Post quantum key sharing improves ipsec handshake time and energy
PQC Migration of IPsec: Reliable Composite Key Sharing Mechanisms in IKEv2
Cryptography and Security
Summary
Quantum computers could break current internet security methods, so new quantum-safe algorithms are needed. The authors studied how these new algorithms affect the IPSec internet security protocol, especially for sharing large cryptographic keys. They found that sending keys as one combined piece over a reliable network connection helps avoid problems and makes the process faster and use less energy. Their approach works better than current methods when networks lose some data packets.
What this means in practice
- •For network security engineers: Improve IPSec deployments to handle large post-quantum keys efficiently by adopting composite key sharing over TCP to reduce handshake delays and energy use.
- •For internet service providers: Enhance network equipment to better support post-quantum IKEv2 handshakes with reliable composite key transmission, improving connection stability under packet loss.
Authors
Rahul, Manjesh Kumar Hanawal, Sameer G. Kulkarni, Tirumaleswar Reddy K
Abstract
The threat of quantum computers breaking classical cryptographic is accelerating the adoption of quantum- resistant cryptographic algorithms. Several government agencies have set a tight time-line for upgradation of all system to support post quantum cryptographs. We study post-quantum migration of IPSec protocols and their impact on network performance. The large key lengths in Post-Quantum Cryptography (PQC) cannot fit in a single IP packet leading to IP fragmentation. This can cause failure of security associations and degrade performance of IKEv2 under poor network conditions. To tackle this problem, we study a new key- sharing mechanism for IKEv2 and evaluate its performance. Unlike current hybrid key-sharing approaches, which send the classical and quantum keys sequentially over UDP or TCP (as in RFC 9370), the new approach concatenates them into a single composite key and transport them over TCP to ensure a reliable handshake. We implement and benchmark the new composite key-sharing handshake mechanism against existing hybrid algorithms that use either UDP or TCP. Extensive experiments under various network conditions demonstrate that the new approach significantly improves handshake time and energy consumption by avoiding the severe retransmission penalties of the Hybrid handshake mechanism. At 1% packet loss, the handshake time of composite key sharing mechanism is better by atleast 20% than hybrid mechanisms, and the improve- ment get better with higher packet loss reaching 30% at 10% packet loss. Energy consumption follows the same pattern achieving reduction of 29% at 10% packet loss