmetric encryption and hash functions by half. This paper provides a systematic analysis of the impact of quantum attacks on current cryptographic infrastructures, including TLS, digital signatures, and blockchain. We then review the state of post-quantum cryptography (PQC) as standardized by NIST, focusing on three leading candidates: CRYSTALS-Kyber for key encapsulation, and CRYSTALS-Dilithium and FALCON for digital signatures. Through simulation using the Open Quantum Safe (liboqs) library on a standard x86_64 platform, we measure key generation time, encryption/signing speed, decryption/verification latency, and key/signature sizes. Our results show that Kyber-768 achieves key generation in <0.1 ms and produces public keys of about 1.2 KB, while Dilithium-3 generates signatures of ~2.7 KB with verification times under 0.3 ms. Compared to RSA-2048 and ECDSA-P256, PQC algorithms offer competitive performance at the cost of larger key and signature sizes. Based on these findings, we propose a hybrid transition roadmap that combines classical and PQC algorithms in parallel, minimizing risk while maintaining backward compatibility. The paper concludes that organizations should begin immediate preparations for the post-quantum era, especially for data requiring long-term confidentiality.
My research focuses on developing a post-quantum cryptography (PQC) framework for securing institutional email systems against future quantum computing threats, particularly the Harvest-Now, Decrypt-Later (HNDL) attack. The study addresses a critical cybersecurity challenge faced by governments, healthcare institutions, universities, and organizations that rely on long-term confidentiality of sensitive communications.The proposed framework integrates the NIST-standardized ML-KEM-768 (formerly CRYSTALS-Kyber) for key encapsulation and ML-DSA-65 (formerly CRYSTALS-Dilithium) for digital signatures to provide quantum-resistant encryption and authentication. A hybrid cryptographic architecture combines PQC with AES-256-GCM to secure email content while maintaining compatibility with existing communication systems.A prototype was implemented using the Open Quantum Safe (liboqs v0.15.0) library and evaluated on resource-constrained hardware representative of institutions in developing countries (3-core Intel Core i5 processor and 4 GB RAM). Performance was measured over 100 benchmark iterations, comparing PQC algorithms with traditional RSA-2048 and ECDSA. The results showed that ML-KEM-768 achieved significantly faster key generation than RSA-2048 while maintaining low computational overhead, requiring less than 2% CPU utilization, under 8 MB of memory, and an end-to-end email processing latency of only 11–16 ms.The research introduces a formally specified HNDL threat model, evaluates the security implications of quantum-resistant cryptography in constrained environments, and discusses deployment considerations including certificate management, side-channel resistance, hybrid migration strategies, and institutional adoption. The work also identifies current limitations, such as the absence of forward secrecy and live production deployment, and proposes future enhancements including PQC-based key ratcheting, TLS integration, and real-world pilot deployments.This research contributes an end-to-end, standards-aligned, open-source framework demonstrating that post-quantum email security is practical and computationally feasible for resource-constrained institutions, particularly in developing economies, providing a pathway toward secure communication infrastructures resilient to future quantum attacks.
Due to the scalability of the stateless and compact JSON Web Tokens (JWT), they are increasingly used in securing modern applications to support single-sign-on context and establish trust in microservices or connected-devices architectures. However, currently JWT relies on traditional encryption algorithms that are based on integer factorization or discrete logarithm problems; this exposes JWT signatures to vulnerability when quantum computers become available. Recently, NIST has announced new standards which are quantum safe. In this paper, we investigate the usage of two quantum-resistant algorithms, which are NIST candidates of round 2 standardization process in 2019, to create and verify JWT signatures. Namely, we consider lattice-based schemes (DILITHIUM and qTESLA) and compare their performance against RSA for digital signature for different security levels defined by NIST. The results show that lattice-based digital signature schemes have better performance than RSA in terms of request per seconds and average response time. DILITHIUM has demonstrated the best performance while also having smaller performance loss when scaling the security level.
The accelerating development of large-scale quantum computers poses an existential threat to the public-key cryptographic infrastructure that underpins modern digital communication. Algorithms such as RSA and Elliptic Curve Cryptography (ECC), which currently secure internet traffic, digital signatures, and data-at-rest, are vulnerable to Shor's algorithm running on a sufficiently powerful quantum processor. In response, the U.S. National Institute of Standards and Technology (NIST) finalized the first post-quantum cryptography (PQC) standards in August 2024—FIPS 203 (ML-KEM/Kyber), FIPS 204 (ML-DSA/Dilithium), and FIPS 205 (SLH-DSA/SPHINCS+)—marking the beginning of a global migration toward quantum-resistant cryptography. This paper presents a hybrid C++/Python secure storage and communication platform (source code available at https://github.com/Sujithb128989/Quantum-Safe-Backend) that implements NIST-selected PQC algorithms in a production-oriented architecture. The backend employs CRYSTALS-Dilithium5 for quantum-resistant transport authentication, Kyber for key encapsulation, and AES-256-GCM for symmetric encryption-at-rest, delivered through a dual-stack gRPC/HTTP architecture containerized with Docker. We describe the system's design rationale, detail the cryptographic pipeline from certificate generation to atomic key rotation, and discuss the engineering challenges of integrating post-quantum primitives into real-world software systems.
The accelerating maturation of quantum computing technology-exemplified by IBM's Eagle, Osprey, and Condor processors surpassing 1,000+ physical qubits-represents a strategic and existential threat to the public-key cryptographic foundations of modern digital infrastructure.The mathematical intractability assumptions underlying RSA (integer factorization), Diffie-Hellman (discrete logarithm), and Elliptic Curve Cryptography (elliptic curve discrete logarithm problem) are rendered computationally negligible by Shor's polynomial-time quantum algorithm.Simultaneously, Grover's unstructured quantum search algorithm halves the effective security of all symmetric encryption schemes, requiring doubling of key lengths.The consequent "Harvest Now, Decrypt Later" (HNDL) attack paradigm-wherein encrypted communications are archived today for future quantum decryption-transforms post-quantum cryptographic migration from a future concern into an immediate operational imperative for all communications with confidentiality lifetimes exceeding five years.This paper presents a comprehensive Hybrid Post-Quantum Cryptographic (HPQC) framework that systematically integrates NIST-finalized post-quantum algorithms-CRYSTALS-Kyber (FIPS 203) for Key Encapsulation Mechanisms, CRYSTALS-Dilithium (FIPS 204) and SPHINCS+ (FIPS 205) for digital signatureswith classical cryptographic primitives (ECDH P-256/X25519, ECDSA, AES-256-GCM) in a layered, crypto-agile, formally proven, and operationally deployable security architecture.Twenty mathematical formulae are derived and presented, covering Shor/Grover complexity bounds, Module-LWE and Module-SIS hardness parameters, hybrid HKDF-SHA-512 key derivation, IND-CCA2 and EUF-CMA security reductions, forward secrecy entropy bounds, and crypto-agility rotation period calculations.Formal Theorems 1 and 2 establish the security of the hybrid KEM and hybrid signature constructions respectively.Simulated performance benchmarks across three hardware tiers (Intel Xeon server, ARM Cortex-A72 edge gateway, ARM Cortex-M4 IoT device) demonstrate 23-31% TLS 1.3 handshake latency overhead over classical baselines with full quantum resistance.Seven comparative tables and five architectural figures support the engineering-ready deployment guidance provided across 5G/6G, massive IoT, SDN, and cloud-native environments.A four-phase crypto-agile migration roadmap aligned with NIST FIPS 203/204/205, NIST SP 800-208, NSA CNSA 2.0, BSI TR-02102, and ENISA PQC guidance is presented for enterprise network operators and security architects.
The emergence of quantum computing is a serious threat to the principles of modern crypto-logical mathematics. The classical public-key cryptography, including Rivest-Shamir-Adleman (RSA), Elliptic Curve Cryptography (ECC), and Diffie-Hellman are very safe against classical adversaries yet become susceptible to quantum algorithms, including the Shor algorithm, which can easily solve the underlying mathematical problems. This weakness is jeopardizing confidentiality and integrity of the world-wide systems of communication, money transactions, and essential structures, and requires the immediate creation of safe alternatives. The current literature on post-quantum cryptography (PQC) has covered various classes of algorithm, such as lattice-based, code-based, multivariate schemes, and isogeny-based schemes. Although lattice-based approaches like Nth Degree Truncated Polynomial Ring Unit (NTRU) and FrodoKEM can be highly theoretically resistant, they can be computationally and memory-intensive. Cryptosystems based on code such as Classic McEliece are secure but not practicable because they have huge public key sizes. Multivariate schemes like Rainbow, and isogeny-based schemes like Super singular Isogeny Key Encapsulation (SIKE) have been attacked recently by cryptanalytic attacks, and broken completely. Such restrictions open the necessity to find more efficient and secure quantum-resistant solutions.This research study postulates a hybrid post-quantum cryptographic (PQC) system that combines CRYSTALS-Kyber for encryption with CRYSTALS-Dilithium for digital signatures both of which are approved through the National Institute of Standards and Technology (NIST) PQC standardization program. The model will be such that it ensures quantum resistance but at the same time it will be scalable, efficient and compatible with the existing infrastructures. The test outcomes indicate that the hybrid PQC model is 35-45 percent faster to encrypt and decrypt, signature performance is enhanced by up to 40 percent, and the throughput is 20 times higher (98.7 Mbps) than the same base PQC scheme including Nth Degree Truncated Polynomial Ring Unit (NTRU), McEliece and Rainbow. These enhancements affirm that the suggested model provides a viable trade-off between the security, speed, and efficiency in terms of key size, which makes it a viable and a sound base to ensure secure communication in the quantum age.