💻 computer science

Post-Quantum and Trust-Aware Authentication for Permissioned Vehicular Blockchains: Session-Amortized V2X Security with Historical Key Continuity

This paper proposes a hybrid authentication architecture for permissioned vehicular blockchains that combines post-quantum key establishment with session-bound message authentication codes and a trust-aware admission policy to drastically reduce communication overhead and latency while maintaining robust security against insider attacks across vehicle lifetimes.

Original authors: Md Shahanur Islam Shagor

Published 2026-09-18

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Md Shahanur Islam Shagor

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where cars talk to each other constantly, sharing information about traffic jams, slippery roads, and sudden stops to keep everyone safe. This conversation, known as vehicle-to-everything communication, relies on digital signatures to prove that a message is real and not a fake sent by a hacker. Today, these signatures use complex math based on prime numbers, a method that has worked well for decades. However, scientists know that powerful quantum computers, which are still being built, will eventually be able to break this math, leaving our roads vulnerable. The challenge for engineers is to switch to a new type of math that can withstand these future machines without slowing down the fast-paced conversation between cars, which happens thousands of times every second.

A researcher at Voronezh State University of Forestry and Technologies has proposed a new way to handle this transition for connected vehicles. The core problem is that the new, quantum-resistant math requires much larger digital signatures than the old system. If every single safety message sent by a car carried a full quantum signature, the wireless network would become clogged, causing dangerous delays. The researcher's solution is to separate the heavy lifting from the routine work. Instead of signing every single message with a large, complex quantum signature, the system uses a powerful quantum handshake only once to establish a secure session. Once that session is open, the cars switch to a much lighter, faster method to sign their ongoing messages, similar to how a driver might show their license at the start of a trip but then simply flash a pre-approved pass for every subsequent stop.

This approach, detailed in a recent study, combines this efficient session method with a smart system for judging trust. The researcher built a simulation to test how this would work in a busy traffic environment with hundreds of cars. The results showed that by using the heavy quantum signatures only for the initial connection and for occasional key updates, the amount of data sent with each routine message dropped dramatically. In the simulation, the data size for a standard message shrank from over 2,400 bytes down to just 74 bytes. This reduction allowed the system to process messages much faster; at a load of 500 active vehicles, the time it took to verify a message was cut from nearly 40 milliseconds to about 21 milliseconds. This speed is crucial because even a fraction of a second of delay can affect how quickly a car reacts to an emergency.

The system also includes a "trust-aware" layer that watches how vehicles behave, not just what they say. Even if a car has a valid digital key, it might be acting strangely, perhaps sending too many messages or contradicting what other sensors see. The new architecture tracks this behavior. If a vehicle starts acting suspiciously, the system quickly lowers its trust score and restricts its ability to send critical safety messages. However, if the vehicle behaves well again, it takes a long time for its trust score to recover. This design prevents a bad actor from simply pausing their attack for a few seconds to reset their status and then starting again. The simulation showed that this method could reject more than 96 percent of malicious messages from compromised vehicles while keeping the number of innocent cars mistakenly blocked to less than 2 percent.

Another vital part of this design is how it handles the long life of a vehicle. Cars stay on the road for many years, and their digital keys must be changed regularly to stay secure. The researcher introduced a way to sign the transition from an old key to a new one, creating a continuous, unbroken chain of history. This ensures that even after a key is rotated, past messages can still be verified as authentic, and no one can secretly swap a key to hide their tracks. The study confirms that this entire lifecycle—from the initial quantum handshake to the daily lightweight messages and the long-term key management—can work together without overwhelming the network. While the study was conducted through computer simulations rather than on real roads, the findings suggest that it is possible to secure the future of connected vehicles against quantum threats without sacrificing the speed and efficiency needed for safe driving.

Technical Summary: Post-Quantum and Trust-Aware Authentication for Permissioned Vehicular Blockchains

Problem Statement
Connected vehicle (V2X) systems face a dual challenge: the impending threat of quantum computers to current elliptic-curve cryptography and the practical constraints of high-rate safety messaging. While NIST has standardized post-quantum cryptography (PQC) algorithms like ML-DSA (Digital Signature Algorithm) and ML-KEM (Key Encapsulation Mechanism), their artifact sizes are significantly larger than classical counterparts. Applying a full ML-DSA signature (approx. 2,420 bytes) to every periodic V2X safety message creates prohibitive communication overhead, fragmentation risks, and verification latency. Furthermore, cryptographic authentication alone cannot distinguish between a legitimate credential holder and a compromised vehicle transmitting manipulated or rate-abusive data. Existing solutions often fail to integrate PQC migration, high-rate message amortization, behavioral trust management, and long-term key continuity into a single lifecycle.

Methodology
The paper proposes a lifecycle-oriented authentication architecture for permissioned vehicular blockchains that decouples infrequent public-key operations from high-rate message authentication. The system relies on three core mechanisms:

Session-Amortized Cryptography:
- Identity & Key Setup: Vehicles utilize ML-DSA-44 for durable signing identities and ML-KEM-512 for session establishment.
- Handshake: Upon entering a domain, a vehicle and an authenticator (RSU) perform a mutual post-quantum handshake. They exchange nonces, encapsulate secrets using ML-KEM, and sign the transcript with ML-DSA. This establishes a shared session secret ( $K_{i,r}$ ) derived via HKDF-SHA-256.
- Routine Messaging: Instead of signing every message, routine V2X envelopes are authenticated using a session-bound HMAC-SHA-256 tag derived from the session secret. This reduces the per-message cryptographic payload from kilobytes to a 32-byte tag plus compact headers.
Asymmetric Trust Management:
- The system employs a bounded trust state ( $T_i \in [0,1]$ ) updated based on authenticated evidence (authentication correctness, freshness, protocol consistency, and rate compliance).
- Asymmetric Dynamics: The model uses distinct gain parameters for recovery ( $\eta_{plus}$ ) and penalty ( $\eta_{minus}$ ), where $\eta_{minus} > \eta_{plus}$ . This ensures that trust degrades rapidly upon detecting violations but recovers slowly, preventing "behave-attack-recover" oscillation strategies.
- Admission Policy: Vehicles are categorized into three paths: Fast (high trust), Probation (uncertain), or Quarantine (low trust). Quarantined vehicles are blocked from safety-relevant actions but retain auditable history.
Historical Key Continuity:
- To manage key rotation over long vehicle lifetimes without breaking historical verifiability, the system requires a signed transition statement ( $\tau$ ) when rotating keys. The new generation signs a statement binding the new public keys to the previous generation's key.
- The ledger retains public verification material for historical generations, allowing past signatures to remain verifiable even after rotation, while preventing silent key replacement.

Key Contributions
The paper defines four specific contributions:

Session-Amortized Protocol: A protocol combining ML-DSA-44 identity authentication with ML-KEM-512 session establishment and symmetric MACs for routine traffic, avoiding per-message PQC signatures.
Asymmetric Trust Model: A trust-update mechanism where negative evidence reduces trust faster than positive evidence restores it, limiting strategic manipulation.
Signed Key Continuity: A mechanism ensuring that key rotations are cryptographically linked to previous generations, preserving the ability to verify historical data without retaining old private session keys.
Integrated Evaluation: A controlled discrete-event simulation quantifying the trade-offs between latency, communication overhead, and insider threat rejection compared to classical, pure PQC, and trust-only baselines.

Performance Results
Evaluated via a discrete-event simulation with up to 500 active vehicles and standardized NIST artifact sizes:

Latency: At 500 vehicles, the median authenticated-message latency is 20.8 ms for the proposed design, compared to 39.6 ms for a baseline using per-message ML-DSA signing.
Overhead: The amortized authentication overhead per routine message drops from 2,452 bytes (direct ML-DSA) to 74 bytes (session MAC + amortized handshake cost), a 97.0% reduction.
Threat Rejection: Under credential-holding insider attacks, the trust-aware policy rejects 96.2% to 98.1% of malicious messages after convergence, while keeping the rate of benign vehicles being quarantined below 1.6%.
Throughput: The proposed system sustains approximately 2,130 messages/second, outperforming the PQC-static baseline (1,320 msg/s) and approaching the classical ECC baseline (2,250 msg/s).

Significance and Claims
The paper argues that post-quantum vehicular authentication is practical only when key continuity, session amortization, and behavioral admission are designed as a unified security lifecycle rather than independent mechanisms. The author explicitly states that they do not introduce new cryptographic primitives; rather, the contribution lies in the integration of standardized NIST algorithms (ML-DSA-44, ML-KEM-512) with a trust-aware admission policy and a signed historical continuity layer.

The design addresses the specific constraint that vehicles and infrastructure must remain secure for decades, potentially outliving the migration horizon of classical cryptography. By moving expensive asymmetric operations to session setup and key rotation checkpoints, the system retains quantum resistance for identity and session establishment while maintaining the low-latency, low-bandwidth requirements of high-rate V2X safety traffic. The author notes that the evaluation is simulation-based and assumes specific service times for cryptographic operations; real-world deployment would require benchmarking on automotive-grade hardware and further validation of trust thresholds against actual misbehavior models.

Technical Summary: Post-Quantum and Trust-Aware Authentication for Permissioned Vehicular Blockchains

More like this