Composable Post-Quantum Security for FADEC-Coupled Dual-Spool Turbofan Cyber-Physical Systems

Technical Summary: Composable Post-Quantum Security for FADEC-Coupled Dual-Spool Turbofan Cyber-Physical Systems

Problem Statement
The paper addresses the mathematical gap between post-quantum cryptography (PQC) and safety-critical aerospace control systems, specifically Full Authority Digital Engine Control (FADEC) coupled with dual-spool turbofan engines. Existing literature typically treats cryptographic security (e.g., lattice-based key encapsulation, authenticated encryption) and control-theoretic stability (e.g., surge margin, spool acceleration, torsional compliance) as independent domains. This separation fails to account for how PQC-specific factors—such as ciphertext expansion, attestation transcript length, and key-renewal entropy constraints—interact with real-time bus schedulability, communication latency, and physical plant stability. The authors argue that in safety-critical architectures, a system can be cryptographically authenticated yet fail to be "composably safe" if the cryptographic overhead violates timing or stability margins.

Methodology
The authors develop a unified mathematical formulation within a stochastic hybrid model where plant evolution, communication latency, leakage, adversarial channel quality, and cryptographic state evolve under a common filtration. The core methodology involves:

1. Unified System Model: The target system is modeled as a coupled tuple $S_\lambda$ comprising a stochastic engine model ($P_{eng}$), a FADEC controller, an abstract avionics bus ($B_{bus}$), a radar-aware communication channel ($C_{ch}$), a Physical Unclonable Function (PUF) source, and post-quantum primitives (KEM, AEAD, Zero-Knowledge proofs).
2. Coupled Parameter Domain: The analysis treats the system state as a product set $\Theta_{tot} = \Theta_{pq} \times \Theta_{puf} \times \Theta_{aead} \times \Theta_{bus} \times \Theta_{radar} \times \Theta_{eng} \times \Theta_{filt}$. Instead of optimizing these slices independently, the model certifies them on a single admissible set.
3. Threat Model: The adversary is a probabilistic polynomial-time entity capable of observing public traffic, obtaining bounded side-channel leakage (modeled via smooth min-entropy and R'enyi divergence), and injecting abstract transient faults. The model explicitly excludes procedural instructions for attacking real hardware.
4. Defensive Analytical Treatment: The paper uses Universal Composability (UC) frameworks to define ideal functionalities for key refresh, authentication, and integrity, then proves that the real protocol realizes these functionalities only when specific stability and schedulability predicates are met.

Key Contributions
The paper provides a "coupled theorem system" demonstrating that PQC migration in aerospace control cannot be assessed solely by key sizes or asymptotic hardness. Key technical contributions include:

• Radar and Doppler Impact on Key Renewal: The authors derive that radar-cross-section uncertainty and Doppler attenuation reduce adversarial channel capacity but simultaneously increase entropy loss ($\Delta H_{ch}$). This tightens the admissible key-renewal period ($T_{key}$), forcing more frequent refreshes in high-uncertainty environments.
• Ciphertext Expansion and Schedulability: The paper proves that post-quantum ciphertext expansion (specifically $O(\lambda \log \lambda)$ for lattice-based KEMs) directly increases bus response times ($R_i$). This expansion can push total latency beyond the "cryptographic actuation window" ($W_{act}$), causing the system to reject valid commands to preserve safety.
• Physical Leakage and Entropy: The model links physical parameters to cryptographic entropy. Specifically, blade-tip clearance perturbations ($\delta_{tc}$) and shaft vibration telemetry are shown to act as leakage channels, reducing the smooth min-entropy of PUF-derived keys and necessitating conservative alarm thresholds.
• Stability Margins under Latency: The authors establish a latency-induced input-to-state stability (ISS) bound. They show that total authenticated delay ($\delta_{tot}$) erodes the exponential decay rate of the closed-loop system, with the margin further reduced by fuel-flow saturation.
• Separation of Authentication and Composability: A critical theoretical result (Counterexample 1) demonstrates that a system can possess perfect cryptographic authentication (zero forgery, zero leakage) yet fail to be safely composable if real-time deadlines are missed due to cryptographic payload size.

Results
The paper derives several formal bounds and inequalities:

• Security-Stability Bound: A sufficient condition for composable release is established where the distinguishing advantage is bounded by the sum of cryptographic errors ($\epsilon_{kem}, \epsilon_{aead}, \dots$) plus the probability of deadline misses ($\epsilon_{bus}$) and stability margin violations ($\epsilon_{st}$).
• Renewal Policy: The key renewal period is shown to be a function of leakage rates from side channels, vibration, and radar uncertainty: $T_{key} \leq \frac{H^\epsilon_\infty(K_0) - \kappa_{min}}{\dot{\ell}_{side} + \dot{\ell}_{vib}|\delta_{tc}| + \dot{\ell}_{ch}}$.
• Schedulability Inequality: The paper proves that for a task to be schedulable, the total latency (bus response + verification + propagation delay) must be less than the minimum of the control deadline, spool acceleration limits, surge margin erosion limits, and torsional sampling requirements.
• Sensitivity Analysis: Symbolic evaluation shows that increasing ciphertext size ($L_{kem}$) monotonically reduces timing slack and stability margins, while increasing radar uncertainty ($V_\Sigma$) accelerates key renewal requirements.

Significance and Claims
The paper modestly claims to provide a mathematical assurance envelope rather than a new controller, bus, or cryptographic primitive. Its significance lies in:

1. Defining the Coupling: It explicitly characterizes how post-quantum security, real-time schedulability, and closed-loop stability interact in safety-critical aerospace control.
2. Identifying Failure Modes: It identifies specific parameter regimes where a "plausible cryptographic upgrade" (e.g., larger PQC ciphertexts) consumes the timing and stability slack required for safe propulsion control.
3. Defensive Scope: The authors emphasize that the model is a defensive analytical tool. It does not provide operational guidance for interfering with real platforms, nor does it replace engine certification artifacts. Instead, it defines mathematically auditable couplings that certification processes can instantiate and challenge.

The work concludes that post-quantum migration in safety-critical aerospace control requires a "coupled security-stability-latency envelope" formulated relative to an explicit observable attack surface, rather than a simple substitution of cryptographic algorithms.