KEM-Encrypted Signatures for Quantum-Safe Data Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in protecting data exchanges from man-in-the-middle attacks, particularly during the transition from pre-quantum to post-quantum cryptography, where interoperability and resource limitations hinder the update of pre-quantum cryptographic algorithms.
Innovation Solution
A method using a key encapsulation mechanism (KEM) to encrypt digital signatures with a symmetric key, ensuring confidentiality and integrity, leveraging post-quantum algorithms for enhanced security, even when pre-quantum algorithms are used for signature generation and verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-quantum cryptographic algorithms are used for signature generation and verification, then interoperability and resource compatibility are maintained, but security against quantum attacks is compromised
Solution Approach 1:
The patent introduces a hybrid cryptographic system that acts as an intermediary between pre-quantum and post-quantum algorithms. The system uses both classical cryptographic algorithms (for interoperability) and post-quantum cryptographic algorithms (for quantum security) simultaneously, with a hybrid signature scheme that combines both approaches. This mediator structure allows the system to maintain compatibility with existing infrastructure while providing protection against quantum attacks.
Solution Approach 2:
The patent creates a composite cryptographic system that combines pre-quantum and post-quantum cryptographic components. The hybrid signature scheme integrates classical digital signature algorithms with post-quantum signature algorithms, creating a composite security mechanism that leverages the strengths of both approaches while mitigating their individual weaknesses.
2Reliability
If post-quantum cryptographic algorithms are implemented immediately, then security against quantum attacks is enhanced, but resource consumption and system complexity increase
Solution Approach 1:
The patent segments the cryptographic system into distinct modular components: a classical cryptographic module, a post-quantum cryptographic module, and a hybrid integration layer. This segmentation allows each component to be developed, tested, and deployed independently, reducing overall system complexity while enabling progressive adoption of post-quantum algorithms.
Solution Approach 2:
The patent implements a dynamic cryptographic system where the ratio of classical to post-quantum algorithms can be adjusted based on security requirements, resource availability, and threat models. The hybrid signature scheme allows flexible configuration of algorithm combinations, enabling the system to adapt its complexity level to match operational needs.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and a system for cryptographic protection of a data exchange between a first entity and a second entity The invention relates to a method for cryptographic protection of a data exchange between a first entity (A) and a second entity (B), wherein a signing key pair (KPC) belongs to the first entity (A) and a KEM key pair (KPM) belongs to the second entity (B), the method comprising the following steps: a) signing, by the first entity (A), first data (D1) with a private signing key (SKC) resulting in a first signature (SI1); b) providing the first entity (A) with a first symmetric key (K1) and a first ciphertext (CT1) using an encapsulation procedure (Encap) of a key encapsulation mechanism, where the encapsulation procedure (Encap) calculates a first shared secret (SS1) and the first ciphertext (CT1) from the public KEM key (PKM); c) encrypting, by the first entity (A), at least the first signature (SI1) with an encryption procedure (AEAD) which uses the first symmetric key (K1), resulting in a first piece of information (ENC1) comprising the encrypted first signature and data corresponding to the first data (D1); d) transmitting, by the first entity (A), the first ciphertext (CT1) and the first piece of information (ENC1) to the second entity (B); e) providing the second entity (B) with the first symmetric key (K1), using a decapsulation procedure (Decap) of the key encapsulation mechanism, where the decapsulation procedure (Decap) calculates the first shared secret (SS1) from the first ciphertext (CT1) and the private KEM key (SKM); f) decrypting, by the second entity (B), at least the encrypted first signature with a decryption procedure (AEAD-1) which uses the first symmetric key (K1), resulting in the first data (D1) and the first signature (SI1); g) verifying, by the second entity (B), the first signature (SI1) decrypted in step f) with the public signing key (PKC).