Dual Post-Quantum Cryptography Key Encapsulation Mechanisms

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current secure communication protocols relying on classical public key infrastructure algorithms like RSA, DH, and ECC are vulnerable to quantum computers, which can potentially break these algorithms within a decade, necessitating a shift to post-quantum cryptography (PQC) key encapsulation mechanisms (KEM) for enhanced security.

Innovation Solution

Implementing a system that uses two different post-quantum cryptography KEM algorithms during the initial handshake to establish secure sessions, where a device and a network mutually support and derive shared secret keys from lattice-based, code-based, or Supersingular Isogeny Key Encapsulation algorithms, ensuring security even if one algorithm is compromised.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If two different post-quantum cryptography KEM algorithms are used during the initial handshake, then security level is improved and resilience against quantum vulnerabilities is enhanced, but device complexity and computational overhead increase

Engineering Contradiction:
Improvesecurity levelVSAvoidcomplexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent divides the key establishment process into multiple independent KEM algorithm executions (first KEM and second KEM), where each algorithm contributes a separate shared secret. This segmentation allows the system to achieve higher security through combination while maintaining modularity, making the complexity manageable through structured organization of multiple cryptographic operations.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent combines multiple different post-quantum cryptography KEM algorithms (e.g., lattice-based, code-based, or Supersingular Isogeny) to create a composite key establishment mechanism. This composite approach integrates the strengths of different cryptographic primitives, achieving enhanced security resilience against quantum attacks while distributing the computational burden across diverse algorithmic foundations.

Inventive Principle:
Principle #40Composite materials

2Reliability

If two different post-quantum cryptography KEM algorithms are implemented, then resilience against algorithm compromise is enhanced, but computational resources and processing time increase

Engineering Contradiction:
ImproveresilienceVSAvoidcomputational resources
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent implements two KEM algorithms during the handshake, which represents a partial increase in computational effort compared to using a single algorithm. This excessive action in the key establishment phase provides long-term security benefits, as the additional computational resources invested upfront create resilient shared secrets that protect against future algorithmic compromises.

Inventive Principle:
Principle #16Partial or excessive action

Solution Approach 2:

The patent performs the computationally intensive dual KEM operations during the initial handshake phase, before actual data transmission begins. This preliminary action ensures that the enhanced security is established in advance, and the computational burden is concentrated in a controlled initialization phase rather than being distributed throughout the entire communication session.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If multiple post-quantum cryptography algorithms are used, then security against quantum computers is improved, but protocol complexity and implementation difficulty increase

Engineering Contradiction:
Improvesecurity against quantum computersVSAvoidprotocol complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent structures the multi-algorithm KEM implementation as separate, independent execution stages (first KEM execution, second KEM execution), each following a standardized pattern. This segmentation reduces protocol complexity by creating modular, repeatable units that can be implemented and verified independently, then combined through a defined composition rule.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent designs the system to support multiple types of post-quantum cryptography KEM algorithms (lattice-based, code-based, Supersingular Isogeny) using a unified framework. This universal approach allows the same basic protocol structure to accommodate different cryptographic primitives, reducing implementation difficulty by avoiding the need for entirely separate protocol designs for each algorithm type.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentUS12088706B2Device securing communications using two post-quantum cryptography key encapsulation mechanisms
Publication Date: 2024.09.10 ADEIA EMERGING TECHNOLOGIES INC
  • US12088706B2 patent drawing
  • US12088706B2 patent drawing
  • US12088706B2 patent drawing

AI summary

A network and a device can support secure sessions with both (i) a post-quantum cryptography (PQC) key encapsulation mechanism (KEM) and (ii) forward secrecy. The device can generate (i) an ephemeral public key (ePK.device) and private key (eSK.device) and (ii) send ePK.device with first KEM parameters to the network. The network can (i) conduct a first KEM with ePK.device to derive a first asymmetric ciphertext and first shared secret, and (ii) generate a first symmetric ciphertext for PK.server and second KEM parameters using the first shared secret. The network can send the first asymmetric ciphertext and the first symmetric ciphertext to the device. The network can receive (i) a second symmetric ciphertext comprising “double encrypted” second asymmetric ciphertext for a second KEM with SK.server, and (ii) a third symmetric ciphertext. The network can decrypt the third symmetric ciphertext using the second asymmetric ciphertext.