The emergence of cryptographically relevant quantum computers threatens the security ofclassical public-key cryptography, necessitating the transition toward post-quantum cryptographic (PQC)algorithms standardized by NIST. At the same time, modern Internet protocols such as HTTP/3—runningover the QUIC transport protocol—are becoming widely deployed, offering reduced latency and improvedreliability compared to traditional TCP+TLS stacks. Ensuring that HTTP/3 infrastructure remains secure inthe post-quantum era requires practical implementations that integrate PQC algorithms without causingprohibitive performance overheads. In this study, we present the development of a PQC–enabled Apacheweb server that supports HTTP/3 through a custom OpenSSL 3.5.4 provider embedding the NISTstandardized ML-KEM and ML-DSA algorithms. Our implementation integrates PQC primitives into theQUIC handshake via modified OpenSSL EVP interfaces and enables PQC-based certificates and keyencapsulation mechanisms within a Caddy reverse proxy + Apache server architecture. Performanceevaluations were conducted on heterogeneous hardware, including a Raspberry Pi 4 and an Intel-baseddesktop system, under realistic network conditions. Experimental results show that ML-KEM and MLDSA introduce moderate handshake latency (≈18%) and minimal throughput reduction (4–8%). Across allconfigurations, HTTP/3's multiplexed, UDP-based design mitigated PQC-related delays, maintaining morethan 90% of classical throughput. The results demonstrate that integrating standardized PQC algorithmsinto modern web servers is both feasible and efficient, validating HTTP/3 as a strong foundation forquantum-resilient Internet communication. This work provides an operational reference for deploying PQCwithin web infrastructures and highlights pathways for future enhancements such as hybrid key exchange,certificate compression, and hardware acceleration.
The emergence of cryptographically relevant quantum computers threatens the security ofclassical public-key cryptography, necessitating the transition toward post-quantum cryptographic (PQC)algorithms standardized by NIST. At the same time, modern Internet protocols such as HTTP/3—runningover the QUIC transport protocol—are becoming widely deployed, offering reduced latency and improvedreliability compared to traditional TCP+TLS stacks. Ensuring that HTTP/3 infrastructure remains secure inthe post-quantum era requires practical implementations that integrate PQC algorithms without causingprohibitive performance overheads. In this study, we present the development of a PQC–enabled Apacheweb server that supports HTTP/3 through a custom OpenSSL 3.5.4 provider embedding the NISTstandardized ML-KEM and ML-DSA algorithms. Our implementation integrates PQC primitives into theQUIC handshake via modified OpenSSL EVP interfaces and enables PQC-based certificates and keyencapsulation mechanisms within a Caddy reverse proxy + Apache server architecture. Performanceevaluations were conducted on heterogeneous hardware, including a Raspberry Pi 4 and an Intel-baseddesktop system, under realistic network conditions. Experimental results show that ML-KEM and MLDSA introduce moderate handshake latency (≈18%) and minimal throughput reduction (4–8%). Across allconfigurations, HTTP/3's multiplexed, UDP-based design mitigated PQC-related delays, maintaining morethan 90% of classical throughput. The results demonstrate that integrating standardized PQC algorithmsinto modern web servers is both feasible and efficient, validating HTTP/3 as a strong foundation forquantum-resilient Internet communication. This work provides an operational reference for deploying PQCwithin web infrastructures and highlights pathways for future enhancements such as hybrid key exchange,certificate compression, and hardware acceleration.
The rapid advancement of quantum computing threatens the security foundations of today’s communication protocols. On the web, the traditional approach to securing web traffic has been to couple HTTP with TLS over TCP, but QUIC over UDP has recently emerged as an alternative to reduce latency and improve performance over unreliable networks. The need for an urgent transition to quantum-resistant web protocols demands further examination of both stacks. Consequently, in this work we evaluate their performance when combined with post-quantum primitives. To this end, we devise a practical evaluation framework that integrates the cryptographic primitives into TLS and QUIC implementations. Our analysis focuses on comparing the impact of hybrid and post-quantum primitives on TLS and QUIC under both ideal and realistic network conditions, providing quantitative insights into the performance cost and feasibility of transitioning toward a post-quantum web. Our results indicate that hybrid KEMs incur the highest handshake latency and bandwidth overhead, while pure post-quantum KEMs offer a favorable trade-off between security and performance, with only moderate costs. Moreover, QUIC consistently reduces the performance penalty of post-quantum primitives compared to TLS, especially in lossy network environments.
Currently available cryptographic algorithms such as the RSA, Diffie-Hellman and the ECC are used in securing most Internet communications across the Internet. Theoretical quantum algorithms (and the Shor algorithm in particular) were demonstrated to be able to efficiently break that type of classical cryptography as soon as large-scale quantum computers are developed. To handle this new emerging security problem, PQC has been proposed as a class of cryptographic algorithms that is resistant to both quantum and classical attackers. It is a research paper offering and experimentally implementing a hybrid PQC-TLS protocol in a heterogeneous network architecture which includes edge computing devices and cloud computing and IoT devices. The suggested architecture integrates both lattice-based CRYSTALS-Kyber key encapsulation scheme and CRYSTALS-Dilithium digital signature scheme in the TLS 1.3 handshake without being interoperable with the older ECC-based key exchange schemes. Five measures of performance that included handshake latency, CPU consumption, memory consumption, bandwidth overhead and energy consumption were analyzed in detail through experimentation. The experiments were conducted using in Iot, edge and cloud nodes under controlled conditions that were repeated a number of times to give reliability in the statistics. The results indicate that the integration of PQC has moderate overhead (mean increase in latency about 1517) and decent computational and energy requirements. Another method of resisting popular attacks on networks like as the man in the middle, replay, and downgrade attacks, is security validation. The findings indicate that quantum resilient secure communication migration to a heterogeneous distributed infrastructure can be practically and scalably provided using hybrid PQC-TLS protocols. Statistical analysis including standard deviation and 95% confidence intervals was performed to validate the reliability of the results.
The advancement of quantum computing creates a big threat to classical cryptographic protocols, including TLS, which is responsible for secure internet communications. While recent industry and academic efforts have focused on integrating lattice-based post-quantum key encapsulation mechanisms (KEMs) such as Kyber+X25519 into hybrid TLS handshakes, these approaches often prioritize performance at the cost of cryptanalytic diversity. Code-based KEMs, despite their proven security measure they remain underexplored in hybrid frameworks due to some limitations like large key sizes and integration complexity. This paper proposes a novel hybrid TLS framework that explicitly incorporates code-based post-quantum cryptography—specifically McEliece—alongside classical key exchange mechanisms. The framework introduces a dual-handshake mechanism, adaptive parameter selection, and seamless fallback negotiation, enabling flexible deployment across heterogeneous networks while ensuring backward compatibility. Integration with Quantum Random Number Generators (QRNGs) and multifactor authentication further increases entropy quality and session security. We implemented and evaluated the framework using an OpenSSL-OQS integration. We measure handshake latency, CPU utilization, memory usage, and throughput across emulated and real-world testbeds. Results show that the proposed hybrid approach achieves up to 30% lower latency and significantly reduced resource overhead compared to pure post-quantum TLS variants, while maintaining near-classical efficiency levels. Mathematical modeling formalizes these trade-offs which offers a foundation for optimizing deployment in both resource-constrained IoT devices and high-performance servers. By advancing cryptographic diversity and aligning with emerging NIST and IETF standardization efforts, the proposed framework provides a practical pathway toward quantum-resilient secure communication.It shows that code-based post-quantum cryptography can be added to current TLS systems without any problems, keeping security, performance, and compatibility in mind as we get ready for the quantum age.
The integration of NIST-standardized lattice-based cryptographic algorithms (ML-KEM and ML-DSA) into TLS 1.3 enables post-quantum secure authentication for Industrial IoT (IIoT) environments. This work implements these algorithms within the X.509 certificate infrastructure and evaluates their performance on resource-constrained IIoT hardware (Raspberry Pi 4). Experimental measurements covering key generation, encapsulation, decapsulation, and signature operations were obtained using a liboqs-enabled TLS 1.3 stack. The results show that PQ TLS 1.3 achieves comparable handshake latency to conventional TLS on IIoT-class gateways, with certificate size identified as the dominant overhead. These findings confirm the practicality of post-quantum authentication in IIoT systems while acknowledging limitations related to the hardware scope and simulated networking. Future work will extend validation to field deployments and additional PQC candidates.
This thesis investigates the current state of Post-quantum cryptography (PQC) in the industry, with a particular focus on its practical deployment, integration challenges, and performance implications.The study combines a structured analysis of academic literature, standardization efforts, and industry guidance with an experimental evaluation of PQC integration in widely used security protocols. The analysis shows that, while significant progress has been made in the standardization of quantum-resistant algorithms such as ML-KEM, ML-DSA, and SLH-DSA, real-world adoption remains in an early and transitional phase. Organizations primarily focus on evaluation and pilot implementations, as deployment is constrained by interoperability issues, implementation maturity, and the complexity of migrating existing cryptographic infrastructures.To complement the conceptual analysis, experimental measurements were conducted for TLS, SSH, and IPsec to evaluate the performance impact of hybrid post-quantum cryptographic mechanisms. The results indicate that performance overhead is not uniform across components. In particular, post-quantum signature schemes introduce significant computational and network overhead, mainly due to increased key and certificate sizes. In contrast, hybrid key exchange mechanisms show only moderate performance impact across all evaluated protocols.The findings highlight that the primary challenge of PQC adoption lies not in algorithm design but in practical integration and large-scale migration. Hybrid cryptographic approaches emerge as the most viable strategy for enabling a gradual transition, balancing improved security against quantum threats with operational feasibility.Overall, this thesis demonstrates that PQC is transitioning from a theoretical research field to a practical engineering challenge, with significant implications for the future design of secure communication systems.
The emergence of quantum computing presents a significant threat to classical cryptographic primitives, particularly those employed in securing internet communications via widely used protocols such as Transport Layer Security (TLS). As conventional key exchange mechanisms will become increasingly vulnerable in the post-quantum era, the integration of post-quantum cryptographic (PQC) algorithms into existing security protocols is of utmost importance. This study investigates the impact of incorporating PQC key encapsulation mechanisms—specifically, the recent standards CRYSTALS-Kyber and HQC, in conjunction with the candidate standard BIKE—into the TLS 1.3 handshake. A comprehensive experimental evaluation was conducted to measure handshake latency under emulated network conditions with varying packet loss probabilities. The findings offer useful insights into the performance trade-offs introduced by PQC integration and further highlight the necessity of a timely transition to post-quantum cryptographic standards.