Technical Summary: Implementing Hybrid Post-Quantum End-to-End Encryption

Problem Statement

Modern digital communication relies on public-key cryptographic systems (RSA, DSA, ECC) whose security depends on the computational intractability of integer factorization and discrete logarithm problems. The emergence of quantum computing, specifically Shor's algorithm, poses a fundamental threat to these systems, potentially rendering them obsolete. While large-scale fault-tolerant quantum computers do not yet exist, the "harvest now, decrypt later" threat model suggests that adversaries are already collecting encrypted data to decrypt once quantum capabilities mature. This necessitates an urgent transition to Post-Quantum Cryptography (PQC).

However, integrating PQC into existing secure communication systems presents significant challenges. NIST-standardized algorithms like CRYSTALS-Kyber (a lattice-based Key Encapsulation Mechanism) are highly effective for key exchange but are orders of magnitude slower than symmetric algorithms when processing bulk data. Consequently, using Kyber alone for encrypting large messages or real-time data streams is impractical. Furthermore, existing End-to-End Encryption (E2EE) systems (e.g., Signal, WhatsApp) rely on classical primitives that are vulnerable to quantum attacks, requiring a redesign that balances quantum resistance with the efficiency required for practical messaging.

Methodology

The authors propose and implement a hybrid E2EE system that combines the quantum resistance of PQC with the efficiency of classical symmetric encryption. The system operates under a zero-trust model, where a relay server facilitates communication but remains cryptographically blind, possessing no access to plaintext messages or cryptographic keys. All cryptographic operations occur exclusively at the client endpoints.

Core Components

1. Key Exchange (Kyber): The system employs CRYSTALS-Kyber-768, a NIST-standardized lattice-based KEM. It is used solely for establishing a shared secret between communicating parties (Alice and Bob). The security relies on the Module Learning With Errors (MLWE) problem, which is believed to be hard for both classical and quantum computers.
2. Key Derivation (SHA-256): The raw shared secret generated by Kyber is processed through the SHA-256 hash function. This step produces a deterministic, high-entropy, 256-bit session key suitable for symmetric encryption, ensuring uniformity and preventing potential implementation issues with raw KEM outputs.
3. Bulk Encryption (AES-256-GCM): The derived session key is used with AES-256-GCM (Galois/Counter Mode) for the actual encryption of message payloads. This provides authenticated symmetric encryption, ensuring both confidentiality and data integrity.
4. Architecture: The system utilizes a relay server (built with Flask and WebSockets) that forwards ciphertexts and encapsulated keys without decryption. The implementation uses standard libraries: pq-crystals-kyber (or liboqs) for PQC operations and PyCryptodome for AES and SHA-256.

Workflow

1. Key Generation: Users generate Kyber public/private key pairs locally.
2. Encapsulation: The sender (Alice) uses the recipient's (Bob) public key to encapsulate a shared secret, generating a ciphertext and the secret.
3. Derivation & Encryption: Alice hashes the shared secret via SHA-256 to derive an AES session key, then encrypts the plaintext message using AES-256-GCM.
4. Transmission: Alice sends the AES ciphertext and the Kyber encapsulation ciphertext to the relay server.
5. Decapsulation & Decryption: Bob receives the data, uses his private key to decapsulate the shared secret, derives the same AES session key via SHA-256, and decrypts the message.

Key Contributions

• Hybrid Architecture Design: The paper presents a complete architectural design integrating CRYSTALS-Kyber-768, AES-256-GCM, and SHA-256 into a functional E2EE system that adheres to a zero-trust relay model.
• Practical Implementation: Unlike purely theoretical frameworks, the authors provide a full, open-source implementation using standard cryptographic libraries (pq-crystals-kyber, PyCryptodome, Flask). This facilitates reproducibility and independent security auditing.
• Performance Characterization: The study conducts comprehensive performance analysis on commodity hardware (Intel Core i5, 8GB RAM), measuring key generation, encapsulation, decapsulation, and encryption/decryption times across varying message sizes.
• Security Analysis: The work establishes confidentiality under standard assumptions (IND-CCA2 security of Kyber, IND-CPA security of AES-GCM) and discusses forward secrecy through ephemeral key generation.

Experimental Results

The implementation was tested on standard hardware with Python 3.11. The results indicate that the integration of PQC introduces minimal overhead:

• Latency: Kyber key generation takes approximately 2 ms. Encapsulation and decapsulation take roughly 3.0 ms and 3.2 ms, respectively.
• End-to-End Performance: For typical small messages, total end-to-end latency remains under 10 ms.
• Cost Analysis: The system exhibits two cost classes:
  • Fixed Costs: Kyber operations and SHA-256 hashing are small, bounded costs (milliseconds) incurred per session.
  • Variable Costs: AES encryption/decryption scales linearly with message size. For large payloads, AES becomes the dominant factor, while for small messages, the Kyber overhead is more significant.
• Efficiency: The authors conclude that the fixed overhead of PQC is acceptable for real-time applications, especially when session keys are amortized across multiple messages.

Significance and Claims

The paper claims that NIST-standardized post-quantum cryptography can be effectively integrated into practical messaging systems without sacrificing performance characteristics required for real-time communication. By combining Kyber for quantum-safe key exchange with AES for efficient bulk encryption, the system offers protection against both classical and quantum adversaries.

The authors emphasize that their work focuses specifically on the cryptographic aspects (key exchange, encryption, integrity) rather than metadata protection or endpoint authentication. They assert that their hybrid approach fills a gap in the literature by demonstrating a practical, zero-trust application-layer implementation that maintains forward secrecy and confidentiality, providing a reference implementation for organizations transitioning to post-quantum secure messaging. The work concludes that such a hybrid quantum-classical system is feasible and ready for deployment in secure messaging and IoT contexts, provided that future optimizations (such as hardware acceleration and HKDF for key derivation) are considered.