2026· International Conference on Security and Cryptography· pp. 146-154· 0 citations· 36 references
Computer Science
TL;DR
Threat-Reactive Encryption (TRE), a four-layer framework that couples a real-time ML threat scorer to a PKCS#11-compatible key management pipeline, closing the gap between threat detection and cryptographic response, is presented.
Abstract
: Static key rotation policies are structurally mismatched to machine-paced adversaries that can exfiltrate session keys within a single cryptoperiod. This paper presents Threat-Reactive Encryption (TRE), a four-layer framework that couples a real-time ML threat scorer to a PKCS#11-compatible key management pipeline, closing the gap between threat detection and cryptographic response. A 47-feature telemetry vector from network flows, TLS handshake metadata, syscall traces, and hardware performance counters (HPCs) is scored every 500ms by an XGBoost+Isolation Forest ensemble inside a hardware-attested Trusted Execution Environment (TEE). Rotation fires atomically when the unified threat score exceeds a Bayesian adaptive threshold, installing new key material via TLS1.3 post-handshake authentication without session interruption. On a 168-hour, 10Gbps testbed with 500 concurrent TLS1.3 sessions and 12 injected CALDERA attack cam-paigns, TRE achieves macro-AUPRC=0.952, median rotation latency=57ms (P99=163ms), and steady-state FPR ≤ 2 . 0% with zero session resets. Post-compromise key exposure is reduced 625 × vs. the 24-hour static policy and 26 × vs. the 1-hour static policy. Adversarial analysis shows full evasion requires the attacker to operate at ≈ 7% of unconstrained attack throughput. The approach is PKCS#11-compatible and provides a direct extension path to post-quantum algorithm substitution via CRYSTALS-Kyber (NIST FIPS203).
Zero-round-trip-time (0-RTT) resumption is a central performance feature of TLS 1.3, cutting reconnection latency by letting clients attach early application data to pre-shared keys derived from previously issued session tickets. Latency-sensitive deployments—web services, API gateways, IoT fleets-rely heavily on this mechanism. However, today's session tickets derive their symmetric keys from a purely classical X25519 exchange, leaving them exposed to Harvest-Now-Decrypt-Later (HNDL) attacks: an adversary who records the ticket exchange today gains the ability to decrypt all associated 0-RTT early data retroactively once a cryptographically capable quantum machine exists. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), which folds a hybrid X25519 + ML-KEM-768 encapsulation directly into the NewSessionTicket lifecycle, rendering tickets quantum-safe without adding any extra round trip.
At the core of HQRT is a Hybrid Resumption Master Secret, constructed jointly from classical and post-quantum shared secrets and integrated into the existing TLS 1.3 key schedule as a drop-in addition. The paper supports this construction with a formal, game-based security model proving HNDL resistance, and extends the replay-protection analysis to quantum adversaries. A working proof-of-concept was implemented on OpenSSL 3.x via the OQS provider, with benchmarking conducted across server, desktop, and IoT hardware.
The latency penalty introduced by HQRT is just 4–9%, with a throughput loss of 6.5% relative to classical 0-RTT-a stark contrast to the 81–89% overhead imposed by full post-quantum handshakes. Across multi-session workloads, the amortised overhead falls by 34–97%, and latency-distribution tails diverge from the classical baseline by under a millisecond.
These results demonstrate that HQRT offers a deployable, incremental route to quantum-safe TLS resumption, delivering HNDL resistance and quantum-safe replay protection at a fraction of the cost of full post-quantum handshakes, while leaving existing certificate infrastructure untouched.
The rapid growth of cloud and edge computing has increased the challenge of protecting Personally Identifiable
Information (PII) during runtime, where conventional encryption leaves data exposed while in use. Existing approaches rely on
static encryption, fixed access policies, or resource-intensive security mechanisms, limiting adaptability to dynamic threats and
compliance requirements. This paper proposes an AI-driven, context-aware Just-In-Time (JIT) cryptographic framework that
combines machine learning-based risk assessment with adaptive encryption selection. Four classifiers (Random Forest,
XGBoost, SVM, and Neural Network), trained on CICIDS2017, CICIoT2023, and UNSW-NB15 datasets, generate real-time risk
scores based on user behavior, data sensitivity, and execution context. Based on risk levels, the framework dynamically applies
QKD-enhanced AES-256-GCM, AES-256-GCM with RSA-4096, ChaCha20-Poly1305, or tokenization/masking, while zero-trust
access control ensures secure data governance. Evaluation on 1,000 synthetic PII records across nine deployment environments
achieved up to 98.74% classification accuracy, 11.3 ms average JIT encryption latency (6.5 ms at the edge), 92.5/100 security
score, and 100% regulatory compliance, outperforming static encryption frameworks with 30% higher security and lower
latency. The results demonstrate an efficient, scalable, and regulation-compliant approach for adaptive PII protection in modern
cloud-edge environments.
R. Pandey, P. Saha, Gaurav Punjabi· International Journal for Re...· 0 citations
The proposed novel password reset standard performs authentication and password update in a single cryptographically bound flow, eliminating the need for sessions, cookies, OTPs, or email-based verification, and mitigating phishing, session hijacking, CSRF, and replay attacks.
Aditya Mitra, Amar Kumar Mandal, Amaan Rais Shah et al.· 0 citations
Password-based authentication remains widespread, and large-scale sets of leaked hashes enable practical offline brute-force attacks. Multi-target attacks, which check candidates against large sets of hashes simultaneously, are particularly effective. Understanding the capabilities of low-cost platforms for such attacks is important to assess real-world password security risks.
Therefore, we present BF2, a modular and scalable FPGA–CPU framework that accelerates multi-target password recovery. BF2 combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs exact membership check using a perfect hash function. We implement BF2 on the low-cost, 199 NiteFury II board. With 16 parallel pipelines running at a 100 MHz clock frequency, our FPGA implementation generates 1.6×10^9 hashes/s. In our experiments, BF2 demonstrates up to 7.5× higher throughput than John the Ripper, and reduces power consumption by as much as 90% compared to Hashcat on an RTX 5000.
Service uptime monitoring infrastructure is a high-value target for data-integrity attacks: a single compromised or dishonest monitoring provider can fabricate availability records, retroactively suppress outage evidence, or silently alter historical data, and clients today have no cryptographic means of detecting such manipulation. This study develops a threat model for monitoring-data integrity attacks—covering provider-side tampering, evidence suppression, Sybil-identity flooding, and submission replay—and presents a verification architecture engineered to resist each threat in that model. Independent validator nodes sign availability observations with Ed25519 keys; a quorum-based aggregation rule tolerates up to f < Q/2 Byzantine validators, SHA-256 content-hash commitments bind off-chain evidence to an immutable on-ledger record that any third party can independently re-derive and check without trusting the aggregator; and stake-bonded registration imposes a quantifiable capital cost on Sybil identities. We formalize the adversary model, prove signature unforgeability under the Elliptic Curve Discrete Logarithm assumption, derive the capital cost of quorum capture, and bound the residual attack surface—selective evidence inclusion and round-stalling—that persists even under a semi-honest aggregator. A seven-day, five-validator, three-region deployment achieves 99.7% quorum agreement, sub-6-second worst-case attestation latency, and zero false positives or negatives across 200 independently re-verified historical rounds, confirming that the architecture removes the central point of trust that lets a single compromised provider corrupt monitoring evidence undetected.
Unknown authors· International Journal of Adv...· 0 citations
The Cryptographic Amplification Factor (CAF) is defined, a metric for the per-resource cost asymmetry that an adversary induces by forcing a TLS 1.3 server onto a high-cost signature algorithm (SLH-DSA instead of a low-cost one (ECDSA or ML-DSA) instead of a low-cost one (ECDSA or ML-DSA).
