A Hybrid Quantum-Resistant Resumption framework for zero-RTT TLS 1.3
Zero-round-trip-time (0-RTT) resumption is a central performance feature of TLS 1.3, cutting reconnection latency by letting clients attach early application data to pre-shared keys derived from previously issued session tickets. Latency-sensitive deployments—web services, API gateways, IoT fleets-rely heavily on this mechanism. However, today's session tickets derive their symmetric keys from a purely classical X25519 exchange, leaving them exposed to Harvest-Now-Decrypt-Later (HNDL) attacks: an adversary who records the ticket exchange today gains the ability to decrypt all associated 0-RTT early data retroactively once a cryptographically capable quantum machine exists. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), which folds a hybrid X25519 + ML-KEM-768 encapsulation directly into the NewSessionTicket lifecycle, rendering tickets quantum-safe without adding any extra round trip. At the core of HQRT is a Hybrid Resumption Master Secret, constructed jointly from classical and post-quantum shared secrets and integrated into the existing TLS 1.3 key schedule as a drop-in addition. The paper supports this construction with a formal, game-based security model proving HNDL resistance, and extends the replay-protection analysis to quantum adversaries. A working proof-of-concept was implemented on OpenSSL 3.x via the OQS provider, with benchmarking conducted across server, desktop, and IoT hardware. The latency penalty introduced by HQRT is just 4–9%, with a throughput loss of 6.5% relative to classical 0-RTT-a stark contrast to the 81–89% overhead imposed by full post-quantum handshakes. Across multi-session workloads, the amortised overhead falls by 34–97%, and latency-distribution tails diverge from the classical baseline by under a millisecond. These results demonstrate that HQRT offers a deployable, incremental route to quantum-safe TLS resumption, delivering HNDL resistance and quantum-safe replay protection at a fraction of the cost of full post-quantum handshakes, while leaving existing certificate infrastructure untouched.