Jul 2026· Electronics· Vol 15, pp. 3250· 0 citations
TL;DR
The Cryptographic Amplification Factor (CAF) is defined, a metric for the per-resource cost asymmetry that an adversary induces by forcing a TLS 1.3 server onto a high-cost signature algorithm (SLH-DSA instead of a low-cost one (ECDSA or ML-DSA) instead of a low-cost one (ECDSA or ML-DSA).
Abstract
Hybrid post-quantum TLS deployments pair classical and post-quantum signature algorithms to resist future quantum adversaries. However, to the best of our knowledge, no active IETF TLS, PQUIP, or LAMPS working-group draft treats CPU-cost adversarial algorithm substitution as a first-class availability threat. We define the Cryptographic Amplification Factor (CAF), a metric for the per-resource cost asymmetry that an adversary induces by forcing a TLS 1.3 server onto a high-cost signature algorithm (SLH-DSA) instead of a low-cost one (ECDSA or ML-DSA). We characterise four adversary classes—insider misconfiguration, supply-chain compromise, remote TLS peer, and protocol man-in-the-middle—demonstrate working proof-of-concept exploits on representative testbeds, and evaluate three defensive primitives under realistic deployment conditions. On the liboqs 0.14.0 reference implementation, CAFrcpu reaches 12,255× on Apple M-series ARM64 and 14,272× on AWS Graviton3 (3904–14,272× across five microarchitectures). Under a representative two-worker hardware security module (HSM) calibration (λ=13.5 TPS), substitution drives the modelled queue utilisation ρ past the stability boundary (1.44×10−4→1.787), a model-independent saturation; on the testbed, we observe server-CPU saturation, accept-queue exhaustion, and dropped connections. Two enforcement defences and a Parallel Signing Architecture provably bound ρ≤α<1 by admission control, regardless of attack rate. The exposed surface is concentrated today in high-assurance and financial-sector deployments and widens as FIPS 206 finalises.
The rapid advancement of quantum computing presents an existential threat to the mathematical foundations of modern internet security. Fault-tolerant quantum computers are projected to reach the logical qubit scale necessary to execute Shor's algorithm by 2030–2035, threatening currently deployed public-key cryptography infrastructures.
We evaluate the performance metrics of integrating post-quantum cryptography (PQC), specifically the newly finalized NIST standards (FIPS 203, 204, and 205), with quantum key distribution (QKD) across communication networks.
Our analysis demonstrates that while hybrid PQC-QKD models reduce long-term key compromise probabilities to near 0%, they introduce a 15% to 40% increase in bandwidth overhead during initial cryptographic handshakes.
Given that enterprise-wide cryptographic migrations historically require 7–10 years, organizations face an immediate vulnerability window against “harvest now, decrypt later” adversaries. Ultimately, we propose a phased, cryptographically agile framework to achieve a Zero-Trust, Quantum-Safe network architecture within a 5-year implementation timeline.
R. Delhibabu· Frontiers of Computer Scienc...· 0 citations
The advancement of quantum computing poses a significant threat to classical cryptographic algorithms, particularly those based on factorization and discrete logarithm problems. In this paper, we propose a secure and quantum-resistant key exchange scheme leveraging the FrodoKEM algorithm, a lattice-based post-quantum key encapsulation mechanism designed to resist attacks from quantum adversaries. FrodoKEM, being based on the Learning with Errors (LWE) problem, offers a conservative and standard approach to post-quantum cryptography without relying on structured lattices. We compare the performance and security of the proposed scheme against traditional key exchange mechanisms such as RSA and Elliptic Curve Diffie-Hellman (ECDH), as well as other post-quantum algorithms like Kyber and NTRU. Our analysis demonstrates that FrodoKEM offers improved security assurances and competitive performance metrics, especially in environments where long-term confidentiality and forward secrecy are critical. The experimental results affirm FrodoKEM's suitability for real-world deployment in post-quantum secure communications.
P Vamshi Krishna, Meeravali Shaik· International journal of com...· 0 citations
Cryptographic algorithms such as RSA, ECDSA, and HMAC-SHA256 underpin modern secure communication, relying on the difficulty of solving complex mathematical problems in polynomial time. However, with quantum computers, Shor’s and Grover’s algorithms may break RSA and ECDSA in polynomial time. Even without quantum computers, adversaries can adopt a “harvest now, decrypt later” approach, prompting research on the standardization of quantum-safe, or post-quantum, cryptography (PQC). This paper proposes a CRYSTALS-Dilithium-driven framework for securing API endpoints. The proposed framework secures APIs using Dilithium-signed JWTs with nonces for authorization claims and request payloads, utilizing Dilithium FIPS-204 “ML-DSA-44,” “ML-DSA-65,” and “ML-DSA-87” from the Open Quantum Safe project. Analysis shows that only legitimate parties can issue and verify tokens; JWTs and keys resist quantum and classical attacks, replay attacks, and offer non-repudiation, data integrity, and authenticity. The protocol was compared with classical algorithms for key generation, signing, decoding, and storage overhead. Benchmarking results indicate that MLDSA-44 (NIST strength category 2) offers the ideal balance between performance, reliability, and quantum readiness. Tamarin-Prover, with its ability to model the unique mathematical structures, larger key sizes, and specific failure modes inherent to PQC algorithms, was used for formal analysis. The proposed framework provides an approach to securing JWTs and APIs with PQC Dilithium, backed by formal guarantees.
Vivin Krishnan· Journal of Intelligent Decis...· 0 citations
With the rapid advancement of quantum computing, classical cryptographic protocols face an increasing risk of being broken. The Post-Quantum OpenPGP (PQ OpenPGP) protocol is an extension of the OpenPGP standard that incorporates hybrid cryptography by combining a classical key exchange and a post-quantum key encapsulation mechanism. This design aims to provide long-term security even in the presence of adversaries equipped with quantum computational capabilities and ensures backward compatibility while transitioning safely to the quantum era. This article presents a formal specification and verification of the PQ OpenPGP protocol using the algebraic specification language CafeOBJ. Our specification captures key aspects of the protocol, including hybrid key encapsulation using post-quantum Module-Lattice Key Encapsulation Mechanism (ML-KEM) and classical Elliptic Curve Diffie–Hellman (ECDH)-KEM, dual digital signatures using post-quantum Module-Lattice Digital Signature Algorithm (ML-DSA) and classical Edwards-curve Digital Signature Algorithm (EdDSA). To model adversarial behavior, we extend the standard Dolev-Yao intruder model, widely used in the analysis of security protocols, by incorporating quantum-enabled capabilities. Under our threat model, the intruder not only has full control over the network, as in the traditional Dolev-Yao setting, but is also capable of breaking classical public-key cryptographic primitives and compromising sensitive information, reflecting the realistic power of large-scale quantum computers. We successfully verify that the PQ OpenPGP protocol satisfies three essential security properties: secrecy of the session key, forward secrecy, and authenticity. The proofs are supported by ten auxiliary lemmas. Given the formal specification, security properties, and conjecture lemmas, the Invariant Proof Score Generator (IPSG) tool automatically generates proof scores to facilitate verification. This work contributes to the growing research on formal verification in post-quantum cryptographic protocols.
Trong Binh Hoang, Duong Dinh Tran, Canh Minh Do et al.· PeerJ Computer Science· 0 citations
Advancements in quantum computing pose critical risks to classical cryptographic systems that rely on the computational hardness of integer factorization and discrete logarithms. This paper presents an evaluation of quantum resistant key exchange mechanisms, emphasizing the BB84 Quantum Key Distribution (QKD) protocol and exploring emerging alternatives such as muon-based randomness for key generation. An implementation of the BB84 protocol using Microsoft’s Q# quantum programming language demonstrates its effectiveness in detecting eavesdropping through observable disturbances in quantum states. Simulations under both secure and compromised conditions confirm the protocol’s resilience against quantum based interception. Practical considerations such as scalability, noise tolerance, and hardware constraints are addressed, offering insight into the deployment challenges of QKD systems. Additionally, a comparative perspective is provided between quantum native approaches and post-quantum classical cryptographic solutions, including lattice-based schemes. The analysis supports the development of hybrid cryptographic infrastructures capable of withstanding quantum threats, thereby contributing to the future of secure communication systems.
M. Nayeem· International Conference Com...· 0 citations
Internet public-key cryptography faces long-term risk from quantum computers, especially when traffic can be collected now and decrypted later. After the NIST post-quantum cryptography standards, the deployment task has shifted from algorithm selection to protocol migration. This paper reviews ML-KEM hybrid key exchange in TLS and SSH through a standards-first narrative review and protocol comparison. It synthesizes NIST standards, RFCs and IETF drafts, experiments, measurements, and primary deployment reports. The paper develops a deployment-readiness framework with four layers: security continuity, protocol integration, operational observability, and crypto-agility. The analysis shows hybrid key exchange represents the most feasible short-term solution, as it introduces post-quantum confidentiality without discarding existing elliptic curve security guarantees. However, hybrid deployment does not provide full post-quantum security. The review argues that readiness depends on protocol binding, implementation behavior, monitoring, and governance as much as on algorithm strength. Handshake size, middlebox compatibility, implementation safety, telemetry, authentication migration, and organizational crypto-agility determine whether migration can progress without weakening current Internet security.
Yan Zhang· Applied and Computational En...· 0 citations