🤖 AI Summary
This work addresses the scalability and post-quantum (PQ) migration challenges of public key infrastructure (PKI) under quantum computing threats. Methodologically, it proposes a hierarchical certificate authentication framework compatible with both classical and NIST-standardized post-quantum cryptographic (PQC) algorithms—SPHINCS⁺, Falcon, and Dilithium—featuring a lightweight client adaptation mechanism, cross-algorithm rapid switching protocol, certificate isolation architecture resilient to cross-trust-chain attacks, and automated issuance/verification workflows. Key contributions include: (i) the first scalable, hierarchical certification authority (CA) model supporting cryptographic agility; (ii) substantial reduction in client-side cryptographic overhead; and (iii) empirical evaluation of performance–security–scalability trade-offs for all three PQC algorithms under 10,000 concurrent connections, demonstrating a viable pathway for large-scale, smooth PKI transition to quantum-resilient cryptography.
📝 Abstract
This work explores the performance and scalability of a hierarchical certificate authority framework with automated certificate issuance employing post-quantum cryptographic (PQC) signature algorithms. The system is designed for compatibility with both classical and PQC algorithms, promoting crypto-agility while ensuring robust security against quantum-based threats. The proposed framework design expects minimal cryptographic requirements from potential clients, protects certificates of high importance against cross-dependent chains-of-trust and allows for prompt switching between classical and PQC algorithms. Finally, we evaluate SPHINCS$^+$, Falcon, and Dilithium variants in various configurations of certificate issuance and verification accommodating a large client base, underlining the trade-offs in balancing performance, scalability, and security.