The emergence of quantum computing poses a threat to classical cryptography algorithms, necessitating a shift to quantum secure cryptography. Hybrid protocols combining at least one classical and one quantum-resistant cryptographic algorithm are becoming the standard for securing communications. In this work, we present our novel solution for integrating three different cryptographic assumptions (two of them quantumresistant) into hybrid network security protocols, ensuring that three different cryptographic assumptions must be broken before the protocol becomes vulnerable. Our solution allows for a seamless integration of classical and post-quantum (PQ) cryptography, and quantum key distribution (QKD) into existing network security protocols (e.g., TLS, IPsec) without any major modifications to the protocols themselves. This crypto-agility ensures the mitigation of some of the most well known challenges of both PQ cryptography and QKD. Our findings demonstrate the feasibility of such triple-hybrid network security protocols, showing non-substantial decrease in performance and almost no added packet overhead compared to state of the art protocols. In exchange, we pave the way towards next generation networks where the potential of new quantum-resistant cryptographic schemes can be leveraged in a dynamic and agile fashion, thus fostering a new era of unbreakable communication systems.

The imminent advent of Quantum Computers poses a significant threat to the cryptographic algorithms supporting the public key infrastructure (PKI) of widely used communication protocols. High Performance Computing (HPC) data centers among other interested parties are well aware of the catastrophic consequences quantum attacks could have on their PKI and are consequently transitioning to Post-Quantum Cryptographic (PQC) methods, despite the substantial overhead this introduces for handling incoming network packets. This work addresses the transition to PQC within the context of the Cloud-Edge Continuum by integrating the Open Quantum Safe (OQS) library into the accelerated strongSwan developed by Mellanox for Data Processing Units (DPUs). This integration offloads cryptographic operations from central servers to data DPUs distributed across the cloud-edge continuum. Our solution ensures quantum security by providing PQ authentication through CRYSTALS-Dilithium or CRYSTALS-FALCON, PQ key exchanges via CRYSTALS-Kyber, and confidential data transmission using AES-256. Additionally, the deployment of this implementation on DPUs helps reduce the computational load on both HPC data centers and edge devices, promoting more efficient and secure operations across the entire cloud-edge continuum.

The reliance on asymmetric public key cryptography (PKC) and symmetric encryption for cyber-security in current telecommunication networks is threatened by the emergence of powerful quantum computing technology. This is due to the ability of quantum computers to efficiently solve problems such as factorization or discrete logarithms, which are the basis for classical PKC schemes. Thus, the assumption that communications networks are secure no longer holds true. Quantum Key Distribution (QKD) and post-quantum cryptography (PQC) are the first cyber-security technologies that allow communications to resist the attacks of a quantum computer. To achieve quantum-resistant communications, the aforementioned technologies need to be incorporated into a network security protocol such as Transport Layer Security (TLS). In this paper, we describe and implement two novel, hybrid solutions in which QKD and PQC are combined inside TLS for achieving quantum-resistant authenticated key exchange: Concatenation and Exclusively-OR (XOR). We present the results, in terms of complexity and security enhancement, of integrating state-of-the-art QKD and PQC technologies into a practical, industry-ready TLS implementation. Our findings demonstrate that the adoption of a PQC-only approach enhances the TLS handshake performance by approximately 9 % compared to classical methods. Furthermore, our hybrid PQC-QKD quantum-resistant TLS comes at a performance cost of approximately 117 % during the key establishment process. In return, we substantially augment the security of the handshake, paving the road for the development of future-proof quantum-resistant communication systems based on QKD and PQC.