The emergence of quantum computing poses a threat to classical cryptography algorithms, necessitating a shift to quantum secure cryptography. Hybrid protocols combining at least one classical and one quantum-resistant cryptographic algorithm are becoming the standard for securing communications. In this work, we present our novel solution for integrating three different cryptographic assumptions (two of them quantumresistant) into hybrid network security protocols, ensuring that three different cryptographic assumptions must be broken before the protocol becomes vulnerable. Our solution allows for a seamless integration of classical and post-quantum (PQ) cryptography, and quantum key distribution (QKD) into existing network security protocols (e.g., TLS, IPsec) without any major modifications to the protocols themselves. This crypto-agility ensures the mitigation of some of the most well known challenges of both PQ cryptography and QKD. Our findings demonstrate the feasibility of such triple-hybrid network security protocols, showing non-substantial decrease in performance and almost no added packet overhead compared to state of the art protocols. In exchange, we pave the way towards next generation networks where the potential of new quantum-resistant cryptographic schemes can be leveraged in a dynamic and agile fashion, thus fostering a new era of unbreakable communication systems.

Quantum key distribution (QKD) is a symmetric key exchange mechanism designed to enhance the security of current communication systems. Although QKD provides unconditional security, it also comes with deployment challenges. One challenge is the distance limitation between the transmitter and receiver, which restricts the large-scale adoption of QKD. To overcome this, trusted relays are used as intermediate nodes, allowing QKD to evolve from distance-limited point-to-point connections to unlimited QKD networks (QKDN). With an increasing deployment of QKD and a growing number of applications requesting keys, quality of service (QoS) constraints must be set for efficient key resource management to alleviate the risk of rejecting application requests. In this work, we integrate key delivery delay and maximum requested key size as QoS constraints in a novel key allocation algorithm built on three QKDN layers – quantum, key management and service. Moreover, we design key relaying using quantum key pools and virtual quantum key pools as storage mechanisms. We use static and dynamic weights for relay path computation and evaluate their impact on the proposed key allocation strategies with QoS constraints and find that static weights show a good overall performance for QKDN, while performance with dynamic weights varies based on historical key consumption data.