Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Post-Quantum Cryptography Migration in Zero-Trust Networks: Implications for Identity, mTLS, PKI, and Service Authentication

Pinky Sarkar

Published Jan 1, 2026• 0 citations
Publisher
DOI
10.2139/ssrn.7362179

Related papers

Post-Quantum Cryptography in Zero- Trust Networks

K Rameesa, Dasari Sudhakar, Mohammed Yasir +2 more

IEEE International Conference on Emerging Synergy Science and Technology (ICESST)•Apr 29, 2026•0 citations

Post-Quantum Cryptographic Integration Framework for Zero Trust Architecture in Enterprise Cloud Environments

Vijayent Kohli, Shriya Misra

The convergence of two federal mandates-Executive Order 14028 (Zero Trust Architecture) and National Security Memorandum 10 (post-quantum cryptography migration)-introduces significant challenges in enterprise cloud environments. Specifically, NIST's newly standardized postquantum algorithms (FIPS 203-205, Aug. 2024) produce cryptographic artifacts 3-5× larger than classical primitives and incur greater computational overhead, conflicting with Zero Trust's continuous authentication requirements. This paper proposes PQ-ZTA, a comprehensive integration framework addressing 23 distinct challenges across five architectural layers: Identity, Network, Data, Application, and Policy. We introduce five design patterns, hybrid cryptographic envelope, policy-based algorithm selection, certificate chain compression, lazy PQC Migration, and Cryptographic Monitoring to enable incremental PQC deployment while preserving Zero Trust security principles. Our formal analysis shows that these hybrid constructions maintain IND-CCA2 security as long as either the classical or post-quantum component remains secure, providing defense-in-depth during the transition. Additionally, we outline a six-phase migration methodology (covering 2025-2028+) that prioritizes protecting long-lived data and securing external interfaces before internal services. This framework offers a practical roadmap for organizations integrating quantum-resistant cryptography into modern Zero Trust architectures under NSA CNSA 2.0 deadlines (Dec. 2025) and NIST's 2030 deprecation targets.

•Dec 16, 2025•0 citations

Crypto-Agile migration to Hybrid Post-Quantum Cryptography in Enterprise TLS PKI VPN and Cloud-Native Systems and services

Stanley Nwakamma, John Ojukwu, Serif Oyindamola Oyesiji

The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.

Gulf Journal of Computer Sciences•Aug 2, 2026•0 citations

Post - Quantum Cryptography and Authentication: Enhancing Security for the Quantum Era

Nguyễn Thị Phượng Hằng, Lưu Hồng Dũng

•Jan 1, 2025•0 citations

Post-Quantum Identity-Based TLS for 5G Service-Based Architecture and Cloud-Native Infrastructure

Vipin Kumar Rathi, Lakshya Chopra, Nikhil Kumar Rajput

Cloud-native application platforms and latency-sensitive systems such as 5G Core networks rely heavily on certificate-based Public Key Infrastructure (PKI) and mutual TLS to secure service-to-service communication. While effective, this model introduces significant operational and performance overhead, which is further amplified in the post-quantum setting due to large certificates and expensive signature verification. In this paper, we present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption(IBE). Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation. We describe an IBE-based replacement for private PKI, including identity lifecycle management, and show how it can be instantiated using a threshold Private Key Generator (T-PKG). We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks. In particular, we demonstrate how identity-based TLS integrates with the 5G Service-Based Architecture while preserving security semantics and 3GPP requirements, and we show how the same architecture can replace private PKI in Kubernetes, including its control plane, without disrupting existing trust domains or deployment models.

arXiv:2602.04238•Feb 4, 2026•0 citations

Challenges and Strategies for Transitioning TLS to Post-Quantum Cryptography

Moritz Beckel

•Sep 8, 2026•0 citations
The convergence of two federal mandates-Executive Order 14028 (Zero Trust Architecture) and National Security Memorandum 10 (post-quantum cryptography migration)-introduces significant challenges in enterprise cloud environments. Specifically, NIST's newly standardized postquantum algorithms (FIPS 203-205, Aug. 2024) produce cryptographic artifacts 3-5× larger than classical primitives and incur greater computational overhead, conflicting with Zero Trust's continuous authentication requirements. This paper proposes PQ-ZTA, a comprehensive integration framework addressing 23 distinct challenges across five architectural layers: Identity, Network, Data, Application, and Policy. We introduce five design patterns, hybrid cryptographic envelope, policy-based algorithm selection, certificate chain compression, lazy PQC Migration, and Cryptographic Monitoring to enable incremental PQC deployment while preserving Zero Trust security principles. Our formal analysis shows that these hybrid constructions maintain IND-CCA2 security as long as either the classical or post-quantum component remains secure, providing defense-in-depth during the transition. Additionally, we outline a six-phase migration methodology (covering 2025-2028+) that prioritizes protecting long-lived data and securing external interfaces before internal services. This framework offers a practical roadmap for organizations integrating quantum-resistant cryptography into modern Zero Trust architectures under NSA CNSA 2.0 deadlines (Dec. 2025) and NIST's 2030 deprecation targets.
The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.
Cloud-native application platforms and latency-sensitive systems such as 5G Core networks rely heavily on certificate-based Public Key Infrastructure (PKI) and mutual TLS to secure service-to-service communication. While effective, this model introduces significant operational and performance overhead, which is further amplified in the post-quantum setting due to large certificates and expensive signature verification. In this paper, we present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption(IBE). Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation. We describe an IBE-based replacement for private PKI, including identity lifecycle management, and show how it can be instantiated using a threshold Private Key Generator (T-PKG). We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks. In particular, we demonstrate how identity-based TLS integrates with the 5G Service-Based Architecture while preserving security semantics and 3GPP requirements, and we show how the same architecture can replace private PKI in Kubernetes, including its control plane, without disrupting existing trust domains or deployment models.