- The paper develops a six-axis taxonomy covering cryptographic foundations, key-distribution architecture, trust, lifecycle, deployment context, and network layers, showing that quantum resistance is an architectural property rather than a simple algorithm swap.
- The paper compares centralized, hierarchical, threshold/MPC, contributory, and serverless multi-path designs, highlighting trade-offs in scalability, forward secrecy, compromise recovery, availability, and operational complexity, including MPC results exceeding 35,000 logins per second.
- The paper recommends cryptographic inventories, hybrid and symmetric fallbacks, automated rekeying, downgrade resistance, post-compromise recovery, interoperability testing, and risk-based governance for prolonged mixed classical–post-quantum deployments.
This paper, "Quantum-Resistant Networks: A Review of Primitives, Protocols and Best Practices" (2605.04129), presents a systematization of knowledge (SoK) on post-quantum (PQ) network security that deliberately departs from the dominant focus on cryptographic primitives and protocol-local substitution. Its central claim is that the quantum transition is fundamentally an architectural problem: how networks distribute, manage, rotate, and recover cryptographic keys when classical public-key cryptography may be unavailable, impractical, or untrusted. The authors—Bertino, Kompella, Kundu, Nita-Rotaru, Vaidya, and Yavuz—argue that existing surveys cover primitives (e.g., Howe et al.'s SoK), protocol instantiations such as PQ-TLS, or adjacent domains like QKD key management, but none integrates symmetric-only designs, PQ-PKI, hybrid modes, threshold/MPC-backed key distribution servers (KDSs), hierarchical trust infrastructures, and serverless multi-path constructions into a single framework. This paper fills that gap.
Motivation and scope
The threat model is explicit throughout: adversaries with quantum capabilities sufficient to break RSA, DH, and ECC via Shor's algorithm; long-term traffic recording ("harvest-now, decrypt-later," HNDL); and partial control over network infrastructure including routing and key-management components. The authors observe that most prior transition efforts optimize a single axis—algorithm substitution inside a protocol stack—whereas real deployments must simultaneously reason about primitive availability, trust models, key-distribution architecture, lifecycle management, deployment environment, and network topology.
A recurring thesis is that cryptographic agility in networks is an emergent system property rather than a software feature. A system capable of swapping algorithms at endpoints may still be unable to rotate keys at scale, recover from compromise, or operate under partial PQ availability. This reframing motivates the taxonomy-driven approach and underpins the best practices offered later in the paper.
Taxonomy by cryptographic foundations
The first axis classifies foundations into four categories:
- Symmetric-only: AES-256-class primitives, HMAC, KDF chains, PRNG/QRNG sources; immune to Shor and only mildly affected by Grover (requiring doubled key sizes). Suitable for constrained IoT, industrial, and high-assurance environments, but weak in scalability, forward secrecy (PFS), and distributed trust.
- PQ-PKC: lattice-based KEMs (ML-KEM/FIPS 203) and signatures (ML-DSA/FIPS 204), enabling scalable federated authentication. A notable risk highlighted here is fingerprinting of PQ implementations through behavioral and protocol-specific patterns (Mallick et al., 22 Mar 2025), which can enable denial-of-service, downgrade, or targeted attacks.
- Hybrid classical–PQC: parallel or KDF-composed combinations providing defense-in-depth; the de facto default for migration-critical sectors, though the paper concedes that compositional analysis requires "comparable security" across components and remains underdeveloped.
- Multi-path / information-theoretic: entropy split across independent paths so an adversary must compromise all of them; security rests on network assumptions rather than computational ones.
The research gaps identified here are substantive: no unified theory for scalable, forward-secure symmetric-only networks; no analytical framework for optimal hybrid composition or failure models; no formal adversary models combining network and cryptographic capabilities for multi-path transport; and no work on cross-primitive combinations (PQC + multi-path + MPC).
Taxonomy by key-distribution architecture
This is the paper's most detailed axis, spanning five architectural classes.
Centralized KDS/KDC. Kerberos remains PQ-viable if ticket protection stays symmetric with conservative parameters (AES-256-class, high-entropy keys, tight replay windows) and public-key add-ons are upgraded to ML-KEM/ML-DSA. Practical migration experiments in Linux environments suggest keeping message flows stable while upgrading only the underlying crypto is realistic. However, larger PQ ciphertexts and signatures strain UDP-based Kerberos against MTU limits, pushing deployments toward TCP or HTTPS-based KDC proxies. The paper is candid that centralized designs have weak PFS and poor post-compromise recovery—a compromise typically forces global rekeying—and no standardized recovery workflows exist.
Replicated and threshold/MPC-backed KDS. Replication improves availability but expands the attack surface (forking, rollback, equivocation); Byzantine fault tolerance at n≥3f+1 replicas provides correctness under active malice, yet every replica still holds full secrets unless secret sharing is applied. Threshold designs using Shamir sharing with proactive refresh ensure no node holds complete key material. MPC-backed systems go further: Araki et al.'s high-throughput three-party computation demonstrates Kerberos ticket-generation workloads at tens of thousands of queries per second (over 35,000 logins/second in their implementation), and DiSE formalizes distributed authenticated encryption where the service never releases the long-term secret. The paper's strong claim here is that these architectures remain meaningful even when public-key migration is blocked entirely, because security reduces to symmetric primitives plus threshold assumptions. The caveats are equally clear: no PQ-safe BFT replication protocols tailored to KDS workloads exist, consistency–security trade-offs under replication are unquantified, and there are no empirical benchmarks answering how many MPC servers a global-scale KDS requires or what latency (t,n) thresholds impose.
Hierarchical KDS. Logical Key Hierarchy (LKH), One-Way Function Trees, Iolus-style subgrouping, and Kerberos cross-field structures scale logarithmically and align with administrative boundaries. Symmetric intra-domain rekeying combined with PQ inter-domain authentication (hybrid SCADA and 5G/6G frameworks) is identified as a promising pattern. The structural weakness is compromise propagation: breach of a high-level domain anchor can cascade across subtrees, and no formal model quantifies blast radius in symmetric-only hierarchies.
Contributory group key establishment. Classical GDH/TGDH/Burmester–Desmedt protocols rely on Diffie-Hellman commutativity, which standardized PQC lacks—ML-KEM is non-commutative, CSIDH is too slow and under security scrutiny after SIDH's 2022 break. Compiler-based constructions from Kyber and LWE-based dynamic AGKA protocols exist but require additional rounds and incur heavy rekeying costs in high-churn settings (vehicular platoons, UAV swarms). The paper flags the absence of native commutative PQ primitives as a fundamental open problem, along with missing fault-tolerant, partition-resilient PQC group protocols—the systems-level resilience achieved classically via Virtual Synchrony has no PQC counterpart.
Serverless multi-path. Secret-sharing over multiple paths offers information-theoretic security without trusted servers, but the paper highlights a concrete negative result: schemes assuming path atomicity and uniform delays suffer from Network Data Remanence side-channel attacks (NDSS 2021). Path-independence assumptions rarely hold in cloud backbones or AS-dominated topologies, and no hybrid KDS-plus-multi-path-entropy design has been analyzed despite its promise.
A comparative table summarizes the trade-offs: centralized KDS scores high on scalability and low complexity but weak on PFS and recovery; threshold/MPC designs invert this profile at high operational cost; serverless multi-path achieves strong PFS and recovery under minimal trust but scales poorly.
Trust, threat, and lifecycle dimensions
The trust taxonomy spans fully trusted authorities, threshold-trust, trust-minimized/serverless, and zero-trust models, plus a five-level "leveled security" ladder capturing intermediate states from "no CRQC exists, HNDL exposure" to "PQC widely adopted but compliance drift erodes resistance." The gaps here are largely about modeling: adaptive adversaries who compromise nodes over time, mixed-trust environments (threshold core, centralized edge), insider threats combined with quantum decryption, and gradual trust erosion rather than instantaneous compromise—all lack formal treatment. Notably, there is no consensus definition of zero trust in the PQ context.
The lifecycle dimension covers generation, distribution, usage scoping, rotation, storage, and post-compromise healing. Key storage receives particular attention: HSMs and TEEs protect against software compromise but introduce vendor/firmware/supply-chain trust assumptions and fail catastrophically once breached; threshold-protected server-side keys limit blast radius; AES-KW with 256-bit KEKs provides PQ-safe wrapping contingent on KEK lifecycle discipline. The overarching position—that robust PQ systems must assume eventual compromise and favor designs limiting exposure duration—is well argued, though the paper concedes that lifecycle stages are handled by disjoint components (KDS, HSMs, controllers) with no end-to-end orchestration or formal cross-layer lifecycle models.
Deployment environments and network layers
Deployment analysis maps environments to suitable architectures: enterprises tolerate centralized/hierarchical/threshold KDS with staged hybrid rollouts; IoT/edge often admits only symmetric-only or serverless multi-path designs; industrial/critical infrastructure prioritizes availability and certification over novelty; adversarial/tactical settings demand trust minimization. A boxed observation worth emphasizing: real networks operate simultaneously in symmetric-only, hybrid, and PQ-enabled modes for years, and safe operation during these prolonged intermediate states—not the final "fully PQ" endpoint—is the dominant operational challenge. Formal models for partial PQ adoption, downgrade resistance during coexistence, and weakest-link effects are absent.
The layer-by-layer treatment (L2 MACsec, L3 IPsec/IKEv2, L4 TLS/QUIC, application-layer SSH, PQ3, PQXDH, SPQR) shows that data-plane cryptography is largely already quantum-resistant while control planes and handshakes carry the transition burden. Machine-checked analyses of Apple's PQ3 (TAMARIN proofs covering ratcheting with unbounded loops) and Signal's PQXDH (which surfaced specification flaws not exploitable in practice, plus a needed KEM binding property) illustrate both the maturity of formal methods and the pitfalls of naive PQ upgrades. Cross-cutting gaps include the absence of unified adversary models combining quantum cryptanalysis with AS-level manipulation, unvalidated path-diversity assumptions, and no framework for reasoning about end-to-end security when different layers adopt different cryptographic foundations.
Security properties
The property-oriented taxonomy evaluates PFS, post-compromise security/healing, KCI resistance, side-channel resilience, and network-level adversary resistance. Key findings: static symmetric KDSs cannot provide strong PFS without architectural modification; KCI resistance is inherently weak in symmetric-only systems since shared secrets enable bidirectional impersonation; KEM-based protocols separate authentication credentials from ephemeral keys and thus fare better; and symmetric-heavy designs benefit from simpler, better-hardened implementations against side channels. Post-compromise recovery mechanisms (proactive resharing, hash-chain rekeying, multi-path entropy injection) exist in principle but lack standardized recovery models, guarantees during the recovery window, and any empirical validation at million-endpoint scale.
Best practices
The paper distills six practices grounded in NIST guidance (SP 800-208, CSWP 39, CSWP 48, NCCoE workstreams): (1) cryptographic discovery/inventory as the prerequisite for all transition decisions; (2) treating agility as an architectural property—decoupling function from algorithm choice, supporting hybrid and symmetric-only fallbacks, encoding exit conditions into policy; (3) engineering explicitly for decade-long heterogeneous operation with automated short cryptoperiods and downgrade resistance; (4) designing for post-compromise recovery from the outset rather than treating it as exceptional; (5) early cross-vendor interoperability testing validated at protocol boundaries; and (6) expressing migration in existing risk-framework language (CSF, SP 800-53) to sustain governance and auditability. These are pragmatic and well-sourced, though they inherit the field's immaturity—for instance, the paper itself notes that no accepted metrics exist for operational agility.
Limitations and open questions
As a systematization, the paper contributes taxonomy and gap identification rather than new constructions or measurements, and several of its comparative claims rest on qualitative synthesis rather than uniform benchmarks—an absence it repeatedly acknowledges. The most consequential open problems it leaves are: whether efficient native commutative PQ primitives enabling constant-round contributory key agreement can be found; whether MPC-backed KDS can meet global-scale latency and throughput requirements under malicious-adversary security; whether path independence sufficient for information-theoretic multi-path security can be empirically established in modern cloud-dominated topologies; how to formally model and safely operate mixed-trust, partially-PQ deployments over transitional decades; and whether unified adversary models combining quantum cryptanalysis with infrastructure control can be constructed at all.
Conclusion
This SoK makes a persuasive case that quantum resistance in networking cannot be achieved by algorithm substitution alone. By organizing the design space along six interacting axes—cryptographic foundation, key-distribution architecture, trust model, key lifecycle, deployment context, and network layer/topology—it exposes trade-offs invisible to protocol-centric analyses and demonstrates that no single architecture dominates. Its most durable contributions are the reframing of cryptographic agility as an emergent network property, the integration of threshold/MPC-backed key distribution into mainstream PQ transition planning, and a candid catalog of the modeling, benchmarking, and transition-roadmap gaps that separate current PQ theory from deployable, resilient network infrastructure.