Publication
Study and Development of Quantum-Resistant Cryptographic Algorithms for the Neuropil Protocol Framework
| Summary: | As quantum computing advances, secure communications must evolve to adapt. Neuropil is a lightweight protocol created by Pi-lar GmbH for secure exchanges in IoT systems. It currently relies on classical cryptographic techniques, including X25519 for key exchange and Ed25519 for authentication, which are vulnerable to quantum attacks. This study shows how lattice-based CRYSTALS Kyber and CRYSTALS Dilithium can be added to Neuropil without changing its protocol architecture. The work begins with a study of post-quantum cryptography. It looks at the NIST standardisation process, and chooses Kyber-512 for key encapsulation and Dilithium-2 for digital signatures, because they match the AES-128 security level with small keys, signatures and ciphertext sizes that fit IoT devices. Integration keeps the original 1024-byte handshake, places a Kyber ciphertext and a Dilithium signature in the next join message, and turns on the extra code only when the build flag NP_USE_OQS is enabled. A hybrid solution was implemented in C using the liboqs library that combines classical and post-quantum algorithms. Tests indicate reliable operation with only a small increase in connection setup time, and no significant effect on the traffic. A built-in cluster driver that starts 10 in-process nodes shows that the hybrid build increases the mean of the join round-trip time from 4.9 ms to 70.4 ms, and adds about 70 kilobytes of start-up traffic. After it settles, the message rate and neighbour count match the classical run. The analysis shows that forging the leftover Ed25519 fingerprint within the 5 ms Handshake gap would need about one trillion physical qubits, far beyond today’s quantum-computing roadmap plans. Evaluations confirm compliance with NIST post-quantum standards and the resilience of the implementation. Because Neuropil keeps backward compatibility, devices that use only classical crypto work as before, while updated nodes get quantum-safe keys. Future work will test regular rotation of Kyber key pairs to give full forward secrecy, speed up heavy math with SIMD and FPGA hardware, and run trials across many regions with thousands of nodes to check real network impact. These results demonstrate that Neuropil can be upgraded to have post-quantum security, remaining efficient and compatible with existing deployments. |
|---|---|
| Main Authors: | Marques, João André Gomes |
| Subject: | Post Quantum Cryptography Quantum Security Neuropil Protocol IoT Security Lattice-Based Algorithms Criptografia Pós-Quântica Segurança Quântica Protocolo Neuropil Segurança IoT Algoritmos Baseados em lattices |
| Year: | 2025 |
| Country: | Portugal |
| Document type: | master thesis |
| Access type: | open access |
| Associated institution: | Universidade de Coimbra |
| Language: | English |
| Origin: | Estudo Geral - Universidade de Coimbra |
| Summary: | As quantum computing advances, secure communications must evolve to adapt. Neuropil is a lightweight protocol created by Pi-lar GmbH for secure exchanges in IoT systems. It currently relies on classical cryptographic techniques, including X25519 for key exchange and Ed25519 for authentication, which are vulnerable to quantum attacks. This study shows how lattice-based CRYSTALS Kyber and CRYSTALS Dilithium can be added to Neuropil without changing its protocol architecture. The work begins with a study of post-quantum cryptography. It looks at the NIST standardisation process, and chooses Kyber-512 for key encapsulation and Dilithium-2 for digital signatures, because they match the AES-128 security level with small keys, signatures and ciphertext sizes that fit IoT devices. Integration keeps the original 1024-byte handshake, places a Kyber ciphertext and a Dilithium signature in the next join message, and turns on the extra code only when the build flag NP_USE_OQS is enabled. A hybrid solution was implemented in C using the liboqs library that combines classical and post-quantum algorithms. Tests indicate reliable operation with only a small increase in connection setup time, and no significant effect on the traffic. A built-in cluster driver that starts 10 in-process nodes shows that the hybrid build increases the mean of the join round-trip time from 4.9 ms to 70.4 ms, and adds about 70 kilobytes of start-up traffic. After it settles, the message rate and neighbour count match the classical run. The analysis shows that forging the leftover Ed25519 fingerprint within the 5 ms Handshake gap would need about one trillion physical qubits, far beyond today’s quantum-computing roadmap plans. Evaluations confirm compliance with NIST post-quantum standards and the resilience of the implementation. Because Neuropil keeps backward compatibility, devices that use only classical crypto work as before, while updated nodes get quantum-safe keys. Future work will test regular rotation of Kyber key pairs to give full forward secrecy, speed up heavy math with SIMD and FPGA hardware, and run trials across many regions with thousands of nodes to check real network impact. These results demonstrate that Neuropil can be upgraded to have post-quantum security, remaining efficient and compatible with existing deployments. |
|---|
Funded activities
No funded projects found.