QKD-KEM: Hybrid QKD Integration into TLS with OpenSSL Providers

2025-03-10

AI Summary

Integrating quantum key distribution (QKD) with TLS 1.3 remains challenging, particularly due to the stateful nature of the ETSI GS QKD 004 key exchange protocol, which is incompatible with conventional TLS stacks designed for stateless operation. Method: We propose the first hybrid QKD–KEM protocol compliant with ETSI QKD 004, implemented via a dual-trigger (client/server) mechanism and a pre-distributed key abstraction layer, built entirely on OpenSSL 3.0’s Provider architecture without modifying the TLS core. Contribution/Results: Our work is the first to support ETSI 004’s state management—overcoming prior limitations restricted to the stateless ETSI 014—and seamlessly unifies information-theoretic security (QKD) with computational security (KEM) while preserving full TLS 1.3 compliance. Experimental evaluation shows handshake latency increases by less than 15%, demonstrating readiness for production deployment in QKD-enabled networks.

Technology Category

• Machine Learning: Quantum Machine Learning
• Search and Optimization: Distributed Search
• Constraint Satisfaction and Optimization: Distributed CSP/Optimization

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Systems and Infrastructure for Web, Mobile and WoT: Energy management for devices in mobile Web and WoT environments

Abstract

Quantum Key Distribution (QKD) promises information-theoretic security, yet integrating QKD into existing protocols like TLS remains challenging due to its fundamentally different operational model. In this paper, we propose a hybrid QKD-KEM protocol with two distinct integration approaches: a client-initiated flow compatible with both ETSI 004 and 014 specifications, and a server-initiated flow similar to existing work but limited to stateless ETSI 014 APIs. Unlike previous implementations, our work specifically addresses the integration of stateful QKD key exchange protocols (ETSI 004) which is essential for production QKD networks but has remained largely unexplored. By adapting OpenSSL's provider infrastructure to accommodate QKD's pre-distributed key model, we maintain compatibility with current TLS implementations while offering dual layers of security. Performance evaluations demonstrate the feasibility of our hybrid scheme with acceptable overhead, showing that robust security against quantum threats is achievable while addressing the unique requirements of different QKD API specifications.

Problem

• Integrates QKD into TLS for enhanced security.
• Addresses stateful QKD key exchange protocols.
• Ensures compatibility with existing TLS implementations.

Innovation

• Hybrid QKD-KEM protocol for TLS integration
• Client and server-initiated QKD flows
• OpenSSL adaptation for QKD key model