💻 computer science

Onion-Routed Multi-Circuit Key Establishment for Quantum-Resilient Sessions

This paper proposes and implements a quantum-resilient session-key establishment scheme that distributes encrypted key fragments across multiple independent Tor circuits to mitigate harvest-now-decrypt-later threats, achieving an average latency of 13–20 seconds while trading off responsiveness for enhanced privacy.

Original authors: Tushin Mallick, Ashish Kundu, Ramana Kompella

Published 2026-05-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Tushin Mallick, Ashish Kundu, Ramana Kompella

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "Harvest Now, Decrypt Later" Trap

Imagine you send a secret letter today using a lock that is currently unbreakable. However, scientists predict that in 10 or 20 years, a super-powerful "Quantum Computer" will be invented that can snap that lock open instantly.

The danger isn't just that the lock might break in the future; it's that a spy could steal your locked letter today, store it in a vault, and wait until that super-computer arrives to unlock it. This is called "Harvest Now, Decrypt Later." Even if your secret is only meant to stay safe for a few years, the threat is real right now because the spy doesn't need to break the lock today; they just need to keep the letter.

The Solution: The "Onion-Routed Puzzle"

The authors propose a new way to share a secret key (the combination to your lock) that makes it incredibly hard for a spy to know which pieces belong to which conversation, even if they steal all the pieces.

Think of it like this:

The Secret Key: Imagine you have a golden key you need to send to a friend.
The Puzzle Pieces: Instead of sending the whole key in one envelope, you chop it into 10 tiny, useless puzzle pieces. You put each piece in its own separate envelope.
The Onion Network (Tor): You don't send these envelopes through the regular mail (the normal internet), where a spy could easily track the sender and receiver. Instead, you send them through a "Ghost Mail" system (Tor).
- In this system, the mail goes through a series of random post offices (relays). Each post office peels off one layer of the address, but no single post office knows both who sent it and who it's for.
The Magic Trick (New Circuits): This is the most important part. For every single puzzle piece, you create a brand new, unique "Ghost Mail" route. You don't reuse the same path.
- Piece 1 goes on Route A.
- Piece 2 goes on Route B.
- Piece 3 goes on Route C.
- ...and so on.

Why This Stops the Spy

The spy is watching the "Ghost Mail" network. They can see pieces of mail going in and coming out.

If you sent all 10 pieces on the same route, the spy could easily match the 10 pieces and say, "Aha! These 10 pieces belong to Alice and Bob!"
But because you sent them on 10 completely different, random routes, the spy has to catch every single one of those 10 routes at the exact same time to know they belong together.

The paper calculates that if the spy controls 5% of the mail network, the chance of them catching all 10 routes by accident is so small it's practically zero (like winning the lottery 20 times in a row). Even if they steal the pieces and wait for the Quantum Computer to open the envelopes, they won't know which 10 pieces to put together to make the key.

The Trade-off: Speed vs. Privacy

The researchers built a working prototype of this system. Here is what they found:

It works: The system successfully splits the key, sends it through the Ghost Mail network, and the friend can put the pieces back together.
It's slow: It takes about 13 to 20 seconds to do this.
Why is it slow? About 88% of that time is just waiting for the "Ghost Mail" network to build those 10 separate, random routes. It's like waiting for 10 different buses to arrive at different stops before you can start your trip.

The Bottom Line

This paper doesn't invent a new type of lock (the encryption itself is still standard). Instead, it invents a new way to deliver the key.

The Good: It protects against spies who steal data today and wait for future super-computers to unlock it, because the spy can't figure out which data belongs to which conversation.
The Bad: It is slow. It's not good for things that need to happen instantly (like a video call), but it might be perfect for sending highly sensitive documents that need to stay secret for decades.

The authors conclude that while the system is a bit sluggish, the privacy it offers is worth the wait for high-stakes secrets.

Technical Summary: Onion-Routed Multi-Circuit Key Establishment for Quantum-Resilient Sessions

Problem Statement
Current secure communication relies on public-key primitives (RSA, Diffie–Hellman, ECC) vulnerable to Shor's algorithm on a sufficiently capable quantum computer. This creates a "harvest-now, decrypt-later" (HNDL) threat model where adversaries archive ciphertext today to decrypt it retroactively once a cryptographically relevant quantum computer (CRQC) becomes available. While Post-Quantum Cryptography (PQC) standards (e.g., NIST's FIPS 203/204/205) are emerging, migration is hindered by constrained endpoints and the fact that metadata (knowing who communicated with whom and when) remains sensitive. Even if the payload is encrypted with PQC, an adversary who can link the metadata of a session to specific endpoints can correlate future decryptions to those endpoints. Existing defenses often protect the payload but leave the metadata linkage intact.

Methodology
The authors propose a session-key establishment scheme that distributes a freshly generated symmetric key as multiple, independently encrypted fragments across distinct, ephemeral Tor circuits. The system architecture comprises three components:

Quantum Key Management Server (QKMS): Generates a symmetric session key, partitions it into $n$ fragments, encrypts each under the client's public key (currently classical RSA in the prototype), and dispatches them.
Onion-Service Proxy: Acts as an intermediary. It receives the client's request, forwards it to the QKMS, receives the encrypted fragments, and forwards each fragment bundle to the client over a fresh, independent Tor circuit.
Client: A Tor onion service that requests the key, receives the fragments, decrypts them, and reconstructs the session key.

Key Mechanisms:

Multi-Circuit Distribution: The key is split into $n$ fragments. Each fragment is sent over a separate Tor circuit.
Ephemeral Circuits: The proxy uses the Tor controller's NEWNYM signal to force a new circuit for each fragment bundle, ensuring that no two fragments travel the same path.
Onion Services: Both the client and the proxy operate as Tor onion services, ensuring bidirectional anonymity (neither party reveals their IP address).
$(n, n)$ Secret Sharing: The design uses an all-or-nothing split; all $n$ fragments are required for reconstruction. This avoids the bandwidth overhead of threshold schemes while maintaining the security argument that an adversary must compromise every circuit to link the fragments.

Key Contributions

Instantiation over Public Tor: The authors implement the deferred anonymous-paths variant over the public Tor network, utilizing NEWNYM signals to obtain fresh paths for each fragment bundle.
Multi-Circuit Linkability Bound: The paper proves that an adversary surveilling a fraction $f$ of Tor relays can correlate all $n$ ephemeral circuits belonging to a single session with a probability bounded by approximately $f^{2n}$ . This assumes the circuits are approximately independent draws from the relay population.
Formalization of Anonymity-Preserving Reconstruction: The authors define the security property where an adversary cannot link the $n$ ciphertext fragments to a common pair of endpoints with probability significantly greater than uniform guessing, even if they can decrypt individual fragments later.
Prototype Implementation: A Flask-based prototype was deployed on AWS EC2, with both proxy and client running as Tor onion services, to measure end-to-end latency.

Results

Latency: The prototype completes a key establishment in 13–20 seconds on average, with a full observed range of 7–50 seconds.
Latency Decomposition: Approximately 88% of the latency is attributable to Tor-related delays (specifically the time required to build fresh circuits via NEWNYM and the six-hop onion-service rendezvous protocol). The remaining ~12% is due to cryptographic operations (encryption/decryption) and application logic, which are negligible.
Scaling: Latency scales approximately linearly with the number of fragments ( $n$ ) because each fragment incurs its own circuit-build delay.

Significance and Claims
The paper positions this work as a "companion" to the Aquaman protocol, focusing specifically on the linkability aspect of quantum resilience rather than the confidentiality of the payload itself.

Defense-in-Depth: The authors explicitly state that the scheme does not provide post-quantum confidentiality for the fragment payload (which is currently encrypted with classical RSA). Instead, it raises the cost of linking decrypted fragments to a specific session and endpoints. If an adversary captures and later decrypts a single fragment, they learn that fragment's plaintext, but without successfully correlating all $n$ circuits, they cannot attribute the reconstructed key to a specific pair of communicants.
Trade-off: The design accepts a significant latency penalty (13–20s) as the cost of achieving geometric decay in linkability probability ( $f^{2n}$ ). The authors argue this is acceptable for data requiring multi-year confidentiality lifetimes where HNDL is a primary concern, but note it may be unsuitable for latency-sensitive applications.
Limitations: The authors acknowledge that the security bound relies on the assumption of independent circuits, which is imperfect in Tor due to guard node pinning and bandwidth-weighted path selection. They also note that the prototype does not yet implement hybrid PQC KEMs for the wireline tunnels, which would be necessary for a production-ready, fully quantum-resistant solution.

In summary, the paper demonstrates that distributing key fragments across multiple, ephemeral Tor circuits can effectively break the linkability between a session's metadata and its endpoints, providing a practical, albeit latency-heavy, mitigation against HNDL threats in the transition period before universal PQC adoption.