A Hybrid Post-Quantum Cryptosystem for Resource-Constrained IoT Communications: Design, Security Analysis, and Migration Framework C. J. Tully https://orcid.org/0009-0007-5661-7332 Independent Researcher, Australia ttg41postquantum@gmail.com --- Abstract Long-lived Internet-of-Things (IoT) devices require migration paths from classical public-key cryptography to post-quantum mechanisms while operating under strict memory, bandwidth, and energy constraints. This paper proposes a hybrid cryptosystem that combines an ephemeral classical key exchange with ML-KEM (FIPS 203), configurable classical or ML-DSA (FIPS 204) authentication, and AES-256-GCM authenticated encryption. The design specifies transcript-bound suite negotiation, domain-separated HKDF key derivation, direction-specific traffic keys, replay protection, nonce-management rules, and bounded fragmentation for low-MTU links. Security claims are stated conditionally on the underlying primitives, secure randomness, correct transcript authentication, and erasure of ephemeral secrets. A resource-analysis framework identifies implementation variables for 32-bit embedded platforms, while a five-phase migration process supports crypto-agility from legacy elliptic-curve deployments to post-quantum-capable operation. Keywords Post-Quantum Cryptography, Hybrid Key Exchange, IoT Security, ML-KEM, ML-DSA
A Hybrid Post-Quantum Cryptosystem for Resource-Constrained IoT Communications: Design, Security Analysis, and Migration Framework C. J. Tully https://orcid.org/0009-0007-5661-7332 Independent Researcher, Australia ttg41postquantum@gmail.com --- Abstract Long-lived Internet-of-Things (IoT) devices require migration paths from classical public-key cryptography to post-quantum mechanisms while operating under strict memory, bandwidth, and energy constraints. This paper proposes a hybrid cryptosystem that combines an ephemeral classical key exchange with ML-KEM (FIPS 203), configurable classical or ML-DSA (FIPS 204) authentication, and AES-256-GCM authenticated encryption. The design specifies transcript-bound suite negotiation, domain-separated HKDF key derivation, direction-specific traffic keys, replay protection, nonce-management rules, and bounded fragmentation for low-MTU links. Security claims are stated conditionally on the underlying primitives, secure randomness, correct transcript authentication, and erasure of ephemeral secrets. A resource-analysis framework identifies implementation variables for 32-bit embedded platforms, while a five-phase migration process supports crypto-agility from legacy elliptic-curve deployments to post-quantum-capable operation. Keywords Post-Quantum Cryptography, Hybrid Key Exchange, IoT Security, ML-KEM, ML-DSA
The imminent advent of quantum computing threatens the long-term security of classical public-key cryptography, creating critical challenges for resource-constrained internet of things (IoT) environments.Hybrid cryptographic frameworks combining elliptic curve cryptography (ECC) with post-quantum cryptography (PQC) primitives have emerged as a transitional solution; however, their security properties remain insufficiently validated under semi-trusted infrastructure assumptions.This paper presents a comprehensive security evaluation of a hybrid ECC-KEM authentication and key agreement framework targeting IoT deployments.Using a dual-verification methodology that integrates formal symbolic analysis with the Tamarin-Prover and practical AI-assisted testing via the APSVer tool, we identify a critical impersonation vulnerability that enables a semi-trusted third party (TTP) to reconstruct PUF-based authentication material.To mitigate this flaw, we introduce a protocol enhancement incorporating ML-DSA post-quantum digital signatures and device-isolated key derivation.Formal verification confirms that the enhanced protocol achieves mutual authentication, session key secrecy, replay resistance, and effective isolation of the TTP.Experimental performance analysis demonstrates that the proposed security improvements introduce only a 12%-15% computational overhead, preserving feasibility for constrained IoT devices.The proposed framework provides a practical, quantum-resilient authentication architecture suitable for next-generation secure IoT deployments.
The emergence of quantum computing threatens classical cryptographic systems, including RSA and ECC, potentially compromising the security of pervasive Internet of Things (IoT) deployments. Resourceconstrained IoT devices—such as sensors, embedded controllers, and microcontrollers—face significant challenges in adopting post-quantum cryptographic (PQC) protocols due to computational, memory, and energy limitations. This paper proposes AQ-PQC, an adaptive lightweight hybrid key exchange protocol combining Kyber lattice-based KEM and lightweight elliptic curve cryptography (ECC), specifically designed for constrained devices. AQ-PQC introduces a dynamic parameter tuning algorithm that adjusts key sizes, handshake rounds, and compression ratios based on real-time device state and network conditions. Formal security analysis under the IND-CCA model demonstrates quantum-resistance and forward secrecy. Extensive hardware implementation on Raspberry Pi 4 and ESP32 devices reveals a significant reduction in handshake latency, energy consumption, and memory footprint compared to conventional PQC protocols. The proposed framework provides a practical, reproducible, and secure methodology for post-quantum IoT communications, supporting heterogeneous and resource-limited networks.
Quantum computing is also posing a serious challenge to the classical cryptographic algorithms like RSA and ECC as they have vulnerability to quantum algorithms such as Shor and Grover. This is a serious problem to Internet of Things (IoT) and edge computing systems, where billions of devices work with strict resource constraints in processing power, memory and energy. To resolve this, we are introducing a minimal postquantum cryptography model to be used in edge platforms with constraints on their resources. This framework combines fierce encapsulation of key (Kyber512) on a lattice with traditional ECDH in a hybrid system of key establishment, along with the Ascon AEAD encryption algorithm to provide effective data hiding and integrity provision. Furthermore, rekeying and forward secrecy on a lightweight basis is possible to reconfigure a layer with negligible overhead on a secure transmission with forward secrecy. The experimental data with ARM Cortex-M and RISC-V architectures and 128-bit post-quantum security has shown that the proposed system can reduce the latency by up to 30 percent and the energy usage by up to 35 percent and considerably better throughput than PQC-only implementations. These findings validate the fact that hybrid PQC solutions have the potential to provide high-resistance quantum with minimal overhead and thus are best suited to IoT and edge applications. The paper offers a viable and extensible security design in conformance with the NIST PQC and IETF migration policies, which can support secure communication in the post-quantum era.
The rapid expansion of Internet of Things (IoT) ecosystems has increased the need for communication mechanisms that can remain secure against emerging computational threats. Conventional asymmetric cryptographic schemes, including RSA and Elliptic Curve Cryptography (ECC), are vulnerable to advances in quantum computing due to the ability of Shor's algorithm to undermine their underlying mathematical assumptions. To address these challenges, this paper presents PQ-IoT SecureCom, a quantum-resistant communication framework built using NIST-standardized post-quantum cryptographic primitives. The proposed framework employs ML-KEM (derived from Kyber) for secure key encapsulation and ML-DSA (derived from Dilithium) for digital authentication, combined with AESGCM to ensure data confidentiality and integrity. Additional security mechanisms, including PQC-based device certification, periodic session key updates, and nonce-based timestamp validation, are incorporated to mitigate replay and impersonation attacks. The framework also supports a hybrid operational mode that enables performance comparison between classical and postquantum cryptographic schemes. System behavior is monitored using a real-time dashboard that records cryptographic overhead, communication metrics, and detected security events. Experimental evaluation shows that ML-KEM and ML-DSA significantly enhance security while introducing computational overhead that remains acceptable for contemporary IoT devices. Through automated attack simulations and detailed event logging, PQ-IoT SecureCom demonstrates the practical feasibility of deploying scalable post-quantum security in IoT communication systems.
The deployment of 5G and emerging 6G networks introduces significant security challenges for Internet of Things (IoT) ecosystems comprising billions of heterogeneous devices, including resource-constrained endpoints, more capable embedded controllers, gateways, edge nodes, and network infrastructure. At the same time, the long-term security of widely deployed public-key cryptography is challenged by advances in quantum computing, motivating migration toward standardized post-quantum key-establishment and digital-signature mechanisms. This comprehensive, evidence-based review classifies cryptographic mechanisms for wireless IoT in 5G and beyond across lightweight symmetric cryptography, post-quantum cryptography, privacy-preserving encryption, and adaptive security. The literature-reported implementation results are compared with explicit attention to heterogeneous hardware, memory, energy, communication, and latency constraints. Lightweight symmetric mechanisms remain relevant for constrained data protection, while standardized post-quantum mechanisms such as ML-KEM and ML-DSA address quantum-vulnerable public-key functions and generally introduce larger keys, ciphertexts, signatures, certificates, or protocol messages. This review therefore emphasizes interoperability, firmware upgradability, crypto-agility, and lifecycle management rather than physical device-size growth. A conceptual three-phase roadmap for 2025–2035 is presented in which quantum-vulnerable public-key mechanisms are progressively supplemented and, where appropriate, replaced by hybrid classical–post-quantum and then post-quantum-capable architectures, while standardized symmetric/lightweight protection remains in use where it satisfies application requirements. The roadmap dates are planning intervals rather than universal adoption forecasts.
Although quantum computing is still in its nascent age, its evolution threatens the most popular public-key encryption systems. Such systems are essential for today's Internet security due to their ability for solving the key distribution problem and for providing high security in insecure communications channels that allow for accessing websites or for exchanging e-mails, financial transactions, digitally signed documents, military communications or medical data. Cryptosystems like Rivest-Shamir-Adleman (RSA), elliptic curve cryptography (ECC) or Diffie-Hellman have spread worldwide and are part of diverse key Internet standards like Transport Layer Security (TLS), which are used both by traditional computers and Internet of Things (IoT) devices. It is especially difficult to provide high security to IoT devices, mainly because many of them rely on batteries and are resource constrained in terms of computational power and memory, which implies that specific energy-efficient and lightweight algorithms need to be designed and implemented for them. These restrictions become relevant challenges when implementing cryptosystems that involve intensive mathematical operations and demand substantial computational resources, which are often required in applications where data privacy has to be preserved for the long term, like IoT applications for defense, mission-critical scenarios or smart healthcare. Quantum computing threatens such a long-term IoT device security and researchers are currently developing solutions to mitigate such a threat. This article provides a survey on what can be called post-quantum IoT systems (IoT systems protected from the currently known quantum computing attacks): the main post-quantum cryptosystems and initiatives are reviewed, the most relevant IoT architectures and challenges are analyzed, and the expected future trends are indicated. Thus, this article is aimed at providing a wide view of post-quantum IoT security and give useful guidelines to the future post-quantum IoT developers.