A Commitment-Based Hybrid Post-Quantum Cryptographic Model for Multi-File Cloud Storage

This paper presents a commitment-based hybrid post-quantum cryptographic model for authenticated multi-file upload to cloud storage. The model comprises AES-256-GCM for bulk encryption, a hybrid X25519 with ML-KEM-768 key encapsulation mechanism, and a hybrid Ed25519 with ML-DSA-65 dual signature, computed over a SHA3-256 batch commitment. The commitment binds all ciphertexts in a batch to a single fixed-size digest that is signed once, reducing the number of post-quantum signature invocations per batch from n to one, independent of batch size; the remaining encryption and hashing is bounded by fast symmetric throughput.

The paper addresses the performance barrier of lattice-based signatures in multi-file cloud storage workloads. ML-DSA-65 produces signatures of approximately 3.3 KB, more than fifty times the size of an Ed25519 signature. In a naïve per-file authentication scheme, the number of ML-DSA-65 signing operations grows linearly with n, so that the total signing-phase cost is dominated by the lattice signing operations rather than by the bulk AES-256-GCM encryption.

The proposed model integrates five cryptographic algorithms: AES-256-GCM for authenticated encryption providing confidentiality and integrity for bulk data; Curve25519 ECDH for forward secrecy and efficient classical key exchange; ML-KEM-768 for post-quantum key exchange with NIST security level 3; Ed25519 for efficient classical authentication; and ML-DSA-65 for post-quantum authentication with NIST security level 3.

The architecture adopts a symmetric sender-receiver design with identical modules: a Key Management and Crypto Engine, a Data Encryption/Decryption Module, a Commitment Module, and an Authentication and Validation Module. The sender passes plaintext files through these modules to produce a sealed batch of ciphertexts, a single SHA3-256 commitment, and a dual signature (Ed25519 and ML-DSA-65), transmitted over a public channel. The receiver reverses the process, accepting the batch only if the recomputed commitment matches and both signatures verify.

The hybrid key derivation concatenates classical and post-quantum shared secrets (K X25519 K ML-KEM-768) and processes them through HKDF-SHA-256 to derive a high-entropy 256-bit AES session key, ensuring security as long as at least one underlying primitive remains unbroken. The commitment h c = SHA3-256((C 1)... (C n)) is computed over the full set of batch ciphertexts, binding all n ciphertexts into a single fixed-size value that is subsequently signed once. A cryptographic transcript T is constructed containing the nonce, salt, authentication tag, ML-KEM ciphertext, AAD, and commitment, over which dual signatures using Ed25519 and ML-DSA-65 are generated.

The complexity analysis shows that the total cost of the proposed model for a batch of n files totalling N plaintext bytes is T Π(n, N) = c KEM + (c AES + c H) · N + 32c H · n + c Sig, where c KEM is the fixed key-establishment cost, c AES and c H are per-byte AES-256-GCM and SHA3-256 rates, and c Sig is the fixed cost of the Ed25519 + ML-DSA-65 dual signature. The baseline cost, in which each file is signed with its own dual signature, is T baseline(n, N) = c KEM + c AES · N + n · c Sig. The number of signature operations in the proposed model is exactly two: one Ed25519 signing call and one ML-DSA-65 signing call, regardless of n, reducing the signature-operation count from O(n) to O(1). The cost saving is ΔT(n, N) = T baseline − T Π = (n − 1) · c Sig − c H(N + 32n), where the savings term (n − 1) · c Sig dominates the additional hashing term for all n ≥ 2.

Experiments were conducted on an Intel Core i5-6300U CPU at 2.40 GHz with 16 GB of physical memory, using Python 3 with the cryptography library (X25519, Ed25519, HKDF-SHA-256), pycryptodome (AES-256-GCM, SHA3-256), and pqcrypto (ML-KEM-768, ML-DSA-65). The signing-phase time was measured across batch sizes n ∈ 10, 50, 100, 500, 1000 and file sizes m i ∈ 100 KB, 1 MB, 10 MB, with each combination measured across 20 independent repeats. The proposed model was compared against a per-file signing baseline using the same primitives but authenticating each file with its own dual signature.

The results show that the baseline grows in direct proportion to n, rising from approximately 10 ms at n = 10 to close to 1.0 s at n = 1000, consistent with issuing one dual signature per file. The proposed model, which issues a single dual signature over the batch commitment, remains on the order of 1-2 ms throughout, varying only weakly and non-monotonically with n rather than growing with it. At n = 1000, the resulting reduction in signing time is 629x for 100 KB, 606x for 1 MB, and 725x for 10 MB. The baseline's through-origin fit yields a per-file cost of approximately 1.0 ms/file with R2 ≥ 0.999.

The paper identifies limitations including that the empirical evaluation characterizes only the sender-side signing-phase cost, not the receiver-side cost of reconstructing the SHA3-256 batch commitment, verifying both signatures, and decrypting each ciphertext. Measurements were obtained on a single commodity client platform using production Python cryptographic libraries. The flat single-level commitment does not support selective per-file verification, limiting applicability in scenarios where a client retrieves a small subset of a larger batch; alternative commitment structures including Merkle-tree and Verkle-tree variants could be explored in the future.

The paper concludes that the pre-signing commitment reduces the number of ML-DSA-65 signature invocations per batch from n to one, independent of batch size, while the remaining work is bounded by fast symmetric primitive throughput. At a batch size of n = 1000, the proposed model reduces signing-phase time by a factor of 629, 606, and 725 for file sizes of 100 KB, 1 MB, and 10 MB respectively, relative to a per-file dual-signing baseline sharing every other primitive. Across all three file sizes the baseline grows in direct proportion to n while the proposed model remains near-constant, its residual variation reflecting the signed transcript growing with batch size rather than any dependence of the post-quantum signature count, which stays fixed at two operations per batch, on n.

Improvements to AI Systems:

1. Batch-Aware Cryptographic Scheduling: Implement a commitment-based batching layer in AI-driven cloud storage systems that aggregates multiple file-upload operations into a single signed digest. The AI system can dynamically choose batch sizes (e.g., n=100–1000) to minimize per-file authentication overhead, reducing signing latency from O(n) to O(1) while maintaining post-quantum security.

2. Hybrid Post-Quantum Key and Signature Management: Integrate the dual-primitive approach (X25519+ML-KEM-768 for key exchange; Ed25519+ML-DSA-65 for signing) into AI agents that handle secure data transfer. The AI system can automatically select hybrid cryptographic parameters based on threat models, ensuring forward secrecy and NIST Level-3 security even if one classical or quantum primitive is compromised.

3. Cost-Aware Resource Allocation: Use the complexity model T Π(n, N) = c KEM + (c AES + c H)·N + 32c H·n + c Sig to train AI optimizers that predict signing-phase costs for varying batch sizes and file sizes. This enables the AI to preemptively allocate CPU/memory resources, avoiding bottlenecks in multi-file upload pipelines—especially on resource-constrained edge devices.

4. Adaptive Batch Commitment Selection: Extend the flat SHA3-256 commitment to a Merkle-tree or Verkle-tree variant, allowing the AI system to support selective per-file verification. The improved AI can then decide when to use flat commitments (for full-batch integrity) versus tree-based commitments (for partial retrieval scenarios), balancing verification speed against storage overhead.

5. Predictive Performance Modeling: Train a regression model on the empirical results (e.g., 629x speedup at n=1000 for 100KB files) to predict signing-time reductions for unseen batch/file-size combinations. The AI can then recommend optimal batch sizes in real-time, maximizing throughput while keeping latency under user-defined thresholds.

6. Automated Cryptographic Primitive Switching: Build an AI controller that monitors the performance of AES-256-GCM, SHA3-256, ML-KEM-768, and ML-DSA-65 on the host hardware. It can switch to alternative primitives (e.g., lighter hashes for non-critical data) or adjust batch sizes if lattice-signature overhead becomes prohibitive, ensuring consistent performance across heterogeneous devices.

7. Security-Aware Transcript Validation: Enhance AI-based intrusion detection systems by incorporating the cryptographic transcript (nonce, salt, tag, ML-KEM ciphertext, AAD, commitment) as a structured feature. The AI can learn to detect anomalies in transcript composition or signature verification failures, flagging potential replay or tampering attacks in multi-file cloud uploads.

What the Improved AI System Can Do:

• Upload 1000 files with post-quantum authentication in 1–2 ms signing time (vs. 1 s for per-file signing), enabling real-time secure sync for large datasets.

• Dynamically adjust batch sizes and commitment structures based on file-size distributions and retrieval patterns, reducing latency by up to 725x while preserving NIST Level-3 security.

• Predict and preemptively mitigate signing-phase bottlenecks on low-power CPUs (e.g., Intel i5-6300U) using the derived cost model, ensuring smooth operation on commodity hardware.

• Provide selective file verification in large batches (via tree-based commitments) without re-hashing or re-signing the entire batch, improving efficiency for partial data access.

• Operate in hybrid classical/post-quantum environments, automatically falling back to classical-only primitives if quantum-safe libraries are unavailable, while still maintaining forward secrecy.