HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks

arXiv:2610.12024 · cs.CR, cs.NI · Submitted 2026-10-08 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks".

Elias: The gist HPQ-AKE is a sign-less hybrid authenticated key exchange protocol designed for efficient migration from classical Public Key Infrastructure to post-quantum key establishment by replacing transcript signatures with dual…

Nadia: First, who's behind it and why it matters.

Title and authors: Nadia: We’re diving deeper into the specifics of HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks. We saw that it replaces transcript signatures with dual KEMs, but what does that actually mean for the security model?

Elias: It means they’re combining ML-KEM-seven hundred sixty-eight to handle the session secrecy and RSA-OAEP to provide implicit mutual authentication, which is a hybrid setup designed to keep things secure while using different cryptographic primitives for different jobs <ref:2610.12024#pg1>.

Priya: So, when you talk about that hybrid nature, are we still dealing with a potential weakness if one of those components—say the RSA part—is compromised in some way? I’m thinking about how that might affect long-term data integrity.

Nadia: The security analysis covers authenticated key establishment and perfect forward secrecy under explicit exposure assumptions, but it also shows conditional KCI resistance under those same long-term-key-only exposure assumptions.

Elias: That means they’re providing a formal guarantee that even if an adversary only has access to the long-term keys, they still can't easily compromise past session keys, which is what forward secrecy is about.

Priya: So, when we look at the data showing the results, does that conditional KCI resistance hold up under different kinds of attacks than what they modeled? I want to see if this security holds up in a less ideal scenario than just key exposure assumptions.

Nadia: Theorem one is their formal bound for Session Key Indistinguishability, and it proves that the advantage an adversary has is bounded by Auth ROM plus Secrecy QROM under the Auth ROM and Secrecy QROM framework.

Elias: That framework helps them separate the classical authentication analysis from the quantum secrecy analysis, which is a clever way to model this kind of mixed protocol in a formal setting.

Priya: From what I’m seeing in their summary, they are also looking at how this behaves under IND-CCA2 security for perfect forward secrecy, which is a pretty strong standard for key exchange protocols.

Nadia: So, the implication is that this isn't just a theoretical sketch; it’s been analyzed rigorously against established security games to give us confidence in its behavior.

Elias: It’s about showing that the combination of ML-KEM and RSA-OAEP works together securely for key exchange, which is exactly what they aimed to achieve with this hybrid approach.

Priya: And looking at the overall picture, it’s a solid piece of work because it moves from just proposing an idea to providing a formal analysis showing the security guarantees against known attack models.

The paper's summary: Nadia: Let’s look at the summary section of this paper again regarding HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks. It boils down to replacing post-quantum transcript signatures with dual KEMs.

Elias: That replacement is the central mechanism, and it immediately addresses the overhead problem by cutting down on what needs to be sent over the network during a handshake.

Priya: So, what’s the practical implication of that cut? Is this just about saving a few kilobytes in a file size, or does it change how we think about protocol design for resource-limited devices?

Nadia: It’s more than just kilobytes; they quantify that reduction as fifty-six point four percent, going from thirteen thousand nine bytes down to five thousand six hundred sixty-eight bytes compared to the baseline Hybrid TLS one point three Full handshake.

Elias: That’s a substantial saving because it directly tackles the bandwidth constraint problem in scenarios where every byte counts on limited links or satellite backhaul.

Priya: When we look at the latency data, that thirty-one point four percent reduction on a simulated fifty kbps link is also huge for real-time applications because it means faster response times across noisy connections <ref:2610.12024#pg1>.

Nadia: It’s not just about speed; it’s about achieving a better balance where you get good security guarantees while keeping the communication load as low as possible.

Elias: The protocol structure itself is designed to be bandwidth-efficient, trading off some local computation time for a much smaller total handshake payload.

Priya: So, the trade-off they’re making is accepting a bounded total computational footprint of seven point one one milliseconds to get that significant reduction in the transmitted data size <ref:2610.12024#pg1>.

Nadia: That computational cost seems manageable for gateway-class nodes, which aligns with their analysis on the xeighty-six testbed where that measured local computation was around seven point one zero five three milliseconds <ref:2610.12024#pg1>.

Elias: That’s good because it confirms that this isn't just a theoretical exercise; the actual execution cost on the hardware they tested is within a reasonable range for edge devices.

Priya: So, in short, they are showing that you can get significant protocol-level savings by choosing this specific architectural trade-off for bandwidth-limited networks.

The paper's improvements: Nadia: Now let’s talk about the specific improvements HPQ-AKE offers over existing methods like KEMTLS or EDHOC protocols. They claim they are better at addressing real deployment issues in IoT and edge environments.

Elias: They point out that unlike some previous work, HPQ-AKE doesn't just use a certified long-term KEM key for server authentication; it doesn't assume the peer’s leaf key is already trusted locally, which is a difference from KEMTLS.

Priya: That lack of assumption about the peer’s leaf key sounds important because in real deployments, you often have to deal with different trust models across different devices.

Nadia: And they specifically highlight that compared to EDHOC protocols, HPQ-AKE targets gateway-level post-quantum migration and defines a specific transitional architecture involving ML-KEM plus RSA-OAEP.

Elias: That transitional architecture is what sets it apart from other work; it’s not just picking one post-quantum mechanism but creating a defined path for moving existing infrastructure to PQC.

Priya: So, when you look at the resource efficiency argument, they emphasize leveraging existing RSA hardware acceleration for implicit mutual authentication via RSA-OAEP rather than relying solely on heavy digital signature schemes like CRYSTALS-Dilithium.

Nadia: That’s a pragmatic choice because it’s more efficient for gateway nodes that might have existing hardware acceleration already in place, which is a real consideration when you’re looking at edge infrastructure.

Elias: And the authors are also addressing denial of service attacks by proposing a Layer-one filter where the responder has to decapsulate the static Kyber ciphertext before it even tries to process the heavy RSA decryption.

Priya: That layer-one defense sounds very smart because it shifts the bottleneck away from local CPU saturation and back onto network bandwidth, which scales better against DoS attempts.

Nadia: So, they are balancing computational cost for gateway nodes with network efficiency to build a system that is both fast and reasonably resource-efficient for constrained environments.

Conclusion: Elias: Wrapping up the discussion on HPQ-AKE: the main conclusion is that this hybrid protocol successfully achieves authenticated key establishment and perfect forward secrecy under long-term-key-only exposure assumptions while focusing on bandwidth constraints.

Priya: What stands out to me is how they proved it formally through Theorem one tying the session key indistinguishability game directly to Auth ROM plus Secrecy QROM.

Nadia: It confirms that the protocol is robust against those specific assumptions, giving us a solid mathematical footing for its security claims in this context.

Elias: And while they’re not validating it on ARM gateways or low-end IoT boards yet, the paper sets up a clear roadmap for future work involving modeling inside automated verification frameworks like EasyCrypt or CryptoVerif to get machine-checked guarantees.

Priya: I’m interested in that future work because getting those machine checks would move this from a strong simulation result to something that can be deployed with high confidence.

Nadia: It definitely sounds like the path forward is moving toward those rigorous mathematical checks while they plan to benchmark it on ARM platforms next, which will be crucial for determining if it’s ready for widespread deployment.

Elias: So, we’ve gone from the initial concept to a formal analysis of HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks.

Priya: It’s been a deep dive into how protocol design choices translate into tangible bandwidth savings and latency improvements for constrained networks.

Nadia: Thanks for joining us today, Elias, Priya, we’ve covered the core of this paper on HPQ-AKE.

Khiem Pham-Tuan, Minh Quang Le, Khuong Nguyen-An

Ho Chi Minh City Open University · Ho Chi Minh City University of Industry and Trade (HUIT) · Ho Chi Minh City University of Technology (HCMUT) · Vietnam National University Ho Chi Minh City

cs.CR, cs.NI

Submitted: 2026-10-08

Updated: 2026-10-08

Comments: Accepted for publication in High-Confidence Computing (Elsevier), October 2026. Author-accepted manuscript

Code: https://github.com/HPQ-Protocols/HPQ-AKE-Protocol

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

The gist: The gist HPQ-AKE is a sign-less hybrid authenticated key exchange protocol designed for efficient migration from classical Public Key Infrastructure to post-quantum key establishment by replacing

Key concepts

ML-KEM-768
This is a post-quantum Key Encapsulation Mechanism used within HPQ-AKE to provide session secrecy and forward secrecy. It is a specific algorithm selected for its security properties against quantum computer attacks, ensuring that the established session key remains confidential even in a future quantum computing environment.
RSA-OAEP
RSA-OAEP is used in HPQ-AKE to provide implicit mutual authentication. This means it verifies the identity of the communicating parties without relying on traditional transcript signatures. It acts as a classical authentication anchor, ensuring that both endpoints are who they claim to be during the key exchange process.
Extended Bellare–Rogaway Model
This is a mathematical framework used to analyze HPQ-AKE's security. It separates the analysis into two parts: one for classical authentication (in the Random Oracle Model) and another for session-key secrecy (in the Quantum Random Oracle Model), allowing researchers to prove security under different exposure assumptions.
Implicit Authentication
This is a method where parties authenticate each other during a key exchange without using explicit digital signatures. In HPQ-AKE, this is achieved by combining ML-KEM for secrecy and RSA-OAEP for authentication, creating a sign-less protocol that eliminates the overhead associated with traditional signature exchanges.

Terminology

Summary

The gist HPQ-AKE is a sign-less hybrid authenticated key exchange protocol designed for efficient migration from classical Public Key Infrastructure to post-quantum key establishment by replacing transcript signatures with dual KEMs, which reduces handshake communication overhead by 56.4% and improves modeled latency in constrained networks

How it works

HPQ-AKE replaces post-quantum transcript signatures with dual KEMs, combining ML-KEM-768 for session secrecy and RSA-OAEP for implicit mutual authentication The protocol combines ML-KEM-768 for post-quantum session secrecy and forward secrecy with RSA-OAEP for implicit mutual authentication It analyzes HPQ-AKE in an extended Bellare–Rogaway model, separating classical authentication in the Random Oracle Model from session-key secrecy in the Quantum Random Oracle Model The protocol targets bandwidth-efficient migration for RSA-enabled gateways and edge/cloud services, subject to compatible key-use policies and protocol support at both endpoints

Security Guarantees

The security analysis establishes authenticated key establishment, perfect forward secrecy (PFS), and conditional KCI resistance under the long-term-key-only exposure assumptions The extended Bellare–Rogaway analysis establishes authenticated key establishment, PFS, and conditional KCI resistance under the long-term-key-only exposure assumptions Theorem 1 (Hybrid Session Key Indistinguishability) bounds the advantage of an adversary in the Session Key Indistinguishability game by Auth ROM + Secrecy QROM The protocol provides perfect forward secrecy (PFS) under the IND-CCA2 security of Kyber Proposition 3 states that KCI resistance holds in the classical, long-term-key-only impersonation experiment below

Performance Metrics

HPQ-AKE reduces modeled handshake transmission from 13,009 to 5,668 Bytes, a 56.4% reduction relative to a Hybrid TLS 1.3 Full handshake The analysis shows that median latency decreases from 2,791 to 1,914 ms on a simulated 50 kbps satellite-like link with stochastic jitter This represents a 31.4% reduction in modeled latency compared to the baseline The total software computational overhead is measured at 7.1053 ± 0.7036 ms on the x86 testbed

Architectural Trade-offs

The protocol utilizes a three-pass design where Phase 1 involves early anti-DoS mitigation via Kyber encapsulation, followed by the core cryptographic engine in Phase 2, and finally client verification in Phase 3 The architecture trades a bounded total computational footprint of 7.11 ms for a 56.4% reduction in total handshake payload size The analysis shows that the operational break-even bandwidths are conditional on the RTT setting, with thresholds being 0.31 Mbps against the Pre-cached baseline and 4.08 Mbps against the Full baseline at a 20 ms RTT

Conclusion

The combined micro-benchmarking and simulation results support the core architectural hypothesis that within bandwidth-constrained modeled networks, reducing transmission payload scale can yield greater latency reductions than minimizing local CPU execution times alone HPQ-AKE achieves a 56.4% protocol-level reduction and eliminates an entire MTU fragmentation frame in the modeled comparison This architectural choice yields substantial modeled performance dividends in channels where bandwidth boundaries impose severe transmission latency penalties The findings identify RSA-KEM-based implicit authentication as a candidate for gateway-class evaluation under the measured x86 CPU assumptions, not as validated performance on ARM gateways or low-end IoT endpoints Future work will focus on modeling the HPQ-AKE execution flow inside automated verification frameworks, such as EasyCrypt or CryptoVerif to derive machine-checked mathematical guarantees of its post-quantum security properties The authors plan to benchmark the revised HPQ-AKE and the same baselines on ARM Cortex-A gateway platforms and STM32F4-class Cortex-M4 boards to determine whether each target can execute the full handshake or requires acceleration or gateway termination They aim to evolve the current hybrid architecture into a pure post-quantum, sign-less authentication framework by substituting the legacy RSA authentication anchor with static post-quantum KEM key pairs The authors will assess blinding and masking countermeasures and their latency, memory, and energy costs in future work

--- Page 1 ---

Graphical Abstract HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks

--- Page 2 ---

Highlights HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks• HPQ-AKE replaces post-quantum transcript signatures with dual KEMs • ML-KEM-768 provides secrecy; RSA-OAEP authenticates IoT gateways • Analysis covers AKE, PFS, and KCI under explicit exposure assumptions • Handshake transmission falls by 56.4%, from 13,009 to 5,668 bytes • Modeled latency falls by 31.4% on a 50 kbps satellite-IoT link

--- Page 3 ---

HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge NetworksKhiem Pham-Tuan, Minh Quang Le, Khuong Nguyen-An Ho Chi Minh City Open University, 97 Vo Van Tan Street, Xuan Hoa Ward, Ho Chi Minh City, Viet Nam Faculty of Information Technology, Ho Chi Minh City University of Industry and Trade (HUIT), 140 Le Trong Tan Street, Tay Thanh Ward, Ho Chi Minh City, Viet Nam Faculty of Information Technology, Ho Chi Minh City Open University, 97 Vo Van Tan Street, Xuan Hoa Ward, Ho Chi Minh City

--- Page 4 ---

HPQ-AKE for Bandwidth-Constrained IoT and Edge NetworksIndustrial motivation and deployment constraints. Commercial edge platforms illustrate the gateway-assisted architecture considered here: AWS IoT Greengrass supports local processing on devices, hubs, or gateways with intermittent cloud connectivity, while its authentication model uses X.509 certificates for local and cloud connections A concrete industrial example is Ergon Energy’s documented use of Inmarsat BGAN M2M to monitor and control remote electricity-network reclosers where terrestrial connectivity is limited or unavailable; the case study reports 5–15 MB of traffic per recloser per month

--- Page 5 ---

HPQ-AKE for Bandwidth-Constrained IoT and Edge NetworksThe analysis covers AKE, PFS, and KCI under explicit exposure assumptions HPQ-AKE reduces modeled handshake transmission from 13,009 to 5,668 Bytes, a 56.4% reduction relative to a Hybrid TLS 1.3 Full handshake

--- Page 6 ---

HPQ-AKE for Bandwidth-Constrained IoT and Edge NetworksKEM-based Authentication (Sign-less Protocols) A promising approach to eliminating signature overhead is “implicit authentication" or KEM-based authentication The protocol trades a total computational footprint of 7.11 ms for a 56.4% reduction in total handshake payload size (shrinking transmitted data from 13,009 Bytes to 5,668 Bytes compared to the Hybrid TLS 1.3 Full handshake)

--- Page 7 ---

HPQ-AKE for Bandwidth-Constrained IoT and Edge NetworksTable 1 Comparison of Related Works and the Proposed Protocol Reference Main Contribution Unaddressed Aspects KEMTLS (2020) [42] Uses a certified long-term KEM key instead of a transcript signature for server authentication. The full handshake retains CA-signed certificates and TLS-PKI validation; unlike HPQ-AKE, it does not assume the peer’s leaf key is already trusted locally EDHOC (RFC 9528) [44, 7] Provides a compact AKE optimized for sensor-level constrained IoT and low-power deployments. Targets device-level exchanges rather than gateway-level post-quantum migration and does not define the ML-KEM + RSA-OAEP transitional architecture of HPQ-AKE

--- Page 8 ---

HPQ-AKE for Bandwidth-Constrained IoT and Edge NetworksTerminology: CA = certificate authority; IND CCA = indistinguishability under chosen-ciphertext attack; QKD = quantum key distribution; FPGA = field-programmable gate array; CMS = Cryptographic Message Syntax, a container format for protected messages

--- Page 9 ---

HPQ-AKE for Bandwidth-Constrained IoT and Edge Networks3.

Improvements for AI systems

  1. textbf Intellectual Property Protection via Sign-Less AKE for Edge Devices: The improved system can establish authenticated sessions without relying on large post-quantum signatures, as HPQ-AKE replaces post-quantum transcript signatures with dual KEMs. This allows AI systems deployed on bandwidth-constrained IoT and edge networks to maintain security while significantly reducing handshake transmission overhead by 56.4% (Handshake transmission falls by 56.4%, from 13,009 to 5,668 bytes).

  2. textbf Bandwidth-Constrained Latency Optimization: The improved system can operate effectively on low-bandwidth links like satellite IoT backhaul by achieving a 31.4% lower modeled latency (median latency is 1,914 ms, 31.4% below the 2,791 ms baseline). This allows for real-time decision-making in environments where traditional hybrid TLS handshakes suffer from severe propagation delays.

  3. textbf Resource-Efficient Authentication: The system can leverage existing RSA hardware acceleration for implicit mutual authentication (RSA-OAEP for Mutual implicit authentication), which is more efficient than full digital signature schemes like CRYSTALS-Dilithium, particularly on gateway-class nodes. This allows AI inference engines to authenticate peer connections without the high computational cost associated with large PQC signatures.

  4. textbf Robustness Against Quantum Adversaries: The system provides post-quantum session secrecy and forward secrecy (ML-KEM-768 provides post-quantum session secrecy and forward secrecy) under the M-LWE assumption, ensuring that Compromise of long-term static keys does not expose past session keys. This is crucial for protecting historical data against future quantum decryption attacks.

  5. textbf Adaptive Denial of Service (DoS) Mitigation: The system can defend against resource exhaustion attacks by utilizing a Layer-1 filter where Before the responder attempts to process the heavy RSA-3072 decryption, it must first successfully decapsulate the static Kyber ciphertext (This initial post-quantum decapsulation is highly asymmetric in terms of computational cost). This shifts the bottleneck from local CPU saturation back to network bandwidth, scaling drop-rate capacity up to CapacityFiler ≈ 111, 000 packets/second.

Related papers