Transcript-Bound Combiners for Downgrade-Resilient Hybrid Post-Quantum Key Establishment: Definition, Proof, and Embedded-Device Cost
Researchers prove transcript-bound hybrid KEM combiners stop downgrade attacks, adding one hash and no extra messages.
Hybrid key establishment with ML-KEM and classical Diffie-Hellman protects the session key but not negotiation integrity when deployed without a handshake transcript. The paper defines a combiner-layer security game and proves that a combiner ignoring the transcript can be downgraded with certainty, while binding the session key and confirmation tag to a transcript hash blocks such attempts up to a negligible term for a 256-bit hash. On Cortex-M4, transcript binding adds one hash per party—about 11.8% of handshake computation and 1.5% of radio-inclusive energy—with no extra messages or bytes. Measurements come from a released harness that passes a 30-check validation gate.
- Hybrid KEM alone does not authenticate which primitives were negotiated.
- Transcript binding blocks downgrade up to a negligible 256-bit hash term.
- Cortex-M4 cost is one extra hash: 11.8% compute, 1.5% energy.
- Binding adds no messages or bytes on the wire.
- Design targets hybrid ML-KEM use in TLS, SSH, and IKE.
From the original article
1 min read at arxiv.orgHybrid key establishment runs a post-quantum key-encapsulation mechanism (KEM) alongside a classical Diffie-Hellman primitive, so that the session key stays secure while either component resists attack. This design is now standardized in the Transport Layer Security protocol, Secure Shell, and the Internet Key Exchange, with the standardized module-lattice KEM (ML-KEM) as the post-quantum component.
By Bhanwar Gupta · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.