Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Lecture notes in networks and systems

A Resilient Hybrid PQ Key Establishment Protocol Combining LWE and NTRU Primitives

Dhamyaa Z. Fatah Al-Kerboly, Omar A. Dawood

Published Oct 6, 2026• 0 citations
Publisher
DOI
10.1007/978-3-032-36030-4_29

Related papers

Transcript-Bound Combiners for Downgrade-Resilient Hybrid Post-Quantum Key Establishment: Definition, Proof, and Embedded-Device Cost

Bhanwar Gupta, Sanjeev Rana

Hybrid key establishment runs a post-quantum key-encapsulation mechanism (KEM) alongside a classical Diffie-Hellman primitive, so that the session key stays secure while either component resists attack. This design is now standardized in the Transport Layer Security protocol, Secure Shell, and the Internet Key Exchange, with the standardized module-lattice KEM (ML-KEM) as the post-quantum component. A hybrid KEM secures the derived key, but not the integrity of the negotiation that selects which primitives are used. Full protocols authenticate that negotiation through a handshake transcript; a hybrid KEM deployed as a standalone drop-in primitive, or inside a minimal handshake without transcript authentication, inherits no such guarantee, and an active attacker can strip the post-quantum option. We ask what the key schedule alone must contain to make downgrade resilience a local property of the combiner. We give a game-based definition at the combiner layer and prove a two-sided separation: a combiner that ignores the transcript is downgraded with certainty, whereas one that binds the session key and the confirmation tag to a hash of the transcript blocks every such attempt, up to a term negligible for a 256-bit transcript hash. We also give an explicit strongest-link security bound. Using a calibrated cost model composed from published Cortex-M4 measurements, transcript binding adds one hash per party - about 11.8% of handshake computation but only 1.5% of radio-inclusive energy - and adds no messages or bytes on the wire. Every reported number is produced by a released harness that passes a 30-check validation gate.

cs.CRCross-listedarXiv:2609.21273•Sep 21, 2026•0 citations

A computationally efficient and randomized RLWE-based key exchange scheme

Komal Pursharthi, Dheerendra Mishra

Cluster Computing•May 31, 2023•11 citations

Multi-key fully homomorphic encryption from NTRU and (R)LWE with faster bootstrapping

Kexin Xu, Benjamin Hong Meng Tan, Liping Wang +2 more

Theoretical Computer Science•Jun 12, 2023•16 citations

Efficient Instantiation of LWE-based Public-Key Encryption and Commitment Schemes

김진수

•Jan 1, 2018•0 citations

HM-AKA+: Protecting against a semi-trusted third party with Hybrid Crypto

Jorge Munilla, An Braeken

Hybrid protocols that combine Post-Quantum (PQ) and traditional primitives, allowing flexible switching based on the threat level, provide optimal trade-offs between efficiency and security. The recently published HM-AKA scheme introduced a basic framework for this setup, but it fails to provide security against impersonation attacks by a semi-trusted TTP in some of its proposed modes. This vulnerability arises due to the asymmetric behavior of PQ primitives compared to traditional public-key primitives. We identify this threat and propose an enhanced version, HM-AKA+, that maintains the framework’s flexibility while ensuring security.

Cryptography and Communications•Apr 10, 2026•0 citations

Symbolic Analysis and Verification of Hybrid Post-Quantum TLS 1.2

Duong Dinh Tran, Kazuhiro Ogata, Santiago Escobar +1 more

Transport Layer Security (TLS) is a fundamental protocol for securing communications over untrusted networks. With the rising threat of quantum computing, Amazon Web Services (AWS) proposed Hybrid Post-Quantum (PQ) TLS, an extended version of TLS 1.2 designed to resist quantum attacks. In this paper, we present a formal symbolic analysis of the AWS protocol proposal using the CafeOBJ algebraic specification language and the Invariant Proof Score Generator (IPSG) tool. Our analysis formally evaluates the protocol’s resilience under two attacker models: one where classical primitives fail (by quantum adversaries), and one where PQ primitives are compromised (as they are relatively new). We verify key security properties, including the confidentiality of session keys, confidentiality of ephemeral secret keys, and forward secrecy, against both classical and quantum adversaries, confirming the security claims of the proposal. All proofs are executable within the CafeOBJ system and hold for an unbounded number of protocol participants and sessions. Although authentication is beyond the scope of the AWS protocol, we propose an improved version that incorporates hybrid digital signatures to restore quantum-safe authentication.

IEEE Access•Jan 1, 2026•0 citations
Hybrid key establishment runs a post-quantum key-encapsulation mechanism (KEM) alongside a classical Diffie-Hellman primitive, so that the session key stays secure while either component resists attack. This design is now standardized in the Transport Layer Security protocol, Secure Shell, and the Internet Key Exchange, with the standardized module-lattice KEM (ML-KEM) as the post-quantum component. A hybrid KEM secures the derived key, but not the integrity of the negotiation that selects which primitives are used. Full protocols authenticate that negotiation through a handshake transcript; a hybrid KEM deployed as a standalone drop-in primitive, or inside a minimal handshake without transcript authentication, inherits no such guarantee, and an active attacker can strip the post-quantum option. We ask what the key schedule alone must contain to make downgrade resilience a local property of the combiner. We give a game-based definition at the combiner layer and prove a two-sided separation: a combiner that ignores the transcript is downgraded with certainty, whereas one that binds the session key and the confirmation tag to a hash of the transcript blocks every such attempt, up to a term negligible for a 256-bit transcript hash. We also give an explicit strongest-link security bound. Using a calibrated cost model composed from published Cortex-M4 measurements, transcript binding adds one hash per party - about 11.8% of handshake computation but only 1.5% of radio-inclusive energy - and adds no messages or bytes on the wire. Every reported number is produced by a released harness that passes a 30-check validation gate.
Hybrid protocols that combine Post-Quantum (PQ) and traditional primitives, allowing flexible switching based on the threat level, provide optimal trade-offs between efficiency and security. The recently published HM-AKA scheme introduced a basic framework for this setup, but it fails to provide security against impersonation attacks by a semi-trusted TTP in some of its proposed modes. This vulnerability arises due to the asymmetric behavior of PQ primitives compared to traditional public-key primitives. We identify this threat and propose an enhanced version, HM-AKA+, that maintains the framework’s flexibility while ensuring security.
Transport Layer Security (TLS) is a fundamental protocol for securing communications over untrusted networks. With the rising threat of quantum computing, Amazon Web Services (AWS) proposed Hybrid Post-Quantum (PQ) TLS, an extended version of TLS 1.2 designed to resist quantum attacks. In this paper, we present a formal symbolic analysis of the AWS protocol proposal using the CafeOBJ algebraic specification language and the Invariant Proof Score Generator (IPSG) tool. Our analysis formally evaluates the protocol’s resilience under two attacker models: one where classical primitives fail (by quantum adversaries), and one where PQ primitives are compromised (as they are relatively new). We verify key security properties, including the confidentiality of session keys, confidentiality of ephemeral secret keys, and forward secrecy, against both classical and quantum adversaries, confirming the security claims of the proposal. All proofs are executable within the CafeOBJ system and hold for an unbounded number of protocol participants and sessions. Although authentication is beyond the scope of the AWS protocol, we propose an improved version that incorporates hybrid digital signatures to restore quantum-safe authentication.