Quantum computing poses a significant threat to classical cryptographic schemes widely used in modern networks, particularly RSA and ECC, which are vulnerable to Shor’s algorithm. To address this challenge, this study conducts a post-quantum security evaluation of TLS 1.3 by implementing hybrid X25519+Kyber key exchange and ML-DSA digital signatures. The objective is to assess the performance, overhead, and effectiveness of hybrid TLS in ensuring long-term data confidentiality within enterprise environments. The research method involves building a server–client testbed using OpenSSL with the oqs-provider, applying network load simulations under various latencies, and measuring key metrics including handshake latency, CPU utilization, certificate size, and client compatibility. The results indicate that hybrid TLS 1.3 with X25519+Kyber introduces only moderate handshake latency, while ML-DSA increases certificate size but remains manageable for deployment in modern enterprise systems. The conclusion of this study is that combining X25519+Kyber with ML-DSA offers an effective transition path towards quantum-safe networks without significantly sacrificing system performance..
Quantum computing poses a significant threat to classical cryptographic schemes widely used in modern networks, particularly RSA and ECC, which are vulnerable to Shor’s algorithm. To address this challenge, this study conducts a post-quantum security evaluation of TLS 1.3 by implementing hybrid X25519+Kyber key exchange and ML-DSA digital signatures. The objective is to assess the performance, overhead, and effectiveness of hybrid TLS in ensuring long-term data confidentiality within enterprise environments. The research method involves building a server–client testbed using OpenSSL with the oqs-provider, applying network load simulations under various latencies, and measuring key metrics including handshake latency, CPU utilization, certificate size, and client compatibility. The results indicate that hybrid TLS 1.3 with X25519+Kyber introduces only moderate handshake latency, while ML-DSA increases certificate size but remains manageable for deployment in modern enterprise systems. The conclusion of this study is that combining X25519+Kyber with ML-DSA offers an effective transition path towards quantum-safe networks without significantly sacrificing system performance..
A sufficiently capable quantum computer would break the public-key cryptography that secures the modern internet, and data captured today can be stored until that machine arrives. This harvest-now-decrypt-later threat has pushed standards bodies to act well ahead of the hardware. In 2024 NIST published the first finished post-quantum standards: ML-KEM, derived from CRYSTALS-Kyber, for key establishment, and ML-DSA, derived from CRYSTALS-Dilithium, for digital signatures. This paper examines how these algorithms move into the two protocols that carry most secured traffic, TLS 1.3 and IPsec. We describe the hybrid handshake that runs a classical and a post-quantum key-encapsulation mechanism side by side, we measure the cost of the larger keys and signatures these schemes carry, and we discuss the practical friction points such as oversized certificate chains and fragmented handshake records. Benchmarks reported in the literature show that a hybrid X25519 plus Kyber-768 handshake adds only a small latency penalty on a healthy network, while Dilithium signatures inflate the certificate path enough to matter on constrained links. We close with a staged migration plan built around crypto-agility.
The emergence of large-scale quantum computers poses a significant threat to current cryptographic protocols, particularly Transport Layer Security (TLS), which relies on RSA and elliptic curve cryptography vulnerable to Shor's algorithm. This paper presents a hybrid framework for quantum-resistant TLS handshakes that integrates post-quantum cryptography (PQC), quantum key distribution (QKD) and classical cryptography to provide comprehensive protection against both classical and quantum attacks. The approach employs three QKD protocols; BB84, E91, and Measurement-Device-Independent QKD (MDI-QKD) alongside NIST-standardized PQC algorithms as well as alternative candidates such as HQC and BIKE. A key innovation is the QKD key management module, which addresses performance bottlenecks through periodic key generation and secure reuse within predefined retention periods, significantly reducing QKD overhead in TLS handshakes. The experimental implementation using the quantum network simulator evaluated 144 distinct cryptographic protocol combinations. Results demonstrate that ML-KEM combined with ML-DSA provides optimal PQC performance, while QKD protocol selection is distance-dependent: BB84 for short-range and MDI-QKD for long-distance communication. The framework includes various attack mitigation mechanisms and ensure security as long as at least one cryptographic method remains uncompromised. Consistent with current global quantum network usage, the proposed TLS approach is designed primarily for MAN and WAN environments rather than the Internet, providing a balanced solution that combines theoretical security guarantees with computational efficiency.
The emergence of fault-tolerant quantum computing poses an existential threat to classical public-key cryptographic systems, including RSA and Elliptic Curve Cryptography (ECC), through Shor's polynomial-time factorization algorithm. The Harvest Now, Decrypt Later (HNDL) attack paradigm further amplifies this threat by enabling adversaries to archive ciphertext today for future quantum-enabled decryption, rendering long-term data confidentiality immediately at risk. While the National Institute of Standards and Technology (NIST) finalized post-quantum cryptographic standards ML-KEM (FIPS 203) and ML-DSA (FIPS 204) in August 2024, their practical integration into complete application-level communication systems remains a largely unaddressed research gap. This paper presents QuantumShield, a hybrid post-quantum secure peer-to-peer communication platform that integrates ML-KEM-768 for quantum-safe key encapsulation, ML-DSA-65 for authenticated digital signatures, and AES-256-GCM for high-throughput symmetric encryption. Our primary research contribution is a rigorous empirical analysis of PQC integration overhead in a real-world communication pipeline, quantifying latency, key size, and security trade-offs against classical RSA-2048 and ECC-256 baselines under controlled experimental conditions. Experimental evaluation across 1,000 iterations demonstrates that ML-KEM-768 encapsulation completes in 2.8 ± 0.2 ms compared to 4.1 ± 0.3 ms for ECDH key agreement — a 32% latency reduction while providing NIST Level 3 post-quantum security. The complete secure transfer pipeline processes 1 MB files in under 22 ms on commodity hardware. The system further provides interactive cryptographic visualization, adversary threat modeling, tamper detection simulation, and a hybrid migration framework demonstrating practical transition from classical to post-quantum infrastructure. QuantumShield establishes that quantum-safe communication is not merely theoretical but deployable today with negligible performance compromise.
The advancement of quantum computing creates a big threat to classical cryptographic protocols, including TLS, which is responsible for secure internet communications. While recent industry and academic efforts have focused on integrating lattice-based post-quantum key encapsulation mechanisms (KEMs) such as Kyber+X25519 into hybrid TLS handshakes, these approaches often prioritize performance at the cost of cryptanalytic diversity. Code-based KEMs, despite their proven security measure they remain underexplored in hybrid frameworks due to some limitations like large key sizes and integration complexity. This paper proposes a novel hybrid TLS framework that explicitly incorporates code-based post-quantum cryptography—specifically McEliece—alongside classical key exchange mechanisms. The framework introduces a dual-handshake mechanism, adaptive parameter selection, and seamless fallback negotiation, enabling flexible deployment across heterogeneous networks while ensuring backward compatibility. Integration with Quantum Random Number Generators (QRNGs) and multifactor authentication further increases entropy quality and session security. We implemented and evaluated the framework using an OpenSSL-OQS integration. We measure handshake latency, CPU utilization, memory usage, and throughput across emulated and real-world testbeds. Results show that the proposed hybrid approach achieves up to 30% lower latency and significantly reduced resource overhead compared to pure post-quantum TLS variants, while maintaining near-classical efficiency levels. Mathematical modeling formalizes these trade-offs which offers a foundation for optimizing deployment in both resource-constrained IoT devices and high-performance servers. By advancing cryptographic diversity and aligning with emerging NIST and IETF standardization efforts, the proposed framework provides a practical pathway toward quantum-resilient secure communication.It shows that code-based post-quantum cryptography can be added to current TLS systems without any problems, keeping security, performance, and compatibility in mind as we get ready for the quantum age.
The digital age has ushered in a dependency on secure communication and data protection. Every day, vastamounts of sensitive information—ranging from personal data and financial transactions to governmentcommunications—are exchanged over networks. This security is largely ensured through modern cryptographicalgorithms that protect confidentiality, integrity, and authenticity. However, the emergence of quantumcomputing poses a significant threat to these systems, potentially rendering many classical cryptographictechniques obsolete. Quantum computers, leveraging the principles of quantum mechanics, have the theoreticalability to perform complex computations exponentially faster than classical computers. With the development ofquantum algorithms such as Shor’s algorithm and Grover’s algorithm, it becomes evident that once large-scalequantum computers become a reality, widely-used encryption schemes such as RSA, Elliptic CurveCryptography (ECC), and Diffie-Hellman may no longer be secure. Quantum-resistant cryptography, alsoknown as post-quantum cryptography, aims to develop cryptographic algorithms that are secure against bothclassical and quantum attacks. This project focuses on the study and analysis of quantum-resistant cryptographicalgorithms and presents the design, implementation, and evaluation of a Hybrid Post-Quantum TLS (PQ-TLS)framework. Experimental results demonstrate that the hybrid approach maintains efficient performance withsub-4-second response latencies and 100% data fidelity during encrypted transmission.
Currently available cryptographic algorithms such as the RSA, Diffie-Hellman and the ECC are used in securing most Internet communications across the Internet. Theoretical quantum algorithms (and the Shor algorithm in particular) were demonstrated to be able to efficiently break that type of classical cryptography as soon as large-scale quantum computers are developed. To handle this new emerging security problem, PQC has been proposed as a class of cryptographic algorithms that is resistant to both quantum and classical attackers. It is a research paper offering and experimentally implementing a hybrid PQC-TLS protocol in a heterogeneous network architecture which includes edge computing devices and cloud computing and IoT devices. The suggested architecture integrates both lattice-based CRYSTALS-Kyber key encapsulation scheme and CRYSTALS-Dilithium digital signature scheme in the TLS 1.3 handshake without being interoperable with the older ECC-based key exchange schemes. Five measures of performance that included handshake latency, CPU consumption, memory consumption, bandwidth overhead and energy consumption were analyzed in detail through experimentation. The experiments were conducted using in Iot, edge and cloud nodes under controlled conditions that were repeated a number of times to give reliability in the statistics. The results indicate that the integration of PQC has moderate overhead (mean increase in latency about 1517) and decent computational and energy requirements. Another method of resisting popular attacks on networks like as the man in the middle, replay, and downgrade attacks, is security validation. The findings indicate that quantum resilient secure communication migration to a heterogeneous distributed infrastructure can be practically and scalably provided using hybrid PQC-TLS protocols. Statistical analysis including standard deviation and 95% confidence intervals was performed to validate the reliability of the results.