The evolution of quantum technologies has introduced new challenges and technologies for secure communication. Concretely we refer to the menace of the Shor’s algorithm executed by a Cryptographically Relevant Quantum Computer (CRQC) and the corresponding solutions, Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD), each one with their pros and cons. The hybridization of quantum and post-quantum cryptographic keys is an optimal solution that ensures secure, flexible, and efficient key derivation in a post-quantum world. This solution is essential for transitioning IPsec (Internet Protocol Security) [1] to a quantum-resistant approach, effectively securing IPsec tunnels against CRQCs while overcoming the limitations of legacy protocols such as IKEv2 [2], ensuring a seamless and efficient transition. By integrating classical cryptography with QKD and PQC through recommendations from NIST for cryptographic key generation [3], and using standardized interfaces like ETSI QKD 004 [4], the hybridization offers a robust and flexible solution, establishing a multi-layered defense designed with future threats in mind.
PQC, QKD, and KDF
Post-Quantum Cryptography (PQC) [5] is a classical cryptographic method aimed at resisting quantum computer attacks through complex mathematical problems. Its security cannot be demonstrated, since it is based on the fact that an efficient quantum algorithm to solve those problems is not known, and it is often implemented as a software-based, scalable, and open-source solution. One example of the integration can be done with liboqs [6], which provides implementation of PQC algorithms from NIST [7]. On the other hand, Quantum Key Distribution (QKD) [8] relies on the quantum properties of photons to securely distribute encryption keys. Unlike PQC, QKD’s security relies on the fundamental principles of quantum physics, making it theoretically secure against quantum-enabled attacks, but specific dedicated hardware is needed. The hybridization solution we propose leverages both technologies, allowing flexibility to switch between cryptographic sources and integrate future standards, using interfaces like ETSI QKD 004 [4] to ensure compatibility and adaptability. The hybrid key is computed using keys coming from QKD and PQC. Those component keys are combined through the so-called Key Derivation Functions.
A Key Derivation Function (KDF) [9] is a core cryptographic component that transforms some initial key material into a secure key for encryption or authentication. One common method is XORing, which uses a bitwise XOR operation to combine keys, providing a straightforward but effective way to ensure the security of the final key. Another method of key derivation is the Hash-Based Message Authentication Code (HMAC), which uses a cryptographic hash function and a secret key to produce a highly secure and random output, suitable for key generation. Additionally, there is a less conventional method named Xwing [10] (yes, like the Red Squadron starfighters), a hybrid Key Encapsulation Mechanism (KEM) that combines both classical and post-quantum techniques, leveraging X25519, a widely used elliptic curve key exchange scheme and ML-KEM-768, a post-quantum key encapsulation mechanism. These methods are some examples, but other alternatives may also exist; the goal is to ensure that our module can easily adapt to different methods, providing enhanced flexibility and security.
Within the QUBIP project, hybrid keys are derived through the Hybridization Module, which combines keys from multiple sources (PQC, QKD, and classical) using these methods, creating a robust final hybrid key that benefits from the strengths of each underlying technology. This hybrid approach provides multi-layer security, ensuring that even if one key exchange method is compromised, the derived key remains secure due to the redundancy provided by other sources, much like having multiple lines of defense. Additionally, the hybridization module offers flexibility and scalability by allowing users to select the desired KDF method and integrate different sources of keys, enabling them to adapt their security measures to specific operational needs.
Hybridization Module for IKE-less IPsec
The Hybridization Module is central to migrating IPsec to a quantum-secure state in QUBIP. The idea is to replace the legacy IKEv2 protocol with a Software-Defined Networking (SDN) solution. Its design integrates quantum and post-quantum technologies to establish a robust security architecture that supports dynamic management of IPsec tunnels within the Centrally Controlled IPsec (CCIPS) architecture.
In this system, the CCIPS Controller works in coordination with various Agents to manage Security Association (SA) configurations across the network. When a new IPsec connection is required, agents contact their local Hybridization Module to request a hybrid key, which is generated combining symmetric keys from sources such as QKD nodes, PQC algorithms, and classical cryptographic techniques. The module uses standardized interfaces like ETSI QKD 004, ensuring compatibility with any QKD manufacturer, liboqs for PQC keys, and libraries such as Cryptography for classical keys. These keys are then processed using KDF techniques such as concatenation, XOR, or HMAC-based extraction, ultimately providing a secure hybrid key to the agent for effective IPsec tunnel protection.
Conclusion
The Hybridization Module presents a forward-looking solution for securing IPsec communication in the quantum era. By combining QKD, PQC, and even classical cryptographic methods, the solution ensures multi-layered defense against both classical and quantum threats. Its modular design, seamless integration with standardized interfaces, and adaptability to evolving cryptographic advancements make it ideal for transitioning smoothly towards quantum-resistant security. As quantum technologies continue to advance, the Hybridization Module stands as a resilient and flexible solution, ensuring long-term security in a rapidly changing landscape.
