Quantum computing poses a serious long-term risk to modern cryptographic systems, including the widely used Signal messaging protocol. This research work addresses that risk by integrating ML-KEM-768, a NIST-standardized post-quantum algorithm specified in FIPS 203, as an additional security layer within Signal Desktop. The proposed implementation applies a quantum-resistant wrapping layer to message content before encryption by Signal’s existing Double Ratchet protocol, thereby creating a hybrid cryptographic design that strengthens protection against both classical and quantum adversaries. The system uses ML-KEM-768 key encapsulation from the @noble/post-quantum library together with AES-256-GCM authenticated encryption from @noble/ciphers. This process produces 1088-byte KEM ciphertexts with 32-byte shared secrets and adds about 1104 bytes of overhead per message. Performance evaluation using two live Signal Desktop instances shows that the additional post-quantum layer introduces only modest latency. ML-KEM-768 encapsulation averages 0.67 ms, decapsulation averages 2.27 ms, and total message preparation overhead averages 13.0ms, which remains well below the 100 ms threshold commonly associated with instantaneous user interaction. Additionally, a second set of experiments evaluated image attachment encryption (100 KB, 500 KB, and 2 MB), confirming that ML-KEM-768 encapsulation cost remains constant at approximately 0.4 ms regardless of payload size while AES-256-GCM bulk encryption scales linearly, making the post-quantum overhead negligible for large media. A third stress test evaluated robustness under load, achieving 913 messages per second in burst mode with sub-millisecond wrap latency, and confirming stable performance with no degradation across sustained operation at 10 messages per second over 60 s. Overall, this work demonstrates that post-quantum cryptography can be integrated into a real messaging system in a practical manner, helping address the harvest now, decrypt later threat while preserving usability and strengthening long-term communication security.
Quantum computing poses a serious long-term risk to modern cryptographic systems, including the widely used Signal messaging protocol. This research work addresses that risk by integrating ML-KEM-768, a NIST-standardized post-quantum algorithm specified in FIPS 203, as an additional security layer within Signal Desktop. The proposed implementation applies a quantum-resistant wrapping layer to message content before encryption by Signal’s existing Double Ratchet protocol, thereby creating a hybrid cryptographic design that strengthens protection against both classical and quantum adversaries. The system uses ML-KEM-768 key encapsulation from the @noble/post-quantum library together with AES-256-GCM authenticated encryption from @noble/ciphers. This process produces 1088-byte KEM ciphertexts with 32-byte shared secrets and adds about 1104 bytes of overhead per message. Performance evaluation using two live Signal Desktop instances shows that the additional post-quantum layer introduces only modest latency. ML-KEM-768 encapsulation averages 0.67 ms, decapsulation averages 2.27 ms, and total message preparation overhead averages 13.0ms, which remains well below the 100 ms threshold commonly associated with instantaneous user interaction. Additionally, a second set of experiments evaluated image attachment encryption (100 KB, 500 KB, and 2 MB), confirming that ML-KEM-768 encapsulation cost remains constant at approximately 0.4 ms regardless of payload size while AES-256-GCM bulk encryption scales linearly, making the post-quantum overhead negligible for large media. A third stress test evaluated robustness under load, achieving 913 messages per second in burst mode with sub-millisecond wrap latency, and confirming stable performance with no degradation across sustained operation at 10 messages per second over 60 s. Overall, this work demonstrates that post-quantum cryptography can be integrated into a real messaging system in a practical manner, helping address the harvest now, decrypt later threat while preserving usability and strengthening long-term communication security.
The emergence of fault-tolerant quantum computing poses an existential threat to classical public-key cryptographic systems, including RSA and Elliptic Curve Cryptography (ECC), through Shor's polynomial-time factorization algorithm. The Harvest Now, Decrypt Later (HNDL) attack paradigm further amplifies this threat by enabling adversaries to archive ciphertext today for future quantum-enabled decryption, rendering long-term data confidentiality immediately at risk. While the National Institute of Standards and Technology (NIST) finalized post-quantum cryptographic standards ML-KEM (FIPS 203) and ML-DSA (FIPS 204) in August 2024, their practical integration into complete application-level communication systems remains a largely unaddressed research gap. This paper presents QuantumShield, a hybrid post-quantum secure peer-to-peer communication platform that integrates ML-KEM-768 for quantum-safe key encapsulation, ML-DSA-65 for authenticated digital signatures, and AES-256-GCM for high-throughput symmetric encryption. Our primary research contribution is a rigorous empirical analysis of PQC integration overhead in a real-world communication pipeline, quantifying latency, key size, and security trade-offs against classical RSA-2048 and ECC-256 baselines under controlled experimental conditions. Experimental evaluation across 1,000 iterations demonstrates that ML-KEM-768 encapsulation completes in 2.8 ± 0.2 ms compared to 4.1 ± 0.3 ms for ECDH key agreement — a 32% latency reduction while providing NIST Level 3 post-quantum security. The complete secure transfer pipeline processes 1 MB files in under 22 ms on commodity hardware. The system further provides interactive cryptographic visualization, adversary threat modeling, tamper detection simulation, and a hybrid migration framework demonstrating practical transition from classical to post-quantum infrastructure. QuantumShield establishes that quantum-safe communication is not merely theoretical but deployable today with negligible performance compromise.
The fast development of cyber communications, multimedia distribution, remote working have promoted the demand to transmit sensitive information through secure means in both the public and the private networks. The advent of massive quantum computers is rendering traditional cryptographic algorithms like RSA and Elliptic Curve Cryptography (ECC) insecure because they can crack the classical public-key algorithms like the Shor and Grover algorithms. This brings an immediate need of hybrid cryptographic systems, which integrate classical, quantum, and post-quantum algorithms to provide confidentiality, integrity, authentication, and future security beyond the quantum threat horizon.The paper is a proposal of a Hybrid Quantum-Post-Quantum Cryptographic Framework of transmitting files safely. It starts by aggregating files, which is a process to compress several files, images, videos, and multimedia files that users have chosen into one file to minimize redundancy and ease encryption. The AES-256 encrypted file is in GCM mode and provides confidentiality and integrity of the compressed file.The dual-layer mechanism ensures key establishment security. To begin with, Quantum Key Distribution (QKD) based on the protocols of BB84/E91 allows the Sender and the Receiver to generate a Quantum Secret Key (QSK) by exchanging quantum bits in quantum channel. Constant monitoring of the error rate facilitates automatic eavesdropping detection, and guarantees the keys generation is made when the conditions are secure, as well as the safeguarding of interception and man-in-the-middle attacks.A post-quantum layer is provided to ensure long-term security against quantum cryptanalysis, which uses Kyber, a NIST-approved lattice-based Key Encapsulation Mechanism (KEM). The Receiver creates a key pair of Kyber and disseminates the public key to the Sender. By using encapsulation, the Sender gets a PQC ciphertext and a Shared Secret (SS), with decapsulation on the Receiver side giving ensure that only participants of good faith get the same secret value.The hybridization phase consists of combining the QSK of QKD and SS of Kyber with the help of HKDF-SHA256 to obtain a Final Wrap Key (FWK). AES-GCM encrypts the key of file encryption by wrapping it with FWK which allows a secure and authenticated transfer of the key. The Sender sends four messages: encrypted file, Kyber ciphertext, wrapped AES key and the initialisation vector. At Receiver end, FWK is calculated once again with the help of QSK and SS so that the original data can be decrypted with the help of AES key.The suggested framework provides a defense-in-depth solution based on the combination of quantum security, post-quantum resilience and authenticated symmetric encryption. It can be analyzed that there is a strong resistance to classical and quantum adversaries, scalability, and compatibility with the existing communication networks. This renders the model to be appropriate to secure government communication, military systems, data exchange in healthcare environments, cloud storage and financial infrastructures. Keywords— Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), Kyber,Key Encapsulation Mechanism (KEM), HKDF-SHA256, Quantum Secret Key (QSK), GCM Mode.
Introduction Session establishment, the process by which two parties authenticate each other and derive a shared secret key, forms the foundation for secure digital communication. Quantum computers threaten this foundation by breaking classical public-key primitives such as RSA and elliptic-curve Diffie–Hellman (ECDH), thereby enabling harvest-now–decrypt-later (HNDL) attacks that endanger long-term confidentiality. Methods This paper presents the design, implementation, and evaluation of an authenticated, quantum-resistant session protocol that replaces these vulnerable mechanisms with their post-quantum counterparts. The proposed protocol integrates ML-KEM-1024 (FIPS 203; CRYSTALS, Kyber) for ephemeral key exchange, ML-DSA-65 (FIPS 204; CRYSTALS, Dilithium) for endpoint authentication, and AES-256-GCM for symmetric protection. A transcript-bound HKDF–SHA3-256 key schedule and a 96-bit GCM nonce construction with conservative rekey limits are used to ensure forward secrecy, downgrade resistance, and message integrity. A Python/C prototype (PQClean ML-KEM-1024 with PyCryptodome AES-256-GCM) was benchmarked over 1,000 iterations on commodity hardware. Results The results show that sub-millisecond cryptographic overhead ML-KEM-1024 matches the performance of X25519 while vastly outperforming RSA-3072 in secure session establishment, and symmetric encryption remains cost effective. Nonces are unique 96-bit values, never reused across directions or beyond 2³² records, following NIST SP 800-38D; when nonce-misuse resistance is required, AES-256-GCM-SIV (RFC 8452) is supported as a drop-in alternative. Empirical tests under both local and WAN-emulated ( ≈ 40 ms RTT) network conditions confirm that the additional post-quantum cost maintains the handshake cryptographic latency in the 0.50–0.70 ms range. Discussion These results demonstrate that fully authenticated, forward-secure, quantum-resistant session negotiation is practical for real-world deployments.
This paper presents QuantumShield, a hybrid post-quantum secure file transfer and peer-to-peer communication system designed to address emerging quantum threats. The system integrates ML-KEM (FIPS 203) for secure key encapsulation, ML-DSA (FIPS 204) for digital signatures, and AES-256-GCM for efficient and authenticated data encryption. A full-stack implementation using FastAPI and React demonstrates secure file transfer, encrypted real-time chat, and protocol visualization. The system follows a KEM-DEM architecture and incorporates forward secrecy to mitigate “Harvest Now, Decrypt Later” attacks. Performance evaluation shows that the proposed approach provides strong security with practical latency, enabling a smooth transition from classical cryptography to quantum-resistant communication systems.
The advent of cryptographically relevant quantum computers poses an existential threat to current public-key cryptographic systems (RSA, ECC) widely used in digital communication protocols such as TLS, IPsec, VPNs, and secure messaging. Traditional systems face risks from "Harvest Now, Decrypt Later" attacks, compromising long-term confidentiality of sensitive data in finance, healthcare, government, and critical infrastructure. This paper proposes Quantum Shield, a comprehensive post-quantum secure framework for next-generation digital communication. It integrates NIST-standardized post-quantum algorithms (ML-KEM for key encapsulation, ML-DSA and SLH-DSA for digital signatures) with hybrid crypto-agile designs, hardware acceleration support, and role-based access controls. The system ensures quantum-resistant key establishment, authentication, and end-to-end encryption while maintaining low latency and high throughput. Experimental evaluation on simulated network traffic demonstrates acceptable performance overhead, enhanced resistance to quantum attacks, improved traceability, and secure multi-party coordination. Quantum Shield bridges the gap between classical and quantum-safe infrastructures, fostering trust and compliance in an era of quantum threats.
Classical public-key cryptography, mainly RSA, is at risk from the emergence of quantum computers. A complete shift to Post-Quantum Cryptography (PQC) faces vulnerabilities due to implementation and trust issues, despite NIST's approval of standards such as ML-KEM (Kyber). This paper presented a performance and bandwidth trade-off study of a proposed Hybrid Key Encapsulation Mechanism that fused the NIST-standardized ML-KEM-768 (FIPS 203) with the traditional RSA-3072. Two separate secret keys S1 and S2 were produced and encapsulated utilizing both classical and post-quantum public keys in our dual-layered model. In order to create a strong session key that ensures trust transition and backward compatibility with current network infrastructures, these secrets were then combined using a Hybrid Key Derivation Function (HKDF). In comparison to standalone systems, the study assessed the computational cost and communication latency brought about by this hybrid overhead. According to experimental data, the hybrid architecture offers a crucial security fail-safe against both classical flaws and future quantum threats without prohibitively high performance, even though it increases ciphertext size.