Scholarlink

The deployment of Post-Quantum Cryptography (PQC) is accelerating, particularly within the Transport Layer Security (TLS) protocol. However, long device lifetimes and limited update capabilities in domains such as Operational Technology (OT) and the Internet of Things (IoT) hinder the adoption of PQC-based authentication, as backward compatibility with legacy devices is essential. In this work, we present a transition mechanism based on dual algorithm certificates, which embed cryptographic artifacts (public key and signature) of both a traditional and a post-quantum algorithm. We introduce a new negotiation mechanism for the TLS handshake that enables secure and flexible use of such certificates for peer authentication, allowing rapid PQC deployment without sacrificing interoperability. We implemented our mechanism in the WolfSSL and OpenSSL libraries and evaluated it on a resource-constrained microcontroller, demonstrating its viability for constrained OT and IoT environments.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Using Dual Algorithm Certificates in TLS: Enabling Rapid Transition to Post-Quantum Cryptography with Backward Compatibility

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Tobias Frauenschläger,
  • Jürgen Mottok

摘要

The deployment of Post-Quantum Cryptography (PQC) is accelerating, particularly within the Transport Layer Security (TLS) protocol. However, long device lifetimes and limited update capabilities in domains such as Operational Technology (OT) and the Internet of Things (IoT) hinder the adoption of PQC-based authentication, as backward compatibility with legacy devices is essential. In this work, we present a transition mechanism based on dual algorithm certificates, which embed cryptographic artifacts (public key and signature) of both a traditional and a post-quantum algorithm. We introduce a new negotiation mechanism for the TLS handshake that enables secure and flexible use of such certificates for peer authentication, allowing rapid PQC deployment without sacrificing interoperability. We implemented our mechanism in the WolfSSL and OpenSSL libraries and evaluated it on a resource-constrained microcontroller, demonstrating its viability for constrained OT and IoT environments.