Post-Quantum Cryptographic Analysis of Message Transformations Across the Network Stack Ashish Kundu, Vishal Chakraborty, Ramana Kompella
arXiv:2604.08480v1 [cs.CR] 9 Apr 2026
Cisco Research {ashkundu, veec, rkompell}@cisco.com
Abstract—When a user sends a message over a wireless network, the message does not travel as-is. It is encrypted, authenticated, encapsulated, and transformed as it descends the protocol stack from the application layer to the physical medium. Each layer may apply its own cryptographic operations using its own algorithms, and these algorithms differ in their vulnerability to quantum computers. The security of the overall communication depends not on any single layer but on the composition of transformations across all layers. We develop a preliminary formal framework for analyzing these cross-layer cryptographic transformations with respect to post-quantum cryptographic (PQC) readiness. We classify every per-layer cryptographic operation into one of four quantum vulnerability categories, define how per-layer PQC statuses compose across the full message transformation chain, and prove that this composition forms a bounded lattice with confidentiality composing via the join (max) operator and authentication via the meet (min). We apply the framework to five communication scenarios spanning Linux and iOS platforms, and identify several research challenges. Among our findings: WPA2-Personal provides strictly better PQC posture than both WPA3-Personal and WPA2-Enterprise; a single post-quantum layer suffices for payload confidentiality but every layer must migrate for complete authentication; and metadata protection depends solely on the outermost layer. Index Terms—post-quantum cryptography, network security, layered encryption, PQC migration, message transformation
quantum computer could break the outer two layers using Shor’s algorithm [1] but would be unable to break the innermost layer. The message content remains confidential. However, by breaking the outer layers, the adversary learns that this device is communicating with Apple’s iMessage servers at specific times, metadata that the inner layer’s post-quantum protection cannot conceal. This example illustrates that the post-quantum security posture of a network communication is not determined by any single protocol or layer. It is determined by the composition of cryptographic transformations across the entire protocol stack, and different security properties (confidentiality, authentication, metadata protection) compose according to different rules. A. The Problem
The threat that quantum computing poses to public-key cryptography is well understood in isolation. Shor’s algorithm [1] efficiently factors integers and computes discrete logarithms, breaking RSA, Diffie–Hellman, and elliptic curve schemes. Grover’s algorithm [2] provides a quadratic speedup for bruteforce search, effectively halving symmetric key lengths. The “Harvest Now, Decrypt Later” (HNDL) threat model [3] makes migration urgent: an adversary recording encrypted traffic today can decrypt it once quantum computers arrive. I. I NTRODUCTION NIST has responded by standardizing three post-quantum Consider a user on an iOS device sending an iMessage to algorithms: ML-KEM (FIPS 203) for key encapsulation, another iOS user over a Wi-Fi network. The message begins as ML-DSA (FIPS 204) for digital signatures, and SLH-DSA plaintext at the application layer. Before it reaches the wireless (FIPS 205) as a hash-based signature backup. Migration medium, three independent cryptographic systems act on it guidance documents (NIST IR 8547, NSA CNSA 2.0) prescribe in sequence. First, Apple’s PQ3 protocol encrypts and signs timelines and algorithm choices. the message using a hybrid key encapsulation mechanism that What is missing, however, is a formal analysis of how combines Kyber-1024 (a post-quantum algorithm based on quantum vulnerability plays out across the layered structure lattice problems) with P-256 ECDH (a classical elliptic curve of real network communications. Existing guidance reasons scheme). Next, a TLS 1.3 session to Apple’s relay servers about protocols in isolation. For example, “migrate TLS encrypts the already-encrypted message using X25519 for to post-quantum key exchange,” “adopt ML-DSA for code key exchange and AES-256-GCM for symmetric encryption. signing”. They do so without addressing how multiple layers Finally, the Wi-Fi layer encrypts the entire IP packet (which of encryption and authentication interact. In practice, however, now contains the doubly-encrypted payload) using AES-128- a network session involves cryptographic operations at the CCMP, with keys derived through WPA3’s SAE handshake link layer (Wi-Fi), possibly the network layer (VPN), the (itself based on elliptic curve Diffie–Hellman). transport/session layer (TLS), and the application layer (endThe transmitted frame is thus triply encrypted: the innermost to-end encryption). These layers use different algorithms, layer (PQ3) uses post-quantum key exchange, the middle authenticate different entities, and protect different scopes of layer (TLS) uses classical elliptic curve key exchange, and traffic. Their PQC statuses may differ, and understanding the the outermost layer (WPA3) also uses classical elliptic curve system-level security requires understanding how those statuses key exchange. An adversary with a cryptographically relevant compose.
B. Our Approach Our goals in this paper are threefolds: 1) to develop a formal model that captures how cryptographic operations at each network layer transform a message and how each operation’s quantum vulnerability status can be classified; 2) to identify composition rules that determine the systemlevel PQC posture from per-layer statuses, and to prove that these rules have clean algebraic structure; 3) to apply this framework to platform configurations, revealing patterns that inform PQC migration strategy (including counterintuitive findings where stronger classical security correlates with weaker quantum security). We proceed by modeling the message transformation chain: the sequence of cryptographic operations applied to a message as it descends the sender’s protocol stack and, symmetrically, the inverse operations applied as it ascends the receiver’s stack. Each operation is classified by its quantum vulnerability. We then define how per-layer statuses compose and prove that the resulting algebra is a bounded lattice in which confidentiality and authentication are dual operators. We ground our analysis in the actual cryptographic algorithms negotiated by default in modern operating systems (Ubuntu 24.04 and iOS 17/18) over wireless networks. This produces verifiable claims about the PQC posture of real-world configurations.
(4) Research challenges. We formalize six research challenges on cross-layer PQC properties, including migration sufficiency, authentication necessity, the classical-quantum security tension, and metadata exposure depth. The rest of this paper is organized as follows. Section II motivates and formally states six research challenges. Section III develops the formal model of message transformation chains and PQC status classification. Section IV presents five case studies with detailed per-layer decomposition. II. R ESEARCH C HALLENGES In migrating a network to a safe post-quantum cryptography status faces a series of challenges that existing work does not answer. While NIST IR 8547 [3] prescribes which algorithms to adopt, it does not specify which layers to migrate first, how many layers need migration at all, or how to reason about the security of a partially migrated stack in which some layers are post-quantum and others are not. These are structural questions about how cryptographic protections at different network layers interact. In this section we formulate six research challenges. Their answers, we hope, will provide a principled basis for crosslayer PQC posture determination and migration planning. We answer Questions 1–3 and 5 completely in Section 5, provide a partial answer to Question 4, and present empirical evidence bearing on Question 6 through the case studies in Section 4. A. RC1: PQC Posture Composition
C. Contributions This paper makes the following contributions: (1) Formal model. We define the message transformation chain L2 ◦ L3 ◦ · · · ◦ L7 as a composition of per-layer cryptographic operations, each carrying a PQC status. We distinguish per-session operations (handshake/key exchange) from per-message operations (record-layer encryption) and formalize the dependency between them. In particular, that the effective PQC status of a symmetric cipher depends on the PQC status of the key exchange that produced its key material. (2) Composition algebra. We prove that PQC status composition across layers forms a bounded lattice on the totally ordered set S = {C-Unsafe < Q-Unsafe < Q-Weakened < Q-Safe}, with confidentiality composing via the join (max) operator and authentication via the meet (min). We prove these are lattice duals: confidentiality requires breaking all layers (redundant protection), while authentication requires breaking only one layer (independent attack surfaces). We show that metadata protection depends solely on the outermost layer. (3) Case studies. We analyze five scenarios. From Linux localhost to iOS-to-iOS iMessage, documenting the exact cryptographic algorithms at each active layer and computing per-layer and chain-level PQC statuses. These analyses reveal that WPA2-Personal (no public-key crypto) is more quantumresistant than WPA3-Personal (elliptic curve SAE) and WPA2Enterprise (certificate-based EAP-TLS), and that a single postquantum deployment (Apple’s PQ3) transforms the chain from Q-Unsafe to Q-Safe for confidentiality.
Question 1. Given a message transformation chain with n active cryptographic layers, each carrying a PQC status for confidentiality and authentication, do there exist closed-form composition rules that determine the chain-level PQC status for (a) payload confidentiality, (b) authentication, and (c) metadata protection? If so, what algebraic structure do these rules exhibit? Consider again, the iMessage scenario from Section 1. A message passes through three cryptographic layers, namely, WPA3 at Layer 2 (Q-Unsafe), TLS 1.3 at Layers 5 and 6 (Q-Unsafe), and Apple’s PQ3 protocol at Layer 7 (Q-Safe). What is the system-level PQC posture? A naïve approach, perhaps, might average the three per-layer statuses, or take the worst case across layers, or take the best case. However, as we will see, the correct answer depends on which security property one asks about. For confidentiality, the system is Q-Safe: the innermost encryption (PQ3, keyed via Kyber-1024) blocks decryption even after the outer two layers are broken. For authentication, the system is Q-Unsafe: each layer authenticates a different entity (WPA3 authenticates the access point; TLS authenticates Apple’s relay server; PQ3 authenticates the sending user), and a quantum adversary who forges any one of these can mount a man-in-the-middle attack at that layer’s scope regardless of what the other layers do. For metadata, the system is QUnsafe: an external observer sees only the outermost layer’s headers, so only that layer’s confidentiality status determines what metadata is exposed.
This three-way divergence indicates that the per-layer PQC statuses do not compose arbitrarily. There may be a small number of composition operators to characterize each security property that determine system-level posture from per-layer statuses in a predictable way. If such operators exist and can be characterized algebraically, they would provide a foundation for automated PQC posture determination across arbitrary network configurations. B. RC2: Confidentiality Sufficiency
and insert herself as a man-in-the-middle at that layer’s scope, within that layer’s trust relationship without disturbing the other layers’ authentication at all. The WPA3 access point’s quantum-safe authentication does not prevent an attacker from forging the TLS server’s certificate. The TLS server’s quantumsafe authentication does not prevent an attacker from forging iMessage sender identity. If this reasoning generalizes, then achieving Q-Safe chain authentication requires migrating authentication at every layer that currently uses public-key signatures. It would be impossible to have any single-layer migration that protects the rest, as there is for confidentiality. This asymmetry, if it can be proved formally, has significant consequences for migration timelines and resource allocation.
Question 2. What is the minimum number of layers that must be migrated to post-quantum key exchange to achieve Q-Safe chain confidentiality? Does the position of the migrated layer(s) matter for payload protection? And for metadata protection? Continuing with the iMessage example, observe that a single post-quantum layer, for example PQ3 at Layer 7, suffices to D. RC4: Migration Preference make the entire chain Q-Safe for payload confidentiality, even Question 4. Given an existing message transformation chain, though the outer two layers are Q-Unsafe. The message is what is the optimal ordering for layer-by-layer PQC migration encrypted inside PQ3 before it reaches TLS or WPA3. A that minimizes cumulative quantum risk? Does the answer quantum adversary who breaks WPA3 and TLS obtains the depend on whether the organization prioritizes confidentiality, PQ3 ciphertext but cannot decrypt it, because key exchange authentication, or metadata protection? in PQ3 uses Kyber-1024, which is not vulnerable to Shor’s Suppose an organization can migrate one layer per quarter. algorithm. The payload remains confidential. Which layer should it migrate first? If a single layer suffices for The practical implication is striking. An organization may confidentiality (RC2), then the first migration already achieves not need to migrate every layer to achieve quantum-safe quantum-safe payload protection. But the choice of which layer confidentiality for its data in transit. However, this observation to migrate first matters, because different layers protect different raises further questions. Does the observation generalize? Does payloads. The outermost layer protects metadata, namely, it hold for any number of layers, any layer positions, any network-level identifiers, traffic patterns, protocol fingerprints. combination of PQC statuses? And if one layer suffices, then The innermost layer, on the other hand, provides end-to-end which layer is it. Migrating the outermost layer (say, Wi- protection that survives intermediary compromise. For example, Fi) would protect both payload and metadata. Indeed, every even if the TLS termination point or VPN gateway is untrusted, header and every byte is encrypted before it leaves the device. application-layer encryption protects the payload. Migrating an inner layer (e.g., application-layer encryption) Authentication adds a further constraint. Since it requires all protects the payload but leaves all outer-layer metadata exposed. layers (RC3), the order in which layers are migrated determines The two choices lead to very different security outcomes even the window of vulnerability. If the outermost layer is migrated though both achieve one layer of post-quantum confidentiality. first, metadata is immediately protected but authentication remains fully vulnerable until the last layer has been migrated. C. RC3: Authentication Necessity Contrastingly, if the innermost layer is migrated first, the Question 3. What is the minimum set of layers that must be application gains end-to-end confidentiality first. However, migrated to post-quantum signatures to achieve Q-Safe chain metadata remains exposed throughout the migration period. authentication? Is it necessarily the case that all layers with The optimal ordering depends on which security properties the public-key authentication must be migrated? organization prioritizes, the sensitivity of different metadata Authentication exhibits different properties. In the iMessage types, and the threat model (passive HNDL collection viz. a scenario, all three layers use classical public-key authentication, viz. active man-in-the-middle). i.e, ECDSA-P256 for PQ3 message signing, ECDSA or RSA certificates for TLS server authentication, and SAE’s implicit E. RC5: Metadata Exposure EC-based mutual authentication for WPA3. The chain is Q- Question 5. For a message transformation chain with n layers, Unsafe for authentication despite having Q-Safe confidential- how deep does metadata exposure extend when the outermost k ity. This observation reflects a structural asymmetry between layers are quantum-vulnerable? Can the exposure depth d∗ be confidentiality and authentication in layered encryption. expressed as a closed-form function of per-layer PQC statuses? For confidentiality, the layers form nested encryption. An Breaking the outermost encryption layer does not immediadversary must go through all layers to reach plaintext, and one ately reveal the application plaintext. It reveals the following quantum-resistant layer blocks the chain. For authentication, layer’s headers. In the iMessage example, a quantum adversary each layer independently verifies a different entity’s identity. A who breaks WPA3 sees the inner IP packet: the device’s local IP quantum adversary who derives the private key behind any one address, the destination IP (Apple’s iMessage relay server), the layer’s certificate or signing key can impersonate that entity destination port (443), and the TLS record headers. The TLS
payload (containing the PQ3 ciphertext) remains encrypted. If with respect to quantum vulnerability (Section III-A), then the adversary then breaks TLS, they see the iMessage-specific model the sequence of cryptographic transformations applied metadata: recipient identifiers, message sizes, timestamps, and to a message as it traverses the protocol stack (Section III-B). delivery receipts. Only the PQ3 layer’s encryption blocks Finally, we decompose each layer’s transformation into its further exposure; the message content itself remains protected. constituent operations and define what determines a layer’s Metadata exposure is therefore not a binary outcome. It is effective PQC status (Sections III-D to III-F). Table III provides incremental: each successive layer that an adversary decrypts a summary of all notation for easy reference. reveals one additional level of protocol headers. This exposure stops at the first layer whose confidentiality is Q-Safe. The A. PQC Status Classification depth of exposure, i.e., the number of header levels revealed, We classify every instance of a cryptographic algorithm into depends on how many consecutive layers from the outermost exactly one of four categories, depending on how it is affected inward are quantum-vulnerable. We want to characterize this by quantum computation. The four elements are defined as depth precisely and understand what information is revealed follows: at each level. An algorithm is Q-Safe if no known quantum algorithm provides a meaningful advantage in breaking it. Examples F. RC6: Classical vs. Quantum Security Tension include ML-KEM-768, ML-DSA-65, AES-256, ChaCha20Question 6. Under what conditions does upgrading a proto- Poly1305, SHA-384, SHA-512, and HMAC-SHA-256. col’s classical security degrade its quantum security? Is this An algorithm is Q-Weakened if Grover’s algorithm [2] tension inherent to any replacement of symmetric mechanisms reduces its effective security level but the residual security with public-key mechanisms, or are there protocol designs remains strictly above 64 bits. The threshold matters: 64-bit that improve classical security without introducing quantum security has been demonstrated to be within reach of classivulnerability? cal brute-force attacks using modern distributed computing An unexpected pattern emerges from comparing Wi-Fi resources, so any post-quantum residual at or below 64 bits security modes. WPA2-Personal uses a pre-shared key and does not provide an adequate security margin. Examples of derives all session keys through symmetric operations. It uses Q-Weakened algorithms include SHA-256 (256-bit → 128-bit PBKDF2 for the pairwise master key, HMAC-SHA1 for the effective for preimage under Grover) and HMAC-SHA1 used message integrity check, AES key wrapping for group key with 160-bit keys (160-bit → 80-bit effective). AES-192 (→ delivery, and AES-128-CCMP for data encryption. No public- 96-bit) and AES-256 (→ 128-bit) remain Q-Safe rather than key cryptography is involved in the protocol. Therefore, it is Q-Weakened, because their post-Grover residual security (96 not suceptible to Shor’s algorithm. and 128 bits respectively) is comfortably above any feasibility Contrastingly, WPA3-Personal, designed as WPA2’s more threshold. secure successor, replaces the 4-way handshake’s key derivation An algorithm is Q-Unsafe if it is efficiently broken by with the SAE (Simultaneous Authentication of Equals) protocol, Shor’s algorithm [1] or a related quantum algorithm. This which performs elliptic curve Diffie–Hellman on the P-256 includes RSA, Diffie–Hellman, ECDH (including X25519 and curve [4]. SAE provides a genuine classical improvement by P-256), ECDSA, Ed25519, and DSA—the algorithms that addressing all of known weaknesses of WPA2-PSK. It resists underpin virtually all deployed public-key cryptography. offline dictionary attacks and provides forward secrecy. But Finally, an algorithm is C-Unsafe if it is already broken SAE also introduces an elliptic curve operation that is a direct or inadequate against classical (non-quantum) adversaries. target for Shor’s algorithm, where none existed before. Examples include DES, RC4, MD5, SHA-1 for collision The result is that upgrading from WPA2-Personal to WPA3- resistance, and RSA-1024. Personal improves classical security while degrading quantum security. The the PQC posture moves from Q-Weakened Definition 1 (PQC Status Set). The PQC status set is the (Grover-weakened symmetric crypto) to Q-Unsafe (Shor- totally ordered set broken elliptic curve crypto). The same pattern emerges when S = {C-Unsafe < Q-Unsafe < Q-Weakened < Q-Safe} upgrading from WPA2-Personal to WPA2-Enterprise. (1) We observe two concrete instances of this tension: If this equipped with the natural ordering from least secure to most tension is inherent, i.e., if replacing a symmetric mechanism secure. with a public-key mechanism to gain classical security necesWe classify individual cryptographic operations, not prosarily introduces quantum vulnerability, then it constrains the design space for transitional protocols and complicates migra- tocols. A single protocol such as TLS 1.3 may involve tion planning for organizations that must maintain backward multiple algorithms with different PQC statuses: X25519 (QUnsafe) for key exchange, ECDSA (Q-Unsafe) for server compatibility. authentication, HKDF-SHA384 (Q-Safe) for key derivation, III. F ORMAL M ODEL and AES-256-GCM (Q-Safe) for record encryption. Second, In this section, we develop our formal model. We begin by an algorithm’s PQC status depends on how it is used, not just on defining how individual cryptographic algorithms are classified what algorithm it is. AES-256 is Q-Safe as a symmetric cipher,
Upgrade
Classical effect
Quantum effect
WPA2-PSK → WPA3-SAE WPA2-PSK → WPA2-Ent.
Better (resists offline dict.) Better (per-user certs) TABLE I
Worse (Q-Weakened→ Q-Unsafe) Worse (Q-Weakened→ Q-Unsafe)
C ONTRASTING CLASSICAL AND QUANTUM EFFECT.
but if the key that feeds it was established via a Q-Unsafe key exchange, the effective confidentiality is Q-Unsafe—because a quantum adversary can recover the key. We make this notion precise in Section III-F. Table II summarizes the classification for algorithms that appear in our case studies. B. Message Transformation Chain A message originating at the application layer undergoes a sequence of cryptographic transformations as it descends the protocol stack toward the physical medium. We model each transformation as a function and the full sequence as a composition. Definition 2 (Layer Transformation). Let Li denote the cryptographic transformation applied at OSI layer i during message sending (encapsulation). Layer i receives a message Mi from the layer above and produces output Mi−1 = Li (Mi )
(2)
which becomes the input to layer i − 1. The index convention reflects the direction of encapsulation. Sending a message proceeds from higher layers (application, L7 ) to lower layers (data link, L2 ), so Li maps layer-i data to layer-(i−1) data. Layers that perform no cryptographic operations act as identity functions (Li (M ) = M with only non-cryptographic header prepending). Definition 3 (Sending Chain). For a message Mapp originating at the application layer, the sending chain is the composition Mout = L2 (L3 (· · · (L7 (Mapp ))))
(3)
where Mout is the frame transmitted on the physical medium. Definition 4 (Receiving Chain). The receiving chain reverses the sending process. Given received frame Mout , −1 −1 Mapp = L−1 7 (· · · (L3 (L2 (Mout ))))
(4)
where L−1 i
denotes the inverse transformation (decryption, verification) at layer i. Send/Receive Symmetry. The PQC status of Li and L−1 i are identical, because both the sender and receiver use the same negotiated algorithm for a given session. The sender encrypts with AES-256-GCM; the receiver decrypts with AES256-GCM. Both operations inherit the same PQC status. We therefore need only analyze the sending direction; the receiving direction is symmetric. Example 1 (Running Example: iOS-to-iOS iMessage). In the iMessage scenario from Section 1, the sending chain has three
active cryptographic layers. At Layer 7, Apple’s PQ3 protocol encrypts the message: M6 = LPQ3 (Mapp ). At Layers 5–6, a 7 TLS 1.3 session encrypts the PQ3 ciphertext: M4 = LTLS (M6 ). 5 At Layer 2, WPA3 encrypts the entire IP packet: Mout = LWPA3 (M4 ). The full sending chain is 2 PQ3 TLS Mout = LWPA3 L L (M ) (5) app 2 5 7 producing a triply-encrypted frame in which the application message is nested inside three independent layers of encryption. C. Active Layers and Protection Path In a given session, not every OSI layer performs cryptographic operations. We define the subset that does as active layer set. Definition 5 (Active Layer Set). For a given communication session, the active layer set is the ordered sequence A = (Li1 , Li2 , . . . , Lin )
(6)
containing exactly those layers that perform at least one cryptographic operation (key exchange, encryption, authentication, or integrity protection), ordered from outermost to innermost: i1 < i2 < · · · < in . In our running example, A = (L2 , L5-6 , L7 ) with n = 3. Contrast this to a simpler scenario, say, HTTPS over WPA2 with no application-layer encryption. Here, we have A = (L2 , L5-6 ) with n = 2. On a localhost connection with no TLS, A may be empty. D. Layer Decomposition and Operation Roles Each layer’s cryptographic transformation decomposes into individual operations, each serving a specific role. Definition 6 (Layer Decomposition). The transformation at layer Li decomposes into ki individual cryptographic operations: (k )
(k −1)
Li (Mi ) = fi i ◦ fi i (j)
(1)
◦ · · · ◦ fi (Mi )
(7)
(j)
Each operation fi has a PQC status σ(fi ) ∈ S and a role from the set {KEX, AUTH, ENC, INT, KDF}. We elaborate on these roles. KEX (key exchange) establishes a shared secret between communicating parties; if this shared secret is recoverable by a quantum adversary, all keys derived from it are also recoverable. AUTH (authentication) verifies peer identity via a digital signature or certificate; if the signature scheme is quantum-vulnerable, the identity can be forged. ENC (encryption) encrypts the payload using a symmetric or AEAD algorithm. INT (integrity) appends a MAC or AEAD
TABLE II PQC STATUS CLASSIFICATION FOR ALGORITHMS IN THIS STUDY. Algorithm
Role
Post-QC Security
Status
ML-KEM-768/1024 ML-DSA-65 AES-256-GCM ChaCha20-Poly1305 SHA-384/SHA-512 HMAC-SHA-256
KEX AUTH ENC ENC KDF/INT INT
Full (lattice-based) Full (lattice-based) 128-bit effective 128-bit effective 192/256-bit effective 128-bit effective
Q-Safe Q-Safe Q-Safe Q-Safe Q-Safe Q-Safe
SHA-256 (preimage) HMAC-SHA1 (160-bit key) PBKDF2-SHA1 (256-bit PMK)
KDF INT KDF
128-bit effective 80-bit effective 128-bit effective∗
Q-Weakened Q-Weakened Q-Weakened
AES-128-CCMP X25519 / ECDH-P256 ECDSA-P256 / Ed25519 RSA-2048+ DH-2048
ENC KEX AUTH KEX/AUTH KEX
64-bit effective Broken (Shor) Broken (Shor) Broken (Shor) Broken (Shor)
Q-Unsafe† Q-Unsafe Q-Unsafe Q-Unsafe Q-Unsafe
DES, RC4, MD5 Various Already broken ∗ PBKDF2 output is 256 bits; Grover reduces search over the passphrase space, but the 256-bit PMK has adequate entropy. † Grover-reduced to 64-bit, at the threshold of classical feasibility. Mechanism differs from Shor.
authentication tag. KDF (key derivation) derives session keys from a shared secret, typically via a hash-based construction like HKDF. Note that these roles are not independent. The security of ENC depends on the security of KEX, because the encryption key is derived from the shared secret produced by the key exchange. A Q-Safe symmetric cipher offers no protection if the key that feeds it was established through a Q-Unsafe key exchange. We formalize this dependency next. E. Per-Session and Per-Message Operations Each active layer’s operations divide into two phases that occur at different times and frequencies.
C-Unsafe
as an algorithm) inherits a Q-Unsafe effective status if Ki was produced by an X25519 key exchange. We state this as a principle that recurs throughout the paper. Remark 9 (Key Material Inheritance). A Q-Safe key derivation function cannot degrade a Q-Unsafe shared secret into a QSafe key. If the root of the key derivation chain is Q-Unsafe, all derived keys inherit that status regardless of the KDF’s own quantum resistance. Concretely, in TLS 1.3, the key derivation chain is: X25519
HKDF
HKDF
Random −−−−−→ shared_secret −−−−→ Khs −−−−→ Kapp
HKDF-SHA384 is Q-Safe, but the root shared secret is QUnsafe (produced by X25519), so Kapp is Q-Unsafe: a Definition 7 (Session Establishment). The session establish- quantum adversary recovers the X25519 shared secret and ment (handshake) at layer Li is a sequence of operations re-derives every subsequent key. that produces session key material Ki and an authentication F. Effective PQC Status outcome Authi : We now define the quantity that matters for system-level hs analysis. The effective PQC status of a layer’s protection, Li : (protocol messages) −→ (Ki , Authi ) (8) which accounts for the dependency between key exchange The PQC status of Ki is determined by the key exchange and encryption. operation(s) within the handshake. The PQC status of Authi Definition 10 (Effective Confidentiality Status). The effective is determined by the authentication operation(s). confidentiality PQC status of layer Li is Definition 8 (Per-Message Data Transformation). After session conf σeff Li = min σ(KEXi ), σ(ENCi ) (10) establishment, each application message is transformed using where min follows the ordering C-Unsafe < Q-Unsafe < the established key: Q-Weakened < Q-Safe from Definition 1. If no key exchange Ldata (Mi ) = AEADKi (Mi ) (9) is performed (e.g., encryption uses a pre-shared key), σ(KEXi ) i is replaced by the PQC status of the key source. The distinction matters because a session is established once (or infrequently), while data transformations occur for Intuitively, a layer’s confidentiality protection is only as every message. For PQC analysis, the handshake determines strong as the weaker of its key exchange and its encryption the ceiling of what the data phase can achieve: a per- algorithm. If the key exchange is Q-Unsafe but the cipher is message transformation that uses AES-256-GCM (Q-Safe Q-Safe, a quantum adversary recovers the session key through
the key exchange and then decrypts the ciphertext. The effective status is Q-Unsafe. Definition 11 (Effective Authentication Status). The effective authentication PQC status of layer Li is auth σeff Li = σ(AUTHi )
(11)
If the layer uses symmetric authentication (e.g., HMAC with auth a pre-shared key) rather than public-key signatures, σeff Li equals the PQC status of the symmetric MAC’s key source.
The third is a quantum exposure analysis that traces what an HNDL adversary learns as she peels successive encryption layers from a captured frame. Each row corresponds to a depth d: depth 0 is the wire observation, depth 1 is the result of breaking the outermost layer, and so on. The HNDL column records whether that depth is reachable and what data is harvestable. Definition 12 (HNDL Exposure Depth). For a message transformation chain with n active layers ordered outermost to innermost, the HNDL exposure depth is
Authentication status does not depend on the encryption alconf gorithm. It depends only on the signature or MAC scheme used d∗ = max{d : σeff Lik ̸= Q-Safe for all k ≤ d} (12) to verify peer identity. A layer can have Q-Safe confidentiality ∗ ∗ (via ML-KEM key exchange) and Q-Unsafe authentication All data at depths 1, . . . , d is harvestable. If d = n, the (via ECDSA certificates) simultaneously; this is exactly the application plaintext itself is harvestable. situation in current hybrid TLS deployments. We use the notation Q-Unsafe† from Section 3 (Remark 2) Table III collects the notation introduced in this section. to distinguish Grover-reduced vulnerabilities (AES-128 at 64bit effective) from Shor-broken ones (ECDH, RSA). IV. C ASE S TUDIES We apply the formal model from Section 3 to some B. Case Study 1: iOS-to-iOS iMessage commonly occurring scenarios. Each case study instantiates the framework with one specific protocol stack and one fixed Configuration. We consider an instantiated communication cryptographic profile, involving a different combination of stack in which two iPhones running iOS 18 exchange iMessages Layer-2, Layer-3, Layer 5–6, and Layer-7 protections. Accord- over a WPA3-Personal Wi-Fi network. For this case study, ingly, the conclusions of a case study should be understood the stack is taken to have three active cryptographic layers: as properties of the instantiated configuration under analysis, WPA3-SAE at Layer 2, TLS 1.3 to Apple’s iMessage relay not as universal claims about all devices, operating systems, or at Layers 5–6, and Apple’s PQ3 [5] end-to-end protection at deployments of the corresponding protocols. Together, these Layer 7. The per-layer cryptographic profile analyzed below case studies illustrate how the same application data can have is the fixed profile for this instantiated configuration. PQ3 radically different quantum vulnerability depending on the Active layers: A = (LWPA3 , LTLS 2 5-6 , L7 ), n = 3. protocol stack it traverses. TLS PQ3 Sending chain: Mout = LWPA3 L L (M ) app 2 5-6 7 A. Methodology 1) Per-Layer Cryptographic Profile: In our abstraction, PQ3 authentication is classified as Q-Unsafe because its perFor each scenario, we present three analyses. The first is a per-layer cryptographic profile that records message signature primitive is ECDSA-P256. This classification the algorithms at each active layer together with the effective abstracts away additional platform-level hardening and verificonf auth PQC statuses σeff Li and σeff Li , followed by a segment-by- cation mechanisms and focuses only on the PQC status of the segment table. Each segment corresponds to a physical network underlying authentication primitive. 2) Segment-by-Segment Analysis: Table V traces the meslink between two adjacent nodes (e.g., device → access point, or VPN server → web server). For each segment, the table shows sage across each physical network link. On each segment, which encryption layers are active on that link, the composite the “Active Layers” column lists the encryption layers whose PQC status an adversary on that segment would face, and what protection covers that link. The composite σconf for the segment specific data is exposed at that point if encryptions are stripped. is max of the per-layer confidentiality statuses (one Q-Safe The second is an endpoint vulnerability posture table. Where layer suffices). The “Exposed at This Node” column describes the segment table describes what is on the wire between what an entity at the termination point of a stripped layer can two nodes, the endpoint table describes what is exposed at see—even without quantum capabilities. The relay server is a trust boundary where TLS protection each node—including the sender and final recipient. For each endpoint, we separate three concerns: classical exposure (what disappears. Even without a quantum computer, Apple’s relay the node sees today, by design, without any cryptographic infrastructure has access to relay-visible messaging metadata. attack), HNDL exposure (what an adversary who captures PQ3 ensures that this exposure does not extend to message traffic at this point could additionally recover with a future content. CRQC), and quantum-resistant protection (which layers, if 3) Endpoint Vulnerability Posture: Table VI shows the any, remain unbreakable even by a quantum adversary). This vulnerability posture at each network node. For each endpoint, separation makes explicit whether quantum computing creates we separate what the node sees classically (today, by design) genuinely new exposure or merely extends existing classical from what an HNDL adversary who captures traffic at that point exposure to new adversaries. could additionally recover with a future quantum computer. The
TABLE III N OTATION SUMMARY. Symbol
Meaning
S Li L−1 i Lhs i Ldata i Mapp Mout (j) fi σ(f ) Ki A conf L σeff i auth L σeff i conf σchain auth σchain meta σchain d∗ †
PQC status set {C-Unsafe < Q-Unsafe < Q-Weakened < Q-Safe} Cryptographic transformation at OSI layer i (sending) Inverse transformation at layer i (receiving) Session establishment (handshake) at layer i Per-message data transformation at layer i Application-layer plaintext message Transmitted frame on the physical medium The j-th cryptographic operation at layer i PQC status of operation f Session key material established at layer i Active layer set (Li1 , . . . , Lin ) Effective confidentiality PQC status of layer i Effective authentication PQC status of layer i Chain-level confidentiality PQC status Chain-level authentication PQC status Chain-level metadata PQC status Metadata exposure depth Grover-reduced (as opposed to Shor-broken)
TABLE IV CS1: P ER - LAYER CRYPTOGRAPHIC PROFILE . Layer
Protocol
KEX
AUTH
L2 L5–6 L7
WPA3-SAE TLS 1.3 PQ3
EC Dragonfly (P-256 class) X25519 Hybrid ECC+PQ initial establishment and ratcheting
SAE implicit (EC) ECDSA-P256 cert ECDSA-P256 signing
σconf
σauth
Q-Unsafe Q-Unsafe Q-Safe
Q-Unsafe Q-Unsafe Q-Unsafe
Data encryption: L2 = AES-128-CCMP (Q-Unsafe† ), L5–6 = AES-256-GCM (Q-Safe), L7 = AES-256-CTR (Q-Safe). For PQ3, initial session establishment combines a Kyber-1024 KEM with P-256 ECDH, and ongoing rekeying combines a per-message P-256 ECDH ratchet with a periodic Kyber-768 ratchet. TABLE V CS1: S EGMENT- BY- SEGMENT ANALYSIS ( SENDER ’ S OUTBOUND PATH ). Segment
Active Layers
σconf
σauth
Exposed at Receiving Node
iPhone A → AP
L2 + L5–6 + L7
Q-Safe
Q-Unsafe
AP strips L2. Sees: outer IP headers (device IP → Apple relay IP), TCP port 443, TLS record headers. Cannot see TLS payload or PQ3-protected content.
AP → Apple Relay
L5–6 + L7
Q-Safe
Q-Unsafe
Relay strips L5–6. Sees: PQ3-protected ciphertext blobs and relay-visible messaging metadata (e.g., timing and ciphertext size information). Does not obtain message plaintext.
Apple Relay → AP
L5–6′ + L7
Q-Safe
Q-Unsafe
New TLS session to iPhone B. AP strips L2 on final hop. Same relay-visible metadata exposure as above.
AP → iPhone B L2′ + L5–6′ + L7 Q-Safe Q-Unsafe iPhone B strips all. Recovers Mapp . ′ Primed layers ( ) indicate new sessions on the relay-to-recipient path. PQ3 is not terminated at the relay; the relay forwards PQ3-protected ciphertext and does not obtain the message plaintext.
“Quantum-Resistant” column identifies what remains protected even against a CRQC-equipped adversary. The endpoint table reveals that the classical and quantum exposure boundaries converge at the relay. Apple’s relay server sees relay-visible messaging metadata today, by design, without any cryptographic attack. An HNDL adversary who captures traffic anywhere upstream of the relay and later obtains a CRQC recovers the same class of metadata—but nothing more, because PQ3 blocks at every endpoint. The quantum threat does not create message-content exposure at the relay; it extends relay-visible metadata exposure to adversaries who are not Apple.
4) Quantum Exposure: Chain composition: conf σchain = max(Q-Unsafe, Q-Unsafe, Q-Safe) = Q-Safe (13) auth σchain = min(Q-Unsafe, Q-Unsafe, Q-Unsafe) = Q-Unsafe (14) meta conf σchain = σeff L2 = Q-Unsafe
(15)
∗
d =2 The iMessage scenario demonstrates the central asymmetry of this paper. A single Q-Safe layer at Layer 7 makes the chain Q-Safe for payload confidentiality, but authentication
TABLE VI CS1: E NDPOINT VULNERABILITY POSTURE . Endpoint
Layers Remaining
Classical Exposure
HNDL Exposure (quantum)
QuantumResistant
iPhone A (sender)
L2+L5–6+L7 (pre-tx)
Full plaintext Mapp (origin device)
N/A — data not yet transmitted
All outbound layers
AP (sender)
L5–6 + L7
IP headers: device IP → relay IP; TCP:443; TLS record headers
Break L5–6 (Q-Unsafe, Shor) → relay-visible messaging metadata. Blocked at L7 (PQ3).
L7: PQ3 hybrid ECC+PQ confidentiality
Apple Relay
L7 only
PQ3-protected ciphertext and relay-visible messaging metadata
PQ3-protected ciphertext only. No additional content recovery.
L7: PQ3 hybrid ECC+PQ confidentiality
AP (recip.)
L5–6′ + L7
Same as sender AP (symmetric)
Same as sender AP
L7: PQ3 hybrid ECC+PQ confidentiality
iPhone B (recip.)
None
Full plaintext Mapp (destination device)
N/A (endpoint)
—
TABLE VII CS1: HNDL QUANTUM EXPOSURE ANALYSIS . d
Layer
σconf
Newly Revealed Data
0
Wire
—
802.11 headers: src/dst MAC, BSS ID, frame type
—
Device presence and activity timing
1
L2: WPA3
Q-Unsafe
IP headers: device IP, Apple relay IP; TCP port 443; TLS record headers
Yes
Communication pattern to Apple servers
2
L5–6: TLS
Q-Unsafe
Relay-visible messaging metadata; PQ3-protected ciphertext
Yes
Messaging metadata visible after TLS removal
3
L7: PQ3
Q-Safe
BLOCKED — PQ3’s end-to-end confidentiality remains protected by its hybrid ECC+PQ design and ongoing post-quantum ratcheting
No
Content is not harvestable
remains Q-Unsafe at every layer and metadata is exposed to depth d∗ = 2. An HNDL adversary can eventually recover relay-visible messaging metadata but cannot recover message content. The segment analysis adds a further insight: the relay server is a classical trust boundary that mirrors the quantum exposure boundary. Apple can see today, without any quantum computer, the same class of relay-visible metadata that an HNDL adversary could recover in a quantum future. C. Case Study 2: Linux-to-Linux HTTPS over WPA2-PSK
HNDL
Harvestable Data
σconf = Q-Unsafe), but the wired adversary’s task is simpler: break TLS only, rather than WPA2 + TLS. 3) Endpoint Vulnerability Posture: The critical entry is the AP. After stripping WPA2, only TLS remains—and TLS is Q-Unsafe. An HNDL adversary who captures traffic at the AP (or on the wired network beyond it) faces a single Shor attack on X25519 to recover all application data. No Q-Safe layer blocks further decryption. Contrast this with CS1, where PQ3 blocks at every endpoint; here, there is no backstop. 4) Quantum Exposure: Chain composition:
Configuration. We consider an instantiated communication stack in which two Linux machines (Ubuntu 24.04) communiconf σchain = max(Q-Unsafe† , Q-Unsafe) = Q-Unsafe (16) cate via HTTPS over a WPA2-Personal (PSK) Wi-Fi network, auth σchain = min(Q-Weakened, Q-Unsafe) = Q-Unsafe with no VPN and no application-layer encryption. The per(17) layer cryptographic profile analyzed below is the fixed profile † meta conf for this instantiated configuration. σchain = σeff L2 = Q-Unsafe (18) TLS ∗ Active layers: A = (LWPA2-PSK , L ), n = 2. 2 5-6 d = 2 = n Sending chain: Mout = LWPA2-PSK LTLS 2 5-6 (Mapp ) This scenario is fully Q-Unsafe: an HNDL adversary can 1) Per-Layer Cryptographic Profile: 2) Segment-by-Segment Analysis: The segment table high- eventually recover all application data. However, the mechalights that the wired segment (AP → Server) has only TLS nisms differ by layer. Layer 2’s vulnerability is Grover-based protecting it. An adversary with physical access to the wired (AES-128 reduced to 64-bit effective), fixable by upgrading to network (or any router between AP and server) faces one fewer AES-256. Layer 5–6’s vulnerability is Shor-based (X25519), encryption layer than a wireless eavesdropper. For HNDL requiring protocol replacement. WPA2-PSK’s authentication purposes, both segments are equally vulnerable (both have (Q-Weakened) is the only non-Q-Unsafe authentication in
TABLE VIII CS2: P ER - LAYER CRYPTOGRAPHIC PROFILE . Layer
Protocol
KEX
AUTH
L2 L5–6
WPA2-PSK TLS 1.3
None (symmetric PSK) X25519
HMAC-SHA1 MIC ECDSA-P256 cert
σconf
σauth
Q-Unsafe† Q-Unsafe
Q-Weakened Q-Unsafe
Data encryption: L2 = AES-128-CCMP (Q-Unsafe† under Grover), L5–6 = AES-256-GCM (Q-Safe). L2 uses no public-key KEX; σconf = min(Q-Weakenedkey , Q-Unsafe†AES-128 ) = Q-Unsafe† . TABLE IX CS2: S EGMENT- BY- SEGMENT ANALYSIS . Segment
Active Layers
σconf
σauth
Exposed at Receiving Node
Linux A → AP
L2 + L5–6
Q-Unsafe
Q-Unsafe
AP strips L2. Sees: IP headers (client IP, server IP), TCP port 443, TLS ClientHello with SNI (server hostname), TLS record sizes.
AP → Server
L5–6 only
Q-Unsafe
Q-Unsafe
Server strips L5–6. Recovers full HTTP content: Mapp . On this segment, an eavesdropper sees TLS ciphertext with no WPA2 wrapper.
TABLE X CS2: E NDPOINT VULNERABILITY POSTURE . Endpoint
Layers Remaining
Classical Exposure
HNDL Exposure (quantum)
QuantumResistant
Linux A (sender)
L2+L5–6 (pre-tx)
Full plaintext Mapp (origin)
N/A (not yet transmitted)
All outbound layers
AP
L5–6 only
IP headers: client/server IPs; TCP:443; TLS ClientHello SNI; TLS record sizes
Break L5–6 (Q-Unsafe, Shor on X25519) → full HTTP content. No blocking layer.
None — no Q-Safe layer remains
Server
None
Full plaintext Mapp (destination)
N/A (endpoint)
—
TABLE XI CS2: HNDL QUANTUM EXPOSURE ANALYSIS . d
Layer
σconf
Newly Revealed Data
0 1
Wire
—
802.11 headers: MAC addrs, BSS ID, frame sizes
—
Device presence, activity timing
L2: WPA2-PSK
Q-Unsafe†
IP headers: src/dst IPs; TCP port 443; TLS SNI (hostname); TLS record sizes and timing
Yes†
Server identities; traffic volumes per destination
2
L5–6: TLS 1.3
Q-Unsafe
Full HTTP content: URLs, cookies, auth tokens, form data, API bodies
Yes
All application data
any scenario in this study—because it uses only symmetric primitives. D. Case Study 3: HTTPS over WPA2-Enterprise Configuration. We consider an instantiated communication stack in which a corporate laptop communicates via HTTPS over WPA2-Enterprise (EAP-TLS), with certificate-based mutual authentication at Layer 2, TLS 1.3 at Layers 5–6, and no VPN or application-layer encryption. The case study analyzes one fixed cryptographic profile for this enterprisestyle configuration rather than all possible WPA2-Enterprise or TLS deployments. Active layers: A = (LWPA2-Ent , LTLS 2 5-6 ), n = 2. Sending chain: Mout = LWPA2-Ent LTLS 2 5-6 (Mapp ) 1) Per-Layer Cryptographic Profile: 2) Segment-by-Segment Analysis:
HNDL
Harvestable Data
3) Endpoint Vulnerability Posture: The AP’s row is the most concerning. As in CS2, after stripping Layer 2 the AP exposes TLS-only traffic with no Q-Safe backstop. But the mechanism is worse than CS2: the WPA2-Enterprise AP has richer classical exposure (employee certificate DNs from the EAP-TLS exchange, cleartext EAP identity frames) and its Layer-2 vulnerability is Shor-based rather than Grover-based, meaning it cannot be fixed by a cipher upgrade alone. The RADIUS server, though it participates in authentication, is not on the data path and does not see post-handshake application traffic. 4) Quantum Exposure: Chain composition: conf σchain = max(Q-Unsafe, Q-Unsafe) = Q-Unsafe
(19)
auth σchain = min(Q-Unsafe, Q-Unsafe) = Q-Unsafe meta conf σchain = σeff L2 = Q-Unsafe ∗
(20)
d =2=n
(21)
TABLE XII CS3: P ER - LAYER CRYPTOGRAPHIC PROFILE . Layer
Protocol
KEX
AUTH
L2 L5–6
WPA2-Ent TLS 1.3
ECDHE-P256 (EAP-TLS) X25519
RSA-2048/ECDSA certs ECDSA-P256 cert
σconf
σauth
Q-Unsafe Q-Unsafe
Q-Unsafe Q-Unsafe
Data encryption: L2 = AES-128-CCMP (Q-Unsafe† ), L5–6 = AES-256-GCM (Q-Safe). L2 σconf = min(Q-UnsafeECDHE , Q-Unsafe†AES-128 ) = Q-Unsafe; Shor on ECDHE dominates. TABLE XIII CS3: S EGMENT- BY- SEGMENT ANALYSIS . Segment
Active Layers
Laptop → AP
L2 + L5–6
σconf
σauth
Exposed at Receiving Node
Q-Unsafe
Q-Unsafe
AP strips L2. Sees: IP headers, destination server IP, TCP port 443, TLS records. Also: EAP-TLS auth exchange (client/server certs, ECDHE params) was visible during association.
AP → Server L5–6 only Q-Unsafe Q-Unsafe Server strips L5–6. Recovers Mapp . No L2 protection on this segment. During 802.1X association, EAP identity frames (containing employee usernames) are sent in cleartext before encryption is established. TABLE XIV CS3: E NDPOINT VULNERABILITY POSTURE . Endpoint
Layers Remaining
Classical Exposure
HNDL Exposure (quantum)
QuantumResistant
Laptop (sender)
L2+L5–6 (pre-tx)
Full plaintext Mapp (origin)
N/A (not yet transmitted)
All outbound layers
AP
L5–6 only
IP headers; TLS records; during association: EAP-TLS certs and ECDHE params (employee cert DNs visible)
Break L5–6 (Q-Unsafe, Shor) → full HTTP content. No blocking layer.
None( no Q-Safe layer remains)
RADIUS
L5–6 (not on data path)
EAP-TLS auth exchange: client/server certs, derives PMK. Does not see data-phase traffic.
N/A for data traffic (auth-only role)
—
Web Server
None
Full plaintext Mapp (destination)
N/A (endpoint)
—
TABLE XV CS3: HNDL QUANTUM EXPOSURE ANALYSIS . d
Layer
σconf
Newly Revealed Data
0
Wire
—
802.11 headers; EAP identity (employee username in cleartext)
—
Employee usernames; corporate SSID; device MACs
1
L2: WPA2-Ent
Q-Unsafe
IP headers; TLS records; additionally: EAP-TLS handshake (client/server certs, ECDHE parameters)
Yes
Internal topology; server IPs; employee certificate DNs
2
L5–6: TLS 1.3
Q-Unsafe
Full HTTP: internal apps, API calls, documents, session tokens
Yes
All corporate data
5) Direct Comparison: WPA2-Personal vs. WPA2-Enterprise: Table XVI isolates the Layer-2 difference. Both scenarios use identical TLS 1.3 and identical AES-128-CCMP data encryption. They differ only in key establishment.
HNDL
Harvestable Data
in RC6. E. Case Study 4: HTTPS over WPA3 with WireGuard VPN Configuration. We consider an instantiated communication stack in which a user on a WPA3-Personal Wi-Fi network routes all traffic through a WireGuard VPN and then connects to an HTTPS website via TLS 1.3. For this case study, the stack is taken to have three active cryptographic layers spanning Layers 2, 3, and 5–6. The per-layer cryptographic profile analyzed below is the fixed profile for this instantiated configuration.
WPA2-Enterprise is classically superior by every measure. Yet its quantum posture is strictly worse: Shor-broken ECDHE versus Grover-reduced AES-128. Worse still, the remediation paths diverge sharply. Upgrading WPA2-PSK to AES-256 is a cipher-suite configuration change. Upgrading WPA2-Enterprise requires replacing the entire EAP-TLS key exchange with a post-quantum mechanism, touching certificate infrastructure, TLS Active layers: A = (LWPA3 , LWG 2 3 , L5-6 ), n = 3. RADIUS servers, and supplicant software. This is a concrete, LWG LTLS quantified instance of the classical–quantum security tension Sending chain: Mout = LWPA3 2 3 5-6 (Mapp )
TABLE XVI L AYER -2 COMPARISON : WPA2-P ERSONAL VS . WPA2-E NTERPRISE . PQC Status L2 Variant
σconf
σauth
WPA2-PSK WPA2-Ent
Q-Unsafe†
Q-Weakened Q-Unsafe
Q-Unsafe
Classical security Quantum security Remediation cost
Vulnerability Mechanism Conf
Auth
Grover (AES-128) Shor (ECDHE)
Grover (sym. MAC) Shor (RSA/ECDSA)
Enterprise ≫ Personal Personal > Enterprise Personal: config ≪ Enterprise: protocol
WireGuard uses Noise IK [6]: two Curve25519 DH opera- recovers the inner IP headers and TLS SNI that WireGuard tions for key exchange, Curve25519 static keys for authentica- was supposed to conceal. The additional protocol complexity tion, and ChaCha20-Poly1305 for data encryption. and latency of the VPN tunnel deliver no quantum security 1) Per-Layer Cryptographic Profile: benefit. 2) Segment-by-Segment Analysis: The segment table makes The one escape hatch is WireGuard’s optional PSK mode. explicit that the VPN server is a full trust boundary for browsing Mixing a 256-bit pre-shared key into the Noise handshake metadata. After stripping WireGuard, the VPN server sees makes the derived symmetric keys independent of Curve25519: exactly which websites the user visits, when, and how much even if the EC discrete log is solved, the PSK contribution conf data is exchanged. This is true today, classically. In a quantum keeps the keys secret. This would make σeff L3 = Q-Safe, ∗ future, an HNDL adversary who captured traffic on the wireless blocking exposure at depth 2, reducing d to 1, and, perhaps segment (Device → AP) would recover the same information more importantly, restoring the VPN’s privacy function against by breaking WPA3 and then WireGuard—reaching the same a quantum adversary. However, PSK mode requires out-of-band metadata the VPN server already sees. key distribution and standard deployments do not enable it. 3) Endpoint Vulnerability Posture: The endpoint table makes V. D ISCUSSION the VPN’s failure starkly visible. At the VPN server, the We summarize the findings that emerge from these case classical and HNDL columns tell related but distinct stories. studies. Classically, the VPN server sees browsing destinations (which websites, when, how much data) but not content—TLS still Finding 1: One PQ-safe layer suffices for payload conconf protects the payload. Under HNDL, even TLS fails: a quantum fidentiality. Scenario 1 achieves σchain = Q-Safe with a adversary who captures traffic at the VPN server recovers single PQ-safe layer (PQ3 at L7) despite two Q-Unsafe everything, because no Q-Safe layer remains. The “Quantum- layers below it. Scenarios 2–4, with zero PQ-safe layers, all conf Resistant” column reads None at every intermediate node— have σchain = Q-Unsafe. This validates the confidentiality three layers of encryption and not a single quantum backstop. sufficiency principle (RC2). Compare with CS1’s endpoint table, where every interme- Finding 2: Authentication is universally Q-Unsafe. Across diate node shows “L7: PQ3 (Kyber-1024)” in the Quantum- all four scenarios and all nine active layer instances, no Resistant column. That single end-to-end Q-Safe layer trans- layer uses post-quantum digital signatures. Even PQ3 signs forms every endpoint from fully exposed to content-protected. with ECDSA-P256. This confirms the authentication necessity concern (RC3). 4) Quantum Exposure: Chain composition: Finding 3: More layers ̸= better quantum security. conf σchain = max(Q-Unsafe, Q-Unsafe, Q-Unsafe) = Q-Unsafe Scenario 4 (n = 3) achieves the worst HNDL outcome (22) (d∗ = 3 = n). Scenario 1 (n = 3) achieves d∗ = 2 because auth σchain = min(Q-Unsafe, Q-Unsafe, Q-Unsafe) = Q-Unsafe one layer is Q-Safe. Layer count is irrelevant; what matters is (23) whether any layer is Q-Safe. meta conf σchain = σeff L2 = Q-Unsafe (24) Finding 4: Metadata exposure halts at the first PQ-safe layer. In Scenario 1, the adversary penetrates depths 1–2 but is ∗ d =3=n blocked at depth 3 (PQ3). In Scenario 4, no layer blocks, and This is the worst case in our study. Three layers of encryption the adversary reaches application data. The exposure depth d∗ provide zero quantum protection. The HNDL depth equals is determined entirely by the position of the first Q-Safe layer the total layer count (d∗ = n = 3), meaning the application counting inward from the outermost. plaintext itself is harvestable. An adversary who records the Finding 5: Enterprise security inversely correlates with triply-encrypted traffic today can, upon obtaining a CRQC, quantum security. Comparing Scenarios 2 and 3 (Table XVI): WPA2-PSK is Q-Unsafe† (Grover, config fix) while WPA2recover the complete web browsing session. The VPN is especially counterproductive. Its core value Enterprise is Q-Unsafe (Shor, protocol replacement). The proposition (hiding browsing destinations from the local classically stronger protocol is quantum-weaker with a harder network and ISP) is defeated at depth 2, where the adversary remediation path.
TABLE XVII CS4: P ER - LAYER CRYPTOGRAPHIC PROFILE . Layer
Protocol
KEX
AUTH
L2 L3 L5–6
WPA3-SAE WireGuard TLS 1.3
EC Dragonfly (P-256) Curve25519 DH X25519
SAE implicit (EC) Curve25519 static ECDSA-P256 cert
σconf
σauth
Q-Unsafe Q-Unsafe Q-Unsafe
Q-Unsafe Q-Unsafe Q-Unsafe
Data encryption: L2 = AES-128-CCMP (Q-Unsafe† ), L3 = ChaCha20-Poly1305 (Q-Safe), L5–6 = AES-256-GCM (Q-Safe). WireGuard optionally conf L becomes Q-Safe. Standard deployments do not use this option. supports a PSK mixed into the Noise handshake; with a Q-Safe PSK, σeff 3 TABLE XVIII CS4: S EGMENT- BY- SEGMENT ANALYSIS . Segment
Active Layers
σconf
σauth
Exposed at Receiving Node
Device → AP
L2 + L3 + L5–6
Q-Unsafe
Q-Unsafe
AP strips L2. Sees: outer IP (device IP → VPN server IP), UDP port 51820, WireGuard handshake/data. Knows VPN is in use; cannot see inner traffic.
AP → VPN
L3 + L5–6
Q-Unsafe
Q-Unsafe
VPN strips L3. Sees: inner IP (client virtual IP → web server IP), TCP port 443, TLS ClientHello with SNI. VPN sees browsing destinations.
VPN → Web
L5–6 only
Q-Unsafe
Q-Unsafe
Web server strips L5–6. Recovers Mapp . On this segment, traffic appears as ordinary HTTPS—no VPN wrapper.
TABLE XIX CS4: E NDPOINT VULNERABILITY POSTURE . Endpoint
Layers Remaining
Classical Exposure
HNDL Exposure (quantum)
QuantumResistant
Device (sender)
L2+L3+L5–6 (pre-tx)
Full plaintext Mapp (origin)
N/A — not yet transmitted
All outbound layers
AP
L3+L5–6
Outer IP (device → VPN server); UDP:51820; WireGuard handshake/data
Break L3 (Q-Unsafe, Shor) → inner IP, TLS SNI. Break L5–6 (Q-Unsafe) → all HTTP content.
None
VPN Server
L5–6 only
Inner IP: virtual IP → web server; TCP:443; TLS SNI (hostname); traffic volumes. Browsing destinations visible.
Break L5–6 (Q-Unsafe, Shor) → full HTTP content. No blocking layer.
None
Web Server
None
Full plaintext Mapp (destination)
N/A (endpoint)
—
Finding 6: Trust boundaries mirror quantum exposure model assigns the same status (Q-Unsafe) to both, but the boundaries. The endpoint tables (Tables VI–XIX) reveal a remediation cost differs by an order of magnitude. pattern: at each intermediate node, the HNDL exposure column VI. C ONCLUSION often recovers the same data that the classical exposure column already shows. In Scenario 1, Apple’s relay classically sees Existing work [7] on post-quantum migration has largely iMessage metadata; an HNDL adversary recovers the same focused on standards guidance and protocol-specific redesigns, metadata and nothing more. In Scenario 4, the VPN server such as hybrid TLS key exchange, post-quantum secure messagclassically sees browsing destinations; an HNDL adversary at ing handshakes, and post-quantum VPN variants. In contrast, the VPN server can additionally break TLS to recover content we study how the PQC posture of multiple concurrently active (which the VPN server cannot do classically). The endpoint layers composes across a single communication stack, and analysis thus reveals both cases where HNDL extends classical how that composition differs by security objective such as exposure to content (CS2, CS3, CS4) and cases where a Q- confidentiality, authentication, and metadata exposure. We have Safe layer ensures HNDL provides no advantage beyond what presented a preliminary framework to analyze PQC threat intermediaries already see (CS1). across the network stack and demonstrated how to use this framework using some case studies. Finding 7: The † distinguishes fixable from structural R EFERENCES vulnerabilities. Both Scenarios 2 and 3 have d∗ = 2 and conf σchain = Q-Unsafe, but their L2 vulnerability mechanisms [1] P. W. Shor, “Algorithms for quantum computation: Discrete logarithms and factoring,” in Proceedings of the 35th Annual Symposium on Foundations differ. WPA2-PSK’s Grover-based vulnerability is eliminated of Computer Science (FOCS). IEEE, 1994, pp. 124–134. by upgrading to AES-256 (a configuration change). WPA2[2] L. K. Grover, “A fast quantum mechanical algorithm for database search,” Enterprise’s Shor-based vulnerability and WPA3-SAE’s Shorin Proceedings of the 28th Annual ACM Symposium on Theory of based vulnerability both require protocol redesign. The formal Computing (STOC). ACM, 1996, pp. 212–219.
TABLE XX CS4: HNDL QUANTUM EXPOSURE ANALYSIS . d
Layer
σconf
Newly Revealed Data
0
Wire
—
802.11 headers: MACs, BSS ID, payload sizes
—
Device presence and timing
1
L2: WPA3
Q-Unsafe
Outer IP: device → VPN server; UDP 51820; WireGuard fingerprint
Yes
VPN usage exposed; VPN server identity
2
L3: WireGuard
Q-Unsafe
Inner IP: virtual IP → web server; TCP 443; TLS SNI (hostname)
Yes
Browsing destinations; defeats VPN privacy
3
L5–6: TLS 1.3
Q-Unsafe
Full HTTP content: URLs, cookies, auth tokens, response bodies
Yes
All application data
[3] National Institute of Standards and Technology, “Transition to postquantum cryptography standards,” NIST, Tech. Rep. NIST IR 8547, 2024. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST. IR.8547.pdf [4] D. Harkins, “Dragonfly key exchange,” IETF, Tech. Rep. RFC 7664, November 2015. [Online]. Available: https://tools.ietf.org/html/rfc7664 [5] D. Stebila, “Security analysis of the imessage pq3 protocol,” Cryptology ePrint Archive, no. 2024/357, 2024. [Online]. Available: https://eprint.iacr.org/2024/357 [6] T. Perrin, “The noise protocol framework,” Specification, 2018. [Online]. Available: https://noiseprotocol.org/noise.html [7] Y. Baseri, V. Chouhan, and A. Hafid, “Navigating quantum security risks in networked environments: A comprehensive study of quantum-safe network protocols,” Computers & Security, vol. 142, p. 103883, July 2024. [Online]. Available: https://www.sciencedirect.com/science/article/ pii/S0167404824001846
HNDL
Harvestable Data