A sign-less key exchange aims to secure IoT networks post-quantum

Researchers have developed HPQ-AKE, a new authenticated key exchange protocol that reduces handshake transmission by 56.4%, shrinking data sent during connection setup from 13,009 to 5,668 bytes. The protocol addresses a critical challenge for bandwidth-constrained Internet of Things and edge networks as they transition to post-quantum cryptography. HPQ-AKE replaces post-quantum transcript signatures with dual KEMs, combining ML-KEM-768 for session secrecy with RSA-OAEP for authentication, and Modeled latency also falls by 31.4% on a simulated satellite link, dropping from 2,791 to 1,914 milliseconds.

HPQ-AKE: Sign-Less Post-Quantum Key Exchange for IoT Gateways

The design preserves compatibility with existing RSA-enabled infrastructure, easing the transition to post-quantum cryptography for IoT gateways and edge computing environments. This strategy addresses a key challenge: balancing security with the limited bandwidth and processing power of many IoT deployments. The protocol’s security rests on a formal analysis within an extended Bellare-Rogaway model, separating classical authentication, verified using the Random Oracle Model, from session-key secrecy, which relies on the Quantum Random Oracle Model.

This separation allows for a rigorous assessment of HPQ-AKE’s resistance to both classical and quantum attacks, establishing Authenticated Key Exchange (AKE) security, forward secrecy and conditional Key Compromise Impersonation (KCI) resistance under specific exposure assumptions. Evaluations demonstrate a 31.4% reduction in modeled latency on a satellite link.

ML-KEM-768 and RSA-OAEP Enable Hybrid Authentication

HPQ-AKE uses existing RSA infrastructure alongside post-quantum cryptography, reducing handshake transmission sizes by 56.4 percent, a shift from 13,009 to 5,668 bytes. By preserving compatibility with current RSA-enabled systems, HPQ-AKE minimizes disruption during the upgrade process, while the protocol’s security analysis separates classical authentication from quantum-resistant key establishment, a key architectural decision. Beyond reduced handshake size, HPQ-AKE also demonstrates improvements in latency, particularly relevant for real-time applications.

This performance gain stems from the hybrid design, which strategically uses RSA for authentication while relying on ML-KEM-768 to establish post-quantum confidentiality. The work’s rationale centers on a communication-aware approach, anchoring confidentiality in the Module-LWE assumption while maintaining compatibility through RSA-based mutual implicit authentication.

Formal Security Analysis in Extended Bellare-Rogaway Model

The formal security underpinning of HPQ-AKE relies on an extended Bellare-Rogaway model, moving beyond standard authenticated key exchange (AKE) frameworks to account for specific exposure scenarios. The model defines security through the Session Key Indistinguishability (SK-Security) game, simulating adversaries with Send, Reveal, and Corrupt oracles to test the robustness of the generated session keys. All security bounds are scaled by a factor accounting for concurrent sessions across the network, reflecting a realistic assessment of potential adversarial reach.

The Test oracle, a core component of the security game, evaluates the cryptographic strength of the protocol by returning either the actual session key or a uniformly random string, challenging an adversary to distinguish between the two. The resulting indistinguishability advantage, represented as 𝖠𝖽𝗏𝒜 𝖧𝖯𝖱 𝖠𝖪𝖤, quantifies the protocol’s resistance to key recovery attacks.

To accurately model the transitional nature of HPQ-AKE, the security analysis divides the assessment, acknowledging the hybrid deployment scenario where RSA-enabled infrastructure coexists with post-quantum cryptography.

Module-LWE and RSA Assumptions Underpin HPQ-AKE Security

The protocol’s security analysis uses a framework extending the Bellare-Rogaway model, separating classical authentication from quantum-resistant session-key secrecy. This division acknowledges the transitional nature of network infrastructure, where both classical and post-quantum cryptography may coexist during migration. Evaluation of HPQ-AKE combined x86 micro-benchmarking, analytical latency modeling and a 10,000-iteration Monte Carlo simulation to assess performance. Local computation requires 7.11 milliseconds on the measured x86 testbed, indicating a low processing overhead.

The design also addresses network latency, a critical factor for bandwidth-constrained devices. Under simulated conditions mirroring a satellite link with 600ms Round Trip Time and stochastic jitter, HPQ-AKE achieved a median latency of 1,914 milliseconds. The work’s rationale centers on a communication-aware approach, anchoring confidentiality in the Module-LWE assumption while maintaining compatibility through RSA-based mutual implicit authentication.

Perfect forward secrecy is provided, as the ephemeral ML-KEM secret is purged after handshake completion via SecureErase. Under the Module-LWE and RSA assumptions, it establishes AKE security, forward secrecy and conditional KCI resistance under the long-term-key-only exposure assumptions.

HPQ-AKE reduces modeled handshake transmission from 13,009 to 5,668 bytes, a 56.4% reduction relative to a Hybrid TLS 1.3 Full handshake, while requiring 7.11 ms of total local computation on the measured x86 testbed.

31.4% Lower Latency on Simulated 50 kbps Satellite Links

The protocol’s efficiency was assessed through 10,000-iteration Monte Carlo simulations characterizing the architectural trade-offs at play. This represents a 31.4% decrease from the 2,791 milliseconds observed with the standard Hybrid TLS 1.3 Full handshake, though it remains slower than a perfectly pre-cached TLS connection. “Relative to the 13,009 Bytes Hybrid TLS 1.3 Full handshake payload, HPQ-AKE therefore achieves a 56.4% protocol-level reduction,” emphasizing the magnitude of the data savings. While a 1.5-RTT structural requirement introduces a propagation penalty, the modeled optimization against the standard Full handshake demonstrates a viable path toward securing low-bandwidth IoT networks.

7.11 ms Measured Local Computation on x86 Gateway

The x86 testbed used in evaluating HPQ-AKE registered 7. HPQ-AKE requires 7.11 ms of total local computation on the measured x86 testbed.

These simulations mirrored a satellite link with 600 millisecond Round Trip Time and incorporated stochastic jitter, representing realistic network impairments. Modeled latency falls by 31.4% on a 50 kbps satellite-IoT link.

This compression, achieved by replacing post-quantum transcript signatures with dual KEMs, lowers the total handshake payload from 13,009 to 5,668 bytes. This smaller payload is especially beneficial for bandwidth-constrained networks, where minimizing data transmission is important for maximizing throughput and reducing costs. The team’s work demonstrates a viable path toward post-quantum security for IoT and edge devices without sacrificing performance. The architecture allows for continued use of existing RSA-enabled infrastructure during the transition to post-quantum cryptography, minimizing disruption for network operators.

This improvement is particularly relevant for applications demanding quick responses, as delays can significantly impact performance in IoT networks. The work proposes a hybrid authenticated key exchange designed for efficient migration to post-quantum key establishment, using a dual-layer KEM construction. ML-KEM provides post-quantum session-key confidentiality, while RSA-OAEP facilitates mutual implicit authentication by reusing existing RSA public keys.

This approach, detailed in the paper, aims to minimize the overhead associated with transitioning to new cryptographic standards, offering a practical pathway for securing bandwidth-constrained IoT and edge networks. The team’s analysis establishes conditional KCI resistance and ROM authentication, providing a strong foundation for secure communication.

Conditional KCI Resistance with Long-Term Key Exposure

Under Module-LWE and RSA assumptions, the protocol establishes authenticated key establishment, forward secrecy and conditional KCI resistance specifically when only long-term keys are exposed, a nuance key for phased cryptographic transitions. The dual-KEM design replaces traditional transcript signatures with a combination of ML-KEM-768 for session-key establishment and RSA-OAEP for implicit authentication, a structural choice that directly addresses bandwidth limitations. Conditional KCI resistance, as demonstrated, holds in classical, long-term-key-only impersonation experiments, contingent on the stated primitive and key-derivation assumptions.

More like this

Quantum CryptographyVersasec unlocks quantum-safe 3 benefits with vSEC, CMS 7.5 & Thales integration

Quantum SecurityEthereum’s leanVM is now formally verified for quantum resistance

Quantum CryptographyIntel chips speed up post-quantum encryption for IoT devices

Quantum SecurityHKUST and Hong Kong Monetary Authority launch tools to help banks prepare for quantum threats