The Colossus with Feet of Clay: Debunking Encrypted Traffic Classifiers under PQC Evolution
2026-08-24 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors study how changes in internet encryption methods, specifically moving to post-quantum cryptography (PQC), affect tools that try to identify websites from encrypted traffic. They show that while PQC changes the way data looks, it doesn't hide website information completely. However, models trained on traditional encryption struggle when faced with PQC-encrypted traffic. The authors suggest focusing on making classifiers that work well across different encryption types for more reliable results in real-world use.
Post-Quantum Cryptography (PQC)TLS 1.3Encrypted Traffic ClassificationWebsite FingerprintingHybrid Key EstablishmentProtocol DriftCross-Domain EvaluationSide-Channel AnalysisMachine Learning ClassifiersHTTPS
Authors
Bingzhen Li, Lingjia Meng, Runhan Song, Chuanzhou Pan, Tongjun Pu, Ziqiang Ma, Yupeng Jiang, Lei Cui, Zhiyu Hao
Abstract
Encrypted traffic classifiers often achieve high accuracy under matched training and testing conditions, implicitly assuming that deployment traffic follows the training distribution. TLS migration toward post-quantum cryptography (PQC) challenges this assumption because hybrid key establishment can reshape observable traffic without changing application labels. We frame this change as PQC-induced protocol drift and study its effects through closed-world HTTPS website fingerprinting using the deployed TLS~1.3 Hybrid-PQC group \texttt{\detokenize{X25519MLKEM768}}. We build a controlled, PQC-aware benchmark pairing Traditional (Non-PQC) and Hybrid-PQC traffic, then evaluate five representative classifiers and side-channel representations under matched-domain, cross-domain, and deployment-ratio settings. Collectively, the experiments show that PQC evolution does not remove learnable website information. Instead, it changes how that information appears in traffic, causing classifiers and feature combinations that perform well in-domain to lose reliability across cryptographic domains. By exposing the fragility of matched-domain evaluation, we offer strategic guidance, identify cross-domain robustness as a research priority, and recommend protocol-aware practices for dependable real-world encrypted traffic classification. The code is available at http://anonymous.4open.science/r/PQ-WF-Eval.