A Commitment-Based Hybrid Post-Quantum Cryptographic Model for Multi-File Cloud Storage

A Commitment-Based Hybrid Post-Quantum Cryptographic Model for Multi-File Cloud Storage Lemdi Frank Prikutse, Regina Esi Turkson, Alimatu-Saadia Yussiff, Abdul-Lateef Yussiff, Maame G. Asante-Mensah

ABSTRACT Cloud storage clients increasingly require authentication that remains secure against future quantumcapable adversaries, motivating hybrid constructions that combine classical primitives with standardized postquantum alternatives. Extended naively to multi-file upload, such constructions incur a per-file lattice signing cost that dominates authentication time and becomes prohibitive at realistic batch sizes. This paper presents a commitment-based hybrid post-quantum model that addresses this bottleneck. It comprises AES-256-GCM bulk encryption, a hybrid X25519 with ML-KEM-768 key encapsulation mechanism, and a hybrid Ed25519 with ML-DSA-65 dual signature, computed over a SHA3-256 batch commitment. The commitment binds all ciphertexts in a batch to a single fixed-size digest that is signed once, reducing the number of post-quantum signature invocations per batch from n to one, independent of batch size; the remaining encryption and hashing is bounded by fast symmetric throughput. On a commodity client platform, averaged over 20 repetitions, this holds signingphase time near-constant as the batch grows while the perfile baseline scales linearly. At 𝑛 = 1000, the model reduces signing-phase time by factors of 629, 606, and 725 for 100 KB, 1 MB, and 10 MB files respectively, against a per-file dual-signing baseline sharing every other primitive. Keywords: post-quantum cryptography; hybrid cryptography; cloud storage security; batch commitment; lattice-based signature; multi-file authentication. 1. INTRODUCTION Cloud computing has emerged as the dominant paradigm for data storage and processing, with organizations migrating critical workloads to cloud infrastructure at unprecedented scale [1]. However, this centralization creates significant security challenges concerning long-term confidentiality and authenticity [23]. Current cloud cryptographic systems rely on classical primitives including Rivest Shamir Adleman (RSA), Elliptic Curve Cryptography (ECC), and Advanced Encryption Standard (AES), which provide adequate security against conventional threats but face serious threats emerging from advances in quantum computing. The polynomial-time efficiency of Shor’s algorithm in addressing integer factorization and discrete logarithm

challenges on quantum hardware threatens the cryptographic security of extensively used systems including RSA, Diffie-Hellman, and ECC [4-6]. The National Institute of Standards and Technology (NIST) Post-Quantum Cryptography (PQC) standardization process finalized the first quantumresistant algorithms, including Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) and ModuleLattice-Based Digital Signature Algorithm (ML-DSA) [78]. Data encrypted today using classical algorithms remain vulnerable to Harvest Now Decrypt Later (HNDL) attacks, where adversaries gather encrypted data to decrypt once quantum computers become available, particularly threatening cloud-stored data requiring long-term confidentiality, including government communications, medical records, and financial information [9]. However, transitioning entirely to Post-Quantum Cryptography (PQC) algorithms faces several challenges: limited real-world deployment experience compared to battle-tested classical cryptography [10], significant investment and operational complexity in migrating existing cloud infrastructure including software reengineering and infrastructure upgrades [11], and uncertainty about the long-term security of specific PQC constructions as cryptanalytic advances continue [10]. Hybrid cryptographic approaches which combine classical and post-quantum primitives offer a pragmatic path forward, maintaining security if at least one component remains unbroken and providing defense-in-depth against both known and unknown cryptanalytic advances [12]. The practical integration of these hybrid primitives into multi-file cloud storage workloads, however, exposes a performance barrier that has received less attention than the cryptographic design problem itself. Lattice-based signatures are large. ML-DSA-65 produces signatures of approximately 3.3 KB [13], more than fifty times the size of an Ed25519 signature [14]. In a naïve per-file authentication scheme, the number of ML-DSA-65 signing operations grows linearly with 𝑛, so that the total signingphase cost is dominated by the lattice signing operations rather than by the bulk AES-256-GCM encryption. This paper therefore addresses the multi-file signingcost problem through a commitment-based design. The paper makes the following contributions: A post-quantum hybrid cryptographic model tailored for multi-file cloud upload authentication. The

construction uniquely combines AES-256-GCM for bulk encryption, X25519/ML-KEM-768 for hybrid key encapsulation, and Ed25519/ML-DSA-65 dual signatures bound to a pre-signature SHA3-256 batch commitment. Secondly, this paper demonstrates that aggregating files into a single batch commitment decouples signature generation from batch size, reducing lattice-based signature (ML-DSA-65) invocations from 𝑛 to 1 per batch while preserving the provable security properties of the constituent primitives. Finally, this paper evaluates implementation on constrained commodity hardware (Intel Core i5-6300U). For 𝑛 = 1,000, the proposed model yields signing-phase speedups of 629 times, 606 times, and 725 times across file sizes of 100 KB, 1 MB, and 10 MB respectively, compared to a per-file dual-signing baseline. 2. RELATED WORK The AES-ECC hybrid has emerged as a widely adopted architecture for cloud data protection due to ECC’s compact key representation and computational efficiency[15]. However, ECC’s security rests on the Elliptic Curve Discrete Logarithm Problem (ECDLP) [16] which Shor’s quantum algorithm takes polynomial time to solve [17], while AES remains vulnerable to Grover’s algorithm that reduces its effective security level [18]. The Harvest Now Decrypt Later (HNDL) threat renders AESECC inadequate for long-term confidentiality, creating urgent demand for post-quantum alternatives that maintain comparable performance [9]. However, hybrid constructions combining postquantum and classical primitives offer defense-in-depth during quantum transition [19]. Concatenation-based combiners have emerged as the provably secure approach for hybrid Key Encapsulation Mechanisms (KEMs), where shared secrets and ciphertexts from multiple KEMs are concatenated before key derivation, retaining Indistinguishability under Chosen-Ciphertext Attack (IND-CCA) security, provided a minimum of one component remains secure [20]. This robustness enables cryptographic hedging against both inadequately analyzed post-quantum algorithms and quantum-vulnerable classical schemes, while simpler XOR-based alternatives fail to preserve Chosen-Ciphertext Attack (CCA) security [20]. Deployment studies of hybrid post-quantum Transport Layer Security (TLS) report 20%-40% handshake latency increase primarily from larger key sizes rather than computational overhead [21], though comprehensive performance evaluation of hybrid protocols for bulk data encryption in cloud storage remains limited. NIST’s standardization has produced ML-KEM responsible for key encapsulation and ML-DSA responsible for digital signatures, with contemporary benchmarking demonstrating competitive performance compared to classical systems[22]. Performance comparisons show that ML-KEM encapsulation and decapsulation operations are faster than RSA and comparable to ECDH, while ML-DSA signing is

comparable to Elliptic Curve Digital Signature Algorithm (ECDSA). This paper’s proposed model adopts an ANDcombiner for its signature layer (Ed25519 ∧ ML-DSA-65) and a concatenation-based hybrid KEM (X25519 ∧ MLKEM-768). The novelty lies not only in the hybrid construction itself, which follows the framework from [23], [24], but also in its interaction with the multi-file batch authentication mechanism. While prior work has explored hybrid signature schemes for Transport Layer Security (TLS) and authentication protocols [21], [25] theoretical foundations of hybrid post-quantum cryptography [26], hash-based commitment schemes for digital signatures [27], [28], and performance overhead of post-quantum cryptography in network protocols [21], these approaches primarily target protocol handshakes, small messages, or theoretical frameworks rather than the specific challenge of signing large encrypted files in cloud storage systems where file sizes reach hundreds of megabytes [29]. Furthermore, while commitment schemes are established in cryptographic protocols [27], [28], and hybrid classical-PQC systems have been proposed for various applications [21], [24], [25], [26], [30] their combination for performance optimization in multi file cloud storage cryptography has not been extensively studied. The workload-level question of how hybrid signatures should be efficiently applied to a batch of files at the scales encountered in cloud object storage needs to be addressed. A lattice-based signature aggregation scheme was proposed by [31], achieving constant-time verification after 𝑂(𝑛) aggregation for low-latency distributed networks such as sensor systems, smart grids, and blockchain platforms. Although their objective was to reduce per-message cost of post-quantum authentication, their target was fundamentally different. Their scheme aggregates individual signatures produced by many independent signers, and the constant-time benefit accrues to verification after per-signer signatures have already been computed, whereas cloud multi-file uploads involve a single signer for whom the dominant cost is the signing operation itself. In another work, [32] present a blockchain-integrated framework combining lattice-based post-quantum primitives with distributed ledger technology to protect the privacy and integrity of multimedia data in cloud-enabled public auditing platforms. Their work explicitly motivates the adoption of post-quantum primitives by the harvestnow-decrypt-later threat to long-lived cloud data and demonstrates the feasibility of integrating lattice-based cryptography into cloud auditing workflows. Nevertheless, their optimization target is the integrity assurance of the auditing platform under a blockchain trust model rather than the client-side cost of authentication at upload time, and their construction does not treat the hybrid classicalplus-post-quantum composition through which the present work hedges transition-period risk. Two lines of work approach the batch-signing problem more directly. [33] propose lattice-based batch

signature schemes in which a single signer authenticates a group of messages at approximately the cost of one signature operation, with signing and verification complexity independent of the number of messages 𝑘. Their constructions employ either a binary-tree structure or an intersection method over lattices, and are proven existentially unforgeable under adaptive chosen-message attack based on the hardness of the Small Integer Solution problem. Their target, however, is message integration authentication in IoT sensor networks, their analysis is asymptotic rather than empirical, and their schemes are purely lattice-based, offering no classical component against which to hedge post-quantum cryptanalytic risk during the transition period. [34] come closer to the present setting, combining classical and post-quantum signatures under a nested combiner of the form employed in [23], and detaching commitment computation from per-item signing to reduce the cost of authenticating large batches. Their efficiency, however, depends on a hardware-assisted commitment construction executed within a trusted execution environment, and their deployment context is continuous data offload for digital twins and low-end IoT devices rather than client-side multi-file upload to cloud object storage. In essence, the batch-signing mechanism has been established for purely post-quantum schemes [33] and, in hybrid form, for hardware-assisted streaming workloads [34], while hybrid classical-post-quantum composition [23], [24] and post-quantum deployment in cloud storage [32] have advanced separately. To the best of our knowledge, no prior work combines a hybrid classicalpost-quantum signature with a pre-signing batch commitment, realized in software without secure-hardware assumptions and evaluated empirically across batch sizes, for single-client multi-file upload to cloud storage. This is the gap the present work addresses. 3. PROPOSED MODEL DESIGN 3.1 Cryptographic Preliminaries Hybrid Key Encapsulation The hybrid KEM combines Curve25519 and MLKEM-768 through concatenation followed by key derivation. The encapsulation process generates ephemeral Curve25519 keys, performs ML-KEM-768 encapsulation, concatenates both shared secrets (𝐾𝑋25519 ⃦ 𝐾𝑀𝐿−𝐾𝐸𝑀−768 ), and applies HKDF-SHA-256 to derive the final symmetric key 𝐾𝑠 . This concatenationbased approach, when combined with HKDF, ensures that the derived key maintains full security as long as a minimum of one KEM (either Curve25519 ECDH or MLKEM-768) remains secure against attacks. This provides defense-in-depth against cryptanalytic advances. Digital Signatures Authentication uses AND-composed dual signatures. Both Ed25519 and ML-DSA-65 signatures are generated

over the same message, and verification succeeds only if both signatures are valid. This composition ensures that forging a signature requires breaking both schemes, which provides authentication security that gracefully transitions to post-quantum security. Our proposed model integrates five carefully selected cryptographic algorithms: AES-256-GCM: Authenticated encryption provides confidentiality and integrity for bulk data. The 256-bit key size maintains security even with Grover’s quantum search algorithm, which reduces effective security to 128 bits. Combined with ML-KEM-768’s quantum resistance, the overall system achieves 128 bits of post-quantum security. Curve25519 ECDH: Ephemeral Elliptic Curve DiffieHellman provides forward secrecy and efficient classical key exchange. It offers approximately 128 bits of classical security. ML-KEM-768: NIST-standardized lattice-based key encapsulation mechanism provides post-quantum key exchange with NIST security level 3, 128 bits quantum security. Ed25519: Elliptic curve digital signature provides efficient classical authentication with 128 bits of classical security. ML-DSA-65: NIST-standardized lattice-based digital signature provides post-quantum authentication with NIST security level 3. 3.2 Architecture of Proposed Hybrid Model The proposed model adopts a symmetric senderreceiver architecture, in which both parties share an identical stack of modules: a Key Management and Crypto Engine, a Data Encryption/Decryption Module, a Commitment Module, and an Authentication and Validation Module. The sender passes plaintext files through these modules to produce a sealed batch of ciphertexts, a single SHA3-256 commitment, and a dual signature (Ed25519 and ML-DSA-65), which is transmitted over a public channel. The receiver reverses the process, accepting the batch only if the recomputed commitment matches and both signatures verify. Fig. 1 below shows a detailed architecture of the proposed AES-ECC-PQC hybrid cryptographic model. Key Management and Crypto Engine: The architecture incorporates a Key Management and Crypto Engine responsible for key generation, exchange, encapsulation, and derivation at both communicating parties (A and B). The Elliptic Curve Cryptography (ECC) Engine implements X25519 (Curve 25519) for Elliptic Curve Diffie-Hellman (ECDH) key exchange, selected for strong security guarantees, compact key sizes of 32 bytes, and low computational overhead suitable for highperformance scalable cloud systems. In parallel, the PostQuantum Key Encapsulation Mechanism (PQ-KEM) based on ML-KEM-768 performs key encapsulation and decapsulation to generate a post-quantum shared secret, ensuring resilience against quantum attacks including Shor’s algorithm which threatens classical public-key

cryptography. Classical and post-quantum shared secrets are concatenated and processed through Hash-based Message Authentication Code (HMAC)-based Key Derivation Function (HKDF) using SHA-256, which performs extract-and-expand operations to produce a high entropy 256-bit symmetric session key with strong unpredictability. This hybrid key derivation approach ensures security as long as a minimum of one underlying cryptographic assumption holds. This achieves both forward secrecy and quantum resilience through defensein-depth. Per-session nonce and salt generation strengthen key entropy, ensure freshness and uniqueness of cryptographic operations, prevent replay attacks, and protect against precomputation and related-key vulnerabilities.

Engine. For each ciphertext in the batch, the module recomputes the GCM authentication tag and decrypts only if the tag verifies, ensuring per-file integrity and authenticity at the symmetric layer. Any tampering with a ciphertext, its associated data, or its nonce causes tag verification to fail and the affected file is rejected without decryption. Successful decryption yields the original plaintext which is forwarded only after the Commitment Verification and Authentication modules also confirm batch-level integrity. Commitment Module: The Commitment Module produces a single cryptographic binding over the entire batch of file ciphertexts using SHA3-256. This commitment captures the integrity of every ciphertext in the batch in one short, fixed-size value, which is then included in the transcript signed by the Authentication and Validation Module. Any tampering (substitution, reordering, or modification) with any ciphertext causes the

Fig.1: Detailed Architecture of Proposed AES-ECC-PQC Model Data Encryption Module: This module ensures data confidentiality and integrity using the derived symmetric session key. Encryption employs Advanced Encryption Standard in Galois Counter Mode (AES-256-GCM), chosen for strong security properties, authenticated encryption capability, and implementation efficiency. GCM provides confidentiality, integrity, and authenticity in a single operation, reducing computational overhead. As shown in Fig. 1, encrypted data flows between the Data Encryption Module and Cloud Storage, remaining unreadable and tamper-evident even if infrastructure or communication channels are compromised. Data Decryption Module: The Data Decryption Module reconstructs the plaintext from received ciphertexts using AES-256-GCM under the session key derived by the receiver’s Key Management and Crypto

recomputed commitment at the receiver to mismatch and the batch to be rejected. By replacing per-file signing with a single signature over the batch commitment, the module reduces the number of post-quantum signature operations from 𝑂(𝑛) to 𝑂(1) thus from 2𝑛 invocations to two, irrespective of batch size, while preserving integrity guarantees. Authentication and Validation Module: This module employs hybrid digital signatures for entity authentication, integrity verification, and non-repudiation. Party A generates dual signatures using Ed25519 (classical elliptic curve authentication) and ML-DSA-65 (lattice-based postquantum signature) over cryptographic transcripts. Party B verifies both signatures through corresponding Ed25519 and ML-DSA-65 verifiers. Successful dual verification confirms message legitimacy and session integrity,

ensuring authentication security even if either classical or post-quantum schemes are compromised. Cloud Storage and Processing: This component represents the external cloud environment positioned outside the cryptographic trust boundary. All data entering this component is protected by AES-256-GCM, with authentication and validation performed before acceptance. This design ensures plaintext data and cryptographic keys are never exposed to cloud infrastructure. The proposed hybrid post-quantum cryptographic model operates through a number of steps which ensure both classical and quantum security:

(1) The sender performs X25519 Elliptic Curve Diffie-Hellman (ECDH) key exchange and ML-KEM-768 key encapsulation with the recipient’s public keys to generate dual shared secrets, providing defense-in-depth against both classical and quantum adversaries. (2) Both secrets are concatenated and processed through HKDF-SHA-256 to derive a high-entropy 256-bit AES session key, ensuring security as long as at least one underlying primitive remains unbroken. (3) The plaintext is encrypted using AES-256-GCM with Additional Authenticated Data (AAD) to produce ciphertext, providing confidentiality, integrity, and authenticity in a single cryptographic operation.

Fig.2: Encryption Protocol Flow

Fig. 2: Decryption Protocol Flow

(4) A cryptographic commitment ℎ𝑐 is computed over the full set of batch ciphertexts using the SHA3-256 hash function, binding all n ciphertexts into a single fixed-size value that is subsequently signed once, rather than signing each ciphertext individually. (5) A cryptographic transcript T is constructed containing the nonce, salt, authentication tag, ML-KEM ciphertext, AAD, and commitment. (6) Dual signatures using Ed25519 and ML-DSA-65 are generated over T, providing hybrid authentication resistant to both classical and quantum attacks. (7) The complete package containing ciphertext, cryptographic parameters, and both signatures is transmitted to the recipient. (8) The recipient reconstructs transcript T and verifies both signatures for authenticity. (9) Performs ECDH and ML-KEM decapsulation operations to recover the identical session key via HKDF. (10) Decrypts the ciphertext using AES-256-GCM with AAD verification. (11) Validates that the recomputed commitment matches the received commitment before outputting the plaintext, while rejecting any package with invalid signatures or mismatched commitments to prevent forgery and tampering attacks. Fig.2 and Fig.3 above show the encryption and decryption protocols respectively.

3.3 Formulation of the Proposed Model The proposed hybrid post-quantum cryptographic model (𝛱) is represented as follows: 𝛱 = (𝑆𝑖𝑔𝑛(𝐸𝐶𝐶,𝑃𝑄𝐶) ) ∘ (𝐴𝐸𝐴𝐷𝐻𝐾𝐷𝐹(𝐸𝐶𝐷𝐻∥𝐾𝐸𝑀) )

(1)

𝛱 = (𝜎𝐸𝑑25519 ˄ 𝜎𝑀𝐿−𝐷𝑆𝐴−65 ) ∘ (𝐴𝐸𝑆 − 𝐺𝐶𝑀𝐾𝑠 ) (2) 𝛱 = (𝜎𝐸𝑑25519 (𝑠𝑘𝐴 , 𝑇)˄ 𝜎𝑀𝐿−𝐷𝑆𝐴−65 (𝑠𝑘𝐴 , 𝑇)) ∘ (𝐴𝐸𝑆 − 𝐺𝐶𝑀𝐾𝑠 )

(3)

To optimize signature performance, a cryptographic commitment, ℎ𝑐 to the ciphertext 𝐶 is created: ℎ𝑐 = SHA3-256 ((𝐶1 ) ∥ ⋯ ∥ (𝐶𝑛 ))

(4)

Where, 𝐾𝑠 = HKDF-SHA-256 (𝐾𝑋25519 ⃦ 𝐾𝑀𝐿−𝐾𝐸𝑀−768 ), 𝑆, 𝑁 ) 𝐾𝑋25519 = 𝐸𝐶𝐷𝐻( 𝑠𝑘𝐴 , 𝑝𝑘𝐵 ) 𝐾𝑀𝐿−𝐾𝐸𝑀−768 = 𝐸𝑛𝑐𝑎𝑝𝑠( 𝑝𝑘𝐵 ) 𝑇 = 𝑁 ⃦ 𝑆 ⃦ 𝜏𝑛 ⃦ 𝐶𝑃𝑄𝐶 ⃦ 𝐴𝐴𝐷 ⃦ ℎ𝑐 𝜎𝐸𝑑25519 = classical signature 𝜎𝑀𝐿−𝐷𝑆𝐴−65 = post quantum signature 𝐶 = 𝑏𝑎𝑡𝑐ℎ ciphertext (AES − GCM encrypted data)

𝐶𝑃𝑄𝐶 = ciphertext (AES − GCM encrypted data) 𝑠𝑘𝐴 = the private key of Party A 𝑝𝑘𝐵 = the public key of party B. 𝑇 = the transcript ( the data being signed) 𝐴𝐴𝐷 = Additional Authenticated Data ℎ𝑐 = ciphertext commitment 𝑆 = salt for HKDF 𝑁 = nonce for AES − GCM 𝜏𝑛 = authentication tag for AES − GCM The proposed model is justified by showing that each security goal is supported by a primitive that resists both classical and quantum adversaries, with classical components paired against post-quantum counterparts so that no single break compromises the system. Confidentiality: Payload data is protected by AES256-GCM, which retains approximately 128 bits of security under Grover’s algorithm. The session key is derived from a hybrid combination of X25519 and MLKEM-768 through HKDF-SHA-256, so recovery requires breaking both the elliptic curve discrete logarithm problem and the Module-LWE problem simultaneously. Integrity: AES-GCM’s authentication tag detects bitlevel tampering at the level of the individual ciphertext. At the batch level, the SHA3-256 commitment ℎ𝑐 = SHA3-256 ((𝐶1 ) ∥ ⋯ ∥ (𝐶𝑛 )) binds the entire ordered batch into a single 32-byte verifiable value: because concatenation is order-sensitive and the transcript records the file count 𝑛, the commitment protects against individual file tampering, file reordering, insertion of unauthorised files, and deletion of legitimate files. The commitment reduces the number of post-quantum signature operations per batch from 𝑂(𝑛) to 𝑂(1), without weakening the per-file integrity guarantees provided by AES-GCM. Authentication: The commitment ℎ𝑐 is signed in parallel with Ed25519 and ML-DSA-65, and the composite signature is accepted only if both individual signatures verify. Forgery therefore requires breaking both the classical and the post-quantum signature scheme; under a quantum adversary that breaks Ed25519, unforgeability is preserved because ML-DSA-65 remains post-quantum secure. This AND-combiner preserves EUF-CMA security whenever at least one component signature scheme remains unforgeable. Forward secrecy and HNDL resistance: Session keys are derived from ephemeral X25519 and ML-KEM-768 keypairs that are erased on session close; long-term keys are used only for signing. An adversary that archives today’s ciphertexts for future decryption against a quantum-capable opponent gains no advantage, because session-key recovery still requires breaking ML-KEM768, which is designed to resist quantum attack.

Cloud service provider resistance: The cloud service provider sees only the ciphertext, the GCM tag, the commitment, and the dual signature, none of which leaks plaintext or key material. Any tampering invalidates the GCM tag, the commitment, or the dual signature, all of which are bound together in the signed transcript. In summary, every security goal is supported by at least one scheme that remains secure against both classical and quantum adversaries, and the commitment-based design holds the number of post-quantum signature operations constant at two per batch, irrespective of 𝑛, without weakening any security property. 4. COMPLEXITY ANALYSIS This section derives the aggregate cost of the proposed model 𝛱 and compares it against a per-file signing baseline that uses the same primitives but signs each file individually. The number of post-quantum signature operations required to authenticate a batch of 𝑛 files is reduced from 𝑂(𝑛) in the baseline to 𝑂(1) in 𝛱. The total signing-phase work remains 𝑂(𝑛) because of the commitment construction, but the per-file marginal coefficient is dominated by SHA3-256 hashing over 32byte digests rather than by lattice signing.

Operation

Phase

5

Per-file SHA3-256 hashing of ciphertexts

Commitment

Outer SHA3256 over concatenated 32-byte digests

Commitment

Ed25519 and ML-DSA-65 signing of the transcript

Authentication

6

7

Complexity 𝑂(𝑁)

𝑂(𝑛)

𝑂(1)

Operations 1-3 and 7 have fixed-length inputs and are 𝑂(1). Bulk encryption and per-file hashing scale with the total ciphertext size 𝑁. The outer commitment hashes 32𝑛 bytes and scales with 𝑛 only.

4.3 Aggregate Complexity Summing per-operation costs, the total cost of 𝛱 for a batch of 𝑛 files totalling 𝑁 plaintext bytes is:

4.1 Notation Let 𝑛 denote the number of files in the batch, |𝑚𝑖 | the size of the 𝑖-th plaintext, 𝑁 = ∑𝑛𝑖=1|𝑚𝑖 | the total plaintext size, and |𝐶𝑖 | = |𝑚𝑖 | + 16 the ciphertext size including the AES-GCM tag. All cryptographic primitives are assumed to run in time proportional to their input length, as specified by FIPS 197 for AES-256-GCM [35], FIPS 202 for SHA3-256 [36], FIPS 203 for ML-KEM-768 [37], FIPS 204 for ML-DSA-65[38], RFC 7748 for X25519 [39], RFC 8032 for Ed25519 [14], and RFC 5869 for HKDF-SHA-256 [40].

4.2 Per Operation Cost The proposed scheme performs the following operations per batch, grouped by phase. Table 1: Per Operation Complexity of Proposed Model No.

Operation

Phase

Complexity

1–3

X25519 ECDH, MLKEM-768 encapsulation, HKDF

Key establishment

𝑂(1)

AES-256GCM encryption of the batch

Bulk encryption

4

No.

𝑂(𝑁)

𝑇𝛱 (𝑛, 𝑁) = 𝑐KEM + (𝑐AES + 𝑐H ) ⋅ 𝑁 + 32𝑐H ⋅ 𝑛 + 𝑐Sig (5) where 𝑐KEM is the fixed key-establishment cost, 𝑐AES and 𝑐H are per-byte AES-256-GCM and SHA3-256 rates, and 𝑐Sig is the fixed cost of the Ed25519 + ML-DSA-65 dual signature. The corresponding baseline cost, in which each file is signed with its own dual signature, is: 𝑻baseline (𝒏, 𝑵) = 𝒄KEM + 𝒄AES ⋅ 𝑵 + 𝒏 ⋅ 𝒄Sig

(6)

The number of signature operations in 𝛱 is exactly two: one Ed25519 signing call and one ML-DSA-65 signing call, regardless of 𝑛. This is the 𝑂(1) signatureoperation count that constitutes the central complexity contribution. The baseline performs 𝑛 dual signatures, giving an 𝑂(𝑛) signature-operation count. 4.4 Comparison The cost saving of 𝛱 over the baseline is: 𝛥𝑇(𝑛, 𝑁) = 𝑇baseline − 𝑇𝛱 = (𝑛 − 1) ⋅ 𝑐Sig − 𝑐H (𝑁 + 32𝑛) (7) 𝑐Sig which is a dual classical and lattice signature is substantially larger than the per-byte SHA3-256 hashing rate on the test platform. The savings term (𝑛 − 1) ⋅ 𝑐Sig dominates the additional hashing term 𝑐H (𝑁 + 32𝑛) for all 𝑛 ≥ 2. Equivalently, 𝛱 replaces 𝑛 per-file dual signatures with a single dual signature over a 32-byte commitment,

plus one additional pass of SHA3-256 hashing over the batch ciphertexts. Section 5.2 reports the measured signing-phase time reduction across batch sizes 𝑛 ∈ {10,50,100,500,1000} at three different file sizes (100 KB, 1 MB, and 10 MB). At 𝑛 = 1000, the measured ratio of baseline to proposed signing-phase time ranges from 606-fold to 725-fold across the three file sizes, with the linear scaling of the baseline confirmed at 𝑅2 > 0.99 in each case.

5.

EXPERIMENTAL RESULTS PERFORMANCE ANALYSIS

AND

5.1 Experimental Setup All experiments were conducted on a single laptop platform which is an Intel Core i5-6300U CPU at 2.40 GHz (2 physical cores, 4 logical processors) with 16 GB of installed physical memory. The benchmarks measure the signing-phase time from the start of the batch commitment construction or the first per-file signature call in the baseline to the completion of the final signature call. This is done across two parameters: batch size 𝑛 ∈ {10,50,100,500,1000} and file size |𝑚𝑖 | ∈ {100 KB, 1 MB, 10 MB}. Each combination is measured across 20 independent repeats to provide statistical stability. The signing phase is measured separately from bulk AES-256-GCM encryption to isolate the contribution of the commitment-based construction, which affects only the signing phase. The proposed model 𝛱 is compared against a per-file signing baseline that uses the same primitives, X25519, ML-KEM-768, HKDF-SHA-256, AES-256-GCM, Ed25519, and ML-DSA-65, but authenticates each file with its own dual signature rather than a single dual signature over a batch commitment. The only structural difference between baseline and proposed model is the SHA3-256 batch commitment ℎ𝑐 and its associated single dual signature. The implementation leverages Python 3 and uses three cryptographic libraries. The cryptography library provides X25519 elliptic-curve Diffie-Hellman key exchange, Ed25519 signing and verification, and HKDF-SHA-256 key derivation. The pycryptodome library provides AES256-GCM authenticated encryption and SHA3-256 hashing for the batch commitment. The pqcrypto library provides ML-KEM-768 encapsulation and decapsulation and ML-DSA-65 signing and verification. 5.2 Results and Analysis To verify the predicted reduction in signatureoperation count, we measured the dual-signing time of the proposed scheme against a per-file signing baseline across batch sizes 𝑛 ∈ {10,50,100,500,1000} at a fixed file size of 1 MB. The per-file signing baseline performs n independent dual signatures, computing one Ed25519 signature and one ML-DSA-65 signature for each file. The proposed model performs a single dual signature over the

SHA3-256 batch commitment ℎ𝑐 , regardless of 𝑛. In both schemes, the AES-256-GCM encryption and per-file ciphertext hashing are identical and are excluded from the timed region; only the signing phase is measured. Each configuration was timed twenty (20) times and the mean across repetitions were recorded. Table 2: Signing Time for a File Size of 100KB Batch Size (n)

Proposed Model (s)

Baseline Model (s)

10

0.001198

0.010493

50

0.001192

0.056332

100

0.001925

0.107445

500

0.001471

0.488285

1000

0.001627

1.022693

Table 3: Signing Time for a File Size of 1MB Batch Size (n)

Proposed Model (s)

Baseline Model (s)

10

0.001040

0.010176

50

0.001107

0.050037

100

0.000952

0.102650

500

0.001363

0.512715

1000

0.001651

1.000424

Table 4: Signing Time for a File Size of 10MB Batch Size (n)

Proposed Model (s)

Baseline Model (s)

10

0.000917

0.009970

50

0.001157

0.049795

100

0.001184

0.100933

500

0.001364

0.493574

Batch Size (n)

Proposed Model (s)

Baseline Model (s)

1000

0.001352

0.980197

Tables 2-4 report the mean signing-phase time of the proposed and baseline models across batch sizes 𝑛 ∈ {10, 50, 100, 500, 1000}, for per-file sizes of 100 KB, 1 MB, and 10 MB respectively, each averaged over 20 repetitions. In every case the baseline grows in direct proportion to 𝑛, rising from approximately 10 ms at n = 10 to close to 1.0 s at n = 1000, which is consistent with issuing one dual signature per file. The proposed model, which issues a single dual signature over the batch commitment, remains on the order of 1-2 ms throughout, varying only weakly and non-monotonically with 𝑛 rather than growing with it. At 𝑛 = 1000 the resulting reduction in signing time is 629x for 100 KB, 606x for 1 MB, and 725x for 10 MB. These results confirm that the baseline cost is governed by the number of per-file signature operations, whereas the proposed model holds the number of post-quantum signature operations constant at one per batch irrespective of 𝑛, yielding a near-constant signing time whose residual variation reflects the transcript growing with batch size rather than any dependence of the signature count on 𝑛.

Fig.5: Signature Time vs Batch Size at 1MB per File

Fig.6: Signature Time vs Batch Size at 10MB per File

Fig.4: Signature Time vs Batch Size at 100KB per File

Figures 4-6 show signing-phase time against batch size 𝑛 on log-log axes, for per-file sizes of 100 KB, 1 MB, and 10 MB. In all three, the baseline grows linearly with 𝑛, its through-origin fit yielding a per-file cost of approximately 1.0 ms/file with 𝑅² ≥ 0.999, and rising from about 10 ms at 𝑛 = 10 to roughly 1.0 s at n = 1000. The proposed model remains near-constant across the same range, with a mean of 1.19-1.48 ms depending on file size and only weak, non-monotonic variation in 𝑛 which is consistent with a fixed number of signature operations rather than a per-file cost. The reduction of signing time at n = 1000 is 629x for 100 KB, 606x for 1 MB, and 725x for 10 MB. The error bars on the proposed points are wide relative to its own sub-millisecond scale but negligible against the baseline, and the residual variation reflects the signed transcript growing with 𝑛 rather than any growth in the signature count, which remains fixed at two operations per batch. 6. LIMITATIONS AND FUTURE WORK The empirical evaluation characterizes the sender-side signing-phase cost only. The corresponding receiver-side cost of reconstructing the SHA3-256 batch commitment, verifying both signatures, and decrypting each ciphertext

is asymmetric with the sender-side cost and is not measured. Empirical characterization of this asymmetry across representative cloud retrieval workloads is a target for future measurement. Secondly, the measurements were obtained on a single commodity client platform (Intel Core i5-6300U) using production Python cryptographic libraries. Evaluation on server-grade CPUs, constrained edge devices, and platforms with dedicated cryptographic acceleration would clarify how the reported improvements scale across deployment platforms and quantify the extent to which the wall-clock times are constrained by implementation-level rather than algorithmic factors. Finally, the flat single-level commitment does not support selective per-file verification, which limits applicability in scenarios where a client retrieves a small subset of a larger batch. Alternative commitment structures, including Merkle-tree and Verkle-tree variants could be explored in the future.

Guideline,” Symmetry (Basel)., vol. 15, no. 11, Nov. 2023, doi: 10.3390/sym15111981. [3]

T. Ali, M. Al-Khalidi, and R. Al-Zaidi, “Information Security Risk Assessment Methods in Cloud Computing: Comprehensive Review,” 2026, Taylor and Francis Ltd. doi: 10.1080/08874417.2024.2329985.

[4]

S. K. Sahu and K. Mazumdar, “State-of-the-art analysis of quantum cryptography: applications and future prospects,” Front. Phys., vol. 12, p. 1456491, 2024, doi: 10.3389/fphy.2024.1456491.

[5]

P. W. Shor, “Algorithms for quantum computation: Discrete logarithms and factoring,” in Proceedings 35th Annual Symposium on Foundations of Computer Science, IEEE, 1994, pp. 124–134.

[6]

D. Bluvstein et al., “Logical quantum processor based on reconfigurable atom arrays,” Nature, vol. 626, no. 7997, pp. 58–65, 2024, doi: 10.1038/s41586-023-06927-3.

[7]

“Module-lattice-based digital signature standard,” Aug. 2024. doi: 10.6028/NIST.FIPS.204.

[8]

“Module-lattice-based mechanism standard,” 10.6028/NIST.FIPS.203.

[9]

F. Kagai, P. Branch, J. But, and R. Allen, “Harvest-Now, Decrypt-Later: A Temporal Cybersecurity Risk in the Quantum Transition,” Telecom, vol. 6, no. 4, p. 100, 2025, doi: 10.3390/telecom6040100.

[10]

F. Barrett-danes and F. Ahmad, “Quantum computing and cybersecurity: a rigorous systematic review of emerging threats, postquantum solutions, and research directions (2019– 2024),” Oct. 01, 2025, Springer Nature. doi: 10.1007/s42452-025-07322-5.

[11]

A. Gupta and S. Mittal, “Post-quantum readiness and cryptographic transition planning for enterprise cloud,” Cybersecurity, vol. 9, no. 1, p. 147, Apr. 2026, doi: 10.1186/s42400-026-005792.

[12]

C. R. Garcia, A. C. Aguilera, C. Stan, J. J. V Olmos, S. Rommel, and I. T. Monroy, “Enhanced network security protocols for the quantum era: Combining classical and post-quantum cryptography, and quantum key distribution,” IEEE Journal on Selected Areas in Communications, vol. 43, no. 8, pp. 2765–2781, 2025, doi: 10.1109/JSAC.2025.3568011.

[13]

N. I. of S. and T. (NIST), “Post-Quantum Cryptography Standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA),” U.S. Department of Commerce, Gaithersburg,

7. CONCLUSION This paper presented a commitment-based hybrid post-quantum cryptographic model for authenticated multi-file upload to cloud storage. The model comprises AES-256-GCM for bulk encryption, a hybrid X25519 with ML-KEM-768 for key encapsulation, and a hybrid Ed25519 with ML-DSA-65 dual signature, over a SHA3256 batch commitment computed before signing. The distinguishing feature of the model is that this pre-signing commitment reduces the number of ML-DSA-65 signature invocations per batch from 𝑛 to one, independent of batch size, while the remaining work, which is bulk symmetric encryption and hashing, is bounded by fast symmetric primitive throughput. Empirical evaluation on a commodity client platform confirms the structural claim. At a batch size of 𝑛 = 1000, the proposed model reduces signing-phase time by a factor of 629, 606, and 725 for file sizes of 100 KB, 1 MB, and 10 MB respectively, relative to a per-file dualsigning baseline sharing every other primitive. Across all three file sizes the baseline grows in direct proportion to 𝑛 while the proposed model remains near-constant, its residual variation reflecting the signed transcript growing with batch size rather than any dependence of the postquantum signature count, which stays fixed at two operations per batch, on 𝑛. REFERENCES [1]

[2]

T. R. Merlo, F. Fard, and S. Hawamdeh, “Cloud Computing’s Impact on the Digital Transformation of the Enterprise: A MixedMethods Approach,” Sustainability (Switzerland), vol. 17, no. 13, Jul. 2025, doi: 10.3390/su17135755. M. Dawood, S. Tu, C. Xiao, H. Alasmary, M. Waqas, and S. U. Rehman, “Cyberattacks and Security of Cloud Computing: A Complete

key-encapsulation Aug. 2024. doi:

MD, 2024. [Online]. https://www.nist.gov/pqcrypto

Available:

[14]

S. Josefsson and I. Liusvaara, “Edwards-Curve Digital Signature Algorithm (EdDSA),” RFC, vol. 8032, pp. 1–60, 2017, doi: 10.17487/RFC8032.

[15]

P. Selvi and S. Sakthivel, “A hybrid ECC-AES encryption framework for secure and efficient cloud-based data protection,” Sci. Rep., vol. 15, p. 30867, 2025, doi: 10.1038/s41598-025-01315-5.

[16]

N. H. Sabbry and A. Levina, “An optimized elliptic curve digital signature strategy for resource-constrained devices,” Sci. Rep., vol. 15, no. 1, Dec. 2025, doi: 10.1038/s41598-025-056010.

[17]

R. Taguchi and A. Takayasu, “Shor’s Quantum Algorithm for Solving the Binary ECDLP: A Survey,” in Advances in Information and Computer Security, Springer, 2024. doi: 10.1007/978-981-96-1218-5_7.

[18]

S. Mandal, R. Anand, M. Rahman, S. Sarkar, and T. Isobe, “Implementing Grover’s on AES-based AEAD schemes,” Sci. Rep., vol. 14, no. 1, Dec. 2024, doi: 10.1038/s41598-024-69188-8.

[19]

J. S. Buruaga, A. Bugler, J. P. Brito, V. Martin, and C. Striecks, “Versatile quantum-safe hybrid key exchange and its application to MACsec,” EPJ Quantum Technol., vol. 12, no. 1, Dec. 2025, doi: 10.1140/epjqt/s40507-025-00382-x.

[20]

F. Giacon, F. Heuer, and B. Poettering, “KEM Combiners,” in Public-Key Cryptography – PKC 2018, Cham: Springer, 2018, pp. 190–218. doi: 10.1007/978-3-319-76578-5_7.

[21]

D. Sikeridis, P. Kampanakis, and M. Devetsikiotis, “Assessing the overhead of post-quantum cryptography in TLS 1.3 and SSH,” in Proceedings of the 16th International Conference on emerging Networking EXperiments and Technologies, 2020, pp. 149–156.

[22]

[23]

[24]

G. Alagic et al., “Status report on the third round of the NIST post-quantum cryptography standardization process,” NIST, 2022. N. Bindel, U. Herath, M. McKague, and D. Stebila, “Transitioning to a Quantum-Resistant Public Key Infrastructure,” in Post-Quantum Cryptography, vol. 10346, T. Lange and T. Takagi, Eds., in Lecture Notes in Computer Science, vol. 10346. , Cham, Switzerland: Springer International Publishing, 2017, pp. 384– 405. doi: 10.1007/978-3-319-59879-6_22. N. Bindel, J. Brendel, M. Fischlin, B. Goncalves, and D. Stebila, “Hybrid key encapsulation mechanisms and authenticated key exchange,” in International Conference on Post-Quantum Cryptography, Springer, 2019, pp. 206–226.

[25]

P. Schwabe, D. Stebila, and T. Wiggers, “PostQuantum TLS Without Handshake Signatures,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA: ACM, 2020, pp. 1461–1480. doi: 10.1145/3372297.3423350.

[26]

D. Stebila and M. Mosca, “Post-Quantum Key Exchange for the Internet and the Open Quantum Safe Project,” in Selected Areas in Cryptography – SAC 2016, in Lecture Notes in Computer Science, vol. 10532. Cham: Springer, 2016, pp. 14–37.

[27]

S. Halevi and S. Micali, “Practical and ProvablySecure Commitment Schemes from Collision-Free Hashing,” in Advances in Cryptology - CRYPTO ’96, Berlin, Heidelberg: Springer-Verlag, 1996, pp. 201–215. doi: 10.1007/3-540-68697-5_16.

[28]

M. Bellare and P. Rogaway, “The Exact Security of Digital Signatures: How to Sign with RSA and Rabin,” in Advances in Cryptology EUROCRYPT ’96, Berlin, Heidelberg: SpringerVerlag, 1996, pp. 399–416. doi: 10.1007/3-54068339-9_34.

[29]

J. Li, J. Li, X. Chen, C. Jia, and W. Lou, “IdentityBased Encryption with Outsourced Revocation in Cloud Computing,” IEEE Transactions on Computers, vol. 64, no. 2, pp. 425–437, 2015, doi: 10.1109/TC.2013.208.

[30]

P. Kampanakis and D. Sikeridis, “Two PostQuantum Signature Use-cases: Non-issues, Challenges and Potential Solutions,” in Proceedings of the 15th International Conference on Availability, Reliability and Security, New York, NY, USA: ACM, 2020, pp. 1–10. doi: 10.1145/3407023.3407057.

[31]

P. Narsimhulu, P. Chithaluru, and R. Aluvalu, “Efficient post-quantum cryptographic signature aggregation for low-latency distributed networks,” Journal on Information Security, vol. 2026, no. 1, p. 6, Feb. 2026, doi: 10.1186/s13635-026-002288.

[32]

A. A. Khan et al., “Quantum computing empowering blockchain technology with post quantum resistant cryptography for multimedia data privacy preservation in cloud-enabled public auditing platforms,” Journal of Cloud Computing, vol. 14, no. 1, p. 43, Aug. 2025, doi: 10.1186/s13677-025-00771-8.

[33]

X. Lu, W. Yin, Q. Wen, K. Liang, L. Chen, and J. Chen, “Message Integration Authentication in the Internet-of-Things via Lattice-Based Batch Signatures,” Sensors, vol. 18, no. 11, p. 4056, 2018, doi: 10.3390/s18114056.

[34]

S. E. Nouma and A. A. Yavuz, “Trustworthy and Efficient Digital Twins in Post-Quantum Era with

Hybrid Hardware-Assisted Signatures,” ACM Transactions on Multimedia Computing, Communications, and Applications, vol. 20, no. 6, pp. 1–30, 2024, doi: 10.1145/3638250. [35]

N. I. of S. and Technology, “Advanced Encryption Standard (AES),” Federal Information Processing Standards Publication (FIPS), vol. 197, Nov. 2001, doi: 10.6028/NIST.FIPS.197.

[36]

M. J. Dworkin and N. I. of S. and Technology, “SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions,” Federal Information Processing Standards Publication (FIPS), vol. 202, Aug. 2015, doi: 10.6028/NIST.FIPS.202.

[37]

N. I. of S. and Technology et al., “Module-LatticeBased Key-Encapsulation Mechanism Standard,” Federal Information Processing Standards Publication (FIPS), vol. 203, Aug. 2024, doi: 10.6028/NIST.FIPS.203.

[38]

N. I. of S. and Technology, “Module-LatticeBased Digital Signature Standard,” Federal Information Processing Standards Publication (FIPS), vol. 204, Aug. 2024, doi: 10.6028/NIST.FIPS.204.

[39]

A. Langley, M. Hamburg, and S. Turner, “Elliptic Curves for Security,” RFC, vol. 7748, pp. 1–22, Jan. 2016, doi: 10.17487/RFC7748.

[40]

H. Krawczyk and P. Eronen, “HMAC-based Extract-and-Expand Key Derivation Function (HKDF),” RFC, vol. 5869, pp. 1–14, May 2010, doi: 10.17487/RFC5869.

Related documents

• The security of practical quantum key distribution#6600
• QUANTUM-ENHANCED ENCRYPTION TECHNIQUES FOR CLOUD DATA PROTECTION#99323
• Quantum-Enhanced Encryption Methods for Securing Cloud Data#706599
• A Novel Quantum Key Distribution Inspired Image Encryption (QKDIE) Algorithm for Enhanced Image Security#328176
• Mobile secret communications method based on quantum key distribution network — Quantumctek Co., Ltd. (US10560265B2)#607382