Transcript-Bound Combiners for Downgrade-Resilient Hybrid Post-Quantum Key Establishment: Definition, Proof, and Embedded-Device Cost
Researchers prove transcript-bound hybrid KEM combiners stop downgrade attacks, adding one hash and no extra messages.
Hybrid key establishment with ML-KEM and classical Diffie-Hellman protects the session key but not negotiation integrity when deployed without a handshake transcript. The paper defines a combiner-layer security game and proves that a combiner ignoring the transcript can be downgraded with certainty, while binding the session key and confirmation tag to a transcript hash blocks such attempts up to a negligible term for a 256-bit hash. On Cortex-M4, transcript binding adds one hash per party—about 11.8% of handshake computation and 1.5% of radio-inclusive energy—with no extra messages or bytes. Measurements come from a released harness that passes a 30-check validation gate.