💻 computer science

Quantum-Resilient Banking Transaction Security using DW-HKEM: A Hybrid RSA/ML-KEM Cryptographic Gateway with Real-Time

This paper presents and validates a practical, low-overhead hybrid cryptographic gateway (DW-HKEM) that combines RSA-256 and ML-KEM-768 to secure banking transactions against both current and future quantum threats while maintaining backward compatibility and real-time performance monitoring.

Original authors: Siddhaarth S Prabhu, Aswani Kumar Cherukuri

Published 2026-07-21

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Siddhaarth S Prabhu, Aswani Kumar Cherukuri

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling post office where everyone sends secret letters. For decades, the only way to keep these letters safe was to lock them in a specific type of metal box called "RSA." This lock is so complex that even the world's fastest supercomputers would take millions of years to pick it. But there's a catch: scientists have discovered a new kind of machine, a "quantum computer," that might one day be able to pick these locks in a blink of an eye. The scary part isn't just that these machines might arrive tomorrow; it's that bad guys are already stealing our locked letters today and hiding them in a vault, waiting for that future day when they can finally open them. This is called "Harvest Now, Decrypt Later."

To make matters trickier, the people who run the banks often treat their security systems like magic black boxes. They know the letters go in and come out, but they can't see inside to check if the locks are working correctly, if someone is trying to swap the lock for a weaker one, or if the system is getting tired. This paper steps into this high-stakes game of digital hide-and-seek to propose a new way to lock our letters that is safe from both today's thieves and tomorrow's quantum machines, while also giving the bank managers a pair of "X-ray glasses" to watch the locks in action.

The Paper's Big Idea: The Double-Lock System

The authors of this paper are worried about two things: the future threat of quantum computers and the current lack of visibility into how banking security actually works. To solve this, they built a new security gateway called DW-HKEM (which sounds like a robot's name, but stands for "Dual-Wrap Hybrid Key Encapsulation Mechanism").

Think of your bank transaction as a precious diamond you need to mail. In the old system, you'd put the diamond in a single, very strong metal box (the RSA lock). The paper argues this is risky because if a quantum computer shows up later, that single box can be smashed open, and the diamond is lost forever.

Instead, the authors propose a "Double-Lock" strategy. Imagine putting your diamond in a metal box, but then wrapping that entire box inside a second, invisible, super-tough force field made of a different material (called ML-KEM).

The First Lock (RSA): This is the old, familiar metal box. It keeps things safe from today's hackers and works with all the existing banking systems.
The Second Lock (ML-KEM): This is the new, quantum-resistant force field. It's based on a math puzzle that even quantum computers are expected to struggle with.
The Secret Sauce: To open the package, you need both keys. The system mixes the secrets from both locks together to create a single, super-strong key for the actual transaction.

The paper explains that even if a bad guy steals the "Harvest Now" data and waits for a quantum computer to break the first metal box, they still can't get the diamond because the second force field remains unbreakable. Conversely, if the new force field ever has a flaw, the old metal box is still there to protect the diamond. It's a "belt and suspenders" approach to security.

The "X-Ray Glasses" (Real-Time Monitoring)

The second half of the paper tackles the "black box" problem. The authors built a dashboard called CryptoX. Imagine a control panel for the bank's security that doesn't just say "All Good," but shows a live video feed of every single lock being clicked, how long it takes to click, and if any lock is clicking slower than usual.

If a hacker tries to slow down the system or swap a strong lock for a weak one, the dashboard would instantly show a spike in time or a weird pattern. This allows the bank's security team to spot trouble immediately, rather than waiting for a breach to happen.

What They Found (The Numbers)

The authors tested their new system by running it through 100 different trials, simulating real banking transactions. Here is what they measured:

Speed: The new double-lock system is incredibly fast. While generating the old RSA key took about 103.96 ms (milliseconds), the new quantum-safe part only took 0.63 ms.
The Cost: Adding the second lock to the system only added about 1.58 ms of total time to a transaction. The authors note that this is so fast that a human user would never notice it; it's like adding a fraction of a second to a video game loading screen.
Size: The trade-off is that the "envelope" gets a bit bigger. The new system's data packet is about 1,392 bytes, compared to the old 256 bytes. However, the authors argue that on modern internet connections, this extra size is so tiny that it doesn't slow down the transfer.

What They Don't Claim

It is important to note what this paper does not say. The authors do not claim that quantum computers are here today; they are preparing for a future where they might be. They also do not claim that their system is perfect forever; they admit that if the new "force field" math (MLWE) is ever cracked, the system relies on the old RSA lock as a backup. They measured this on a standard computer to show it can work, but they acknowledge that real-world banking servers are even more complex.

The Takeaway

This paper suggests that banks don't have to choose between "staying safe today" and "being safe tomorrow." By using this hybrid double-lock system, they can protect their customers' money from future quantum attacks without slowing down the internet or breaking their current systems. Plus, by adding the CryptoX dashboard, they finally get to see inside the black box, ensuring that every lock clicks exactly the way it should. It's a practical, measured step toward a future where your digital secrets stay secret, no matter how powerful the computers of the future become.

Technical Summary: Quantum-Resilient Banking Transaction Security using DW-HKEM

Problem Statement
The paper addresses two critical vulnerabilities in current financial infrastructure: the imminent threat of Harvest Now, Decrypt Later (HNDL) attacks and the operational obscurity of cryptographic systems.

HNDL Threat: Adversarial nation-states and threat actors are currently intercepting and archiving encrypted banking traffic (protected by RSA-2048) with the intent of decrypting it once Cryptographically Relevant Quantum Computers (CRQCs) become available. Since RSA relies on integer factorization, which Shor's algorithm can solve in polynomial time, data encrypted today remains vulnerable to future retroactive decryption.
Operational Obscurity: Existing banking systems treat encryption and decryption as "black-box" operations. Security teams lack real-time observability into cryptographic performance, making it difficult to detect algorithm downgrade attacks, resource exhaustion, library compromises, or to validate migration readiness for post-quantum standards.

Methodology
The authors propose and implement a Dual-Wrap Hybrid Key Encapsulation Mechanism (DW-HKEM) integrated with a real-time monitoring dashboard named CryptoX.

DW-HKEM Architecture:
- Hybrid Encapsulation: The system encapsulates a randomly generated AES-256 session master key ( $M$ $M$ ) using two distinct mechanisms simultaneously:
  - RSA-2048 (OAEP-SHA256): Ensures backward compatibility with existing banking PKI and Hardware Security Modules (HSMs).
  - ML-KEM-768 (FIPS 203): A lattice-based Key Encapsulation Mechanism (KEM) providing quantum resistance based on the Module Learning With Errors (MLWE) assumption.
- Key Derivation: The shared secrets from both encapsulations ( $S_{RSA}$ and $S_{KEM}$ ) are concatenated and hashed using SHA-256 to derive the final composite session key ( $K_{Session}$ ).
- Security Logic: This construction ensures that even if a future CRQC breaks RSA, the session key remains secure as long as the MLWE assumption holds. Conversely, if the lattice assumption were broken, the RSA layer provides a security backstop. This combinatorial approach protects against both classical and quantum adversaries.
CryptoX Real-Time Dashboard:
- A Flask-based web application that provides live analytics on cryptographic operations.
- It tracks execution times (using time.perf_counter), operation counts, and session statistics.
- It visualizes trends via Chart.js to detect anomalies (e.g., sudden latency spikes indicating library compromise) and aids in capacity planning and migration validation.
Implementation Details:
- Built in Python using the Open Quantum Safe (OQS) library (liboqs v0.10.0) for ML-KEM operations.
- The system was tested on a Windows 11 x86-64 workstation with Python 3.12.2.
- Benchmarks were conducted over 100 independent iterations with fresh key pairs to avoid caching artifacts.

Key Contributions
The paper claims the following specific contributions:

Design and Implementation of DW-HKEM: A hybrid framework combining RSA-2048 and ML-KEM-768 specifically tailored for banking transaction security.
Hybrid Key Derivation: An improved KDF design that creates a 2-layer protection for session keys using SHA-256, ensuring security against both classical and quantum threats.
Real-Time Observability: Development of the CryptoX dashboard, which moves cryptographic operations from a "black-box" state to a fully observable state, allowing for anomaly detection and SLA validation.
Empirical Benchmarking: Comprehensive performance testing measuring computational latency and communication overhead in a simulated financial environment.
Threat Modeling: A comparative analysis of the proposed system against the HNDL threat model, demonstrating its resilience compared to traditional RSA-only systems.

Experimental Results

Latency: The total overhead for the DW-HKEM handshake (excluding key generation, which is typically a one-time cost) is approximately 1.58ms.
- RSA-2048 decapsulation: ~8.20 ms.
- ML-KEM-768 decapsulation: ~0.10 ms.
- The hybrid approach adds only ~0.96ms of overhead per handshake compared to pure RSA, a difference the authors state is imperceptible to end-users (human-perceptible threshold >100ms).
Key Generation: ML-KEM-768 key generation is significantly faster (0.63 ms) compared to RSA-2048 (103.96 ms), offering a 99.39% speedup.
Communication Overhead: The hybrid approach increases ciphertext size significantly.
- RSA-2048 Ciphertext: 256 bytes.
- DW-HKEM Ciphertext (RSA + ML-KEM): 1,392 bytes.
- This represents a ~444% increase in ciphertext size and a ~453% increase in combined handshake size. The authors note that while this is a bandwidth penalty, the transmission latency impact on high-speed enterprise networks (1 Gbps) is negligible (~0.009 ms).

Significance and Claims
The paper positions the DW-HKEM architecture as a practical, scalable reference for the financial sector's transition to the post-quantum era.

Mitigation of HNDL: By ensuring that session keys are derived from both RSA and ML-KEM, the system renders archived traffic useless to future quantum attackers who can only break one of the two primitives.
Regulatory Compliance: The system aligns with emerging NIST standards (FIPS 203) while maintaining backward compatibility with legacy systems (FIPS 186), facilitating a smoother regulatory migration path.
Operational Visibility: The CryptoX dashboard addresses the "observability gap," providing security architects with the data needed to validate migration timelines, detect active attacks (like downgrade attacks), and ensure cryptographic agility.
Feasibility: The authors conclude that the minimal computational overhead (~1.58ms) and the ability to run on standard enterprise hardware make this architecture viable for immediate deployment in banking transaction security.

The paper explicitly states that complete source code is available on GitHub to support reproducibility and further development.

Technical Summary: Quantum-Resilient Banking Transaction Security using DW-HKEM

More like this