Hamming Quasi-Cyclic (HQC) is a code-based key-encapsulation mechanism selected by NIST for post-quantum cryptography standardization, but it is challenging to deploy on resource-constrained devices due to its memory and computational costs. In this paper, we propose a novel software implementation of HQC, named MUTUALISM, which is deployable on resource-constrained devices. MUTUALISM builds on an efficient multiply-then-reduce method for sparse-dense polynomial multiplication that minimizes costly modular reduction operations. We further propose two variants of the multiplication algorithm that optimize memory footprint and computation throughput, respectively. We then present MUTUALISM as a unified and optimized implementation derived from fine-grained profiling of HQC. This implementation systematically integrates the aforementioned multiplication algorithms with additional optimizations throughout the HQC implementation pipeline, thereby reducing the memory footprint and improving end-to-end throughput. Our experiments on ARM Cortex-M4 show that MUTUALISM achieves a speedup of more than 57 times compared with PQClean while reducing the memory footprint by 80%. To the best of our knowledge, MUTUALISM is the first software-only HQC implementation deployable on resource-constrained devices with 64 KB of RAM across all security levels. This enables post-quantum key establishment on BLE-class IoT microcontrollers with only tens of kilobytes of SRAM, thereby bridging the gap between PQC standards and real-world wireless embedded deployments.

The trends of the increasing middleboxes make the middle network more and more complex. Today, many middleboxes work on application layer and offer significant network services by the plain-text traffic, such as firewalling, intrusion detecting and application layer gateways. At the same time, more and more network applications are encrypting their data transmission to protect security and privacy. It is becoming a critical task and hot topic to continue providing application-layer middlebox services in the encrypted Internet, however, the state of the art is far from being able to be deployed in the real network. In this paper, we propose a practical architecture, named PlainBox, to enable session key sharing between the communication client and the middleboxes in the network path. It employs Attribute-Based Encryption (ABE) in the key sharing protocol to support multiple chaining middleboxes efficiently and securely. We develop a prototype system and apply it to popular security protocols such as TLS and SSH. We have tested our prototype system in a lab testbed as well as real-world websites. Our result shows PlainBox introduces very little overhead and the performance is practically deployable.

The exhaustion of IPv4 addresses has led to the transition to IPv6 becoming a major task for the Internet. Providing IPv6 users with accessibility to IPv4 services has been one of the most challenging tasks during the IPv4/IPv6 transition. However, some protocols contain IP addresses in the application layer, resulting in incompatibilities in traversing the network-layer translators. In this paper, we propose a Generic Application Layer Translator (GALT), which is designed to bridge the gap between IPv6 clients and IPv4 cross-layer services for the IPv4/IPv6 translation scenario. To ensure correctness and efficiency, we propose a protocol description language that enables GALT to be aware of protocol semantics. We develop the GALT system and apply it to widely used protocols with cross-layer issues, including HTTP and SIP. Our evaluation shows that GALT correctly solves the cross-layer problem in IPv4/IPv6 translation, with efficient performance for practical services.