{"id":"a67e0ba4-bf12-4bff-8de3-6ee90ecf1c1d","arxiv_id":"2505.13239","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Onion Routing Relay applies post-quantum layered encryption to quantum key distribution relays, hiding the shared key from intermediate nodes with only a small increase in end-to-end delivery time.","lead":"This paper proposes Onion Routing Relay (ORR), a way to distribute quantum keys between distant nodes by wrapping the key in onion-style layers of post-quantum encryption. Tests on a simulated QKD network suggest ORR adds security at modest extra time compared to standard key-relay methods.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unauthenticated PQC-KEM negotiation lets a malicious first hop impersonate downstream nodes, so ORR's confidentiality claim is unsupported as written.","rationale":"The reader's identified weakest assumption, that real inter-node delays will grow to milliseconds and dominate the extra tens of microseconds of ORR encryption, is a genuine performance-caveat concern and is correctly flagged as untested. However, the more load-bearing issue is on the security side: the protocol's confidentiality claim presupposes that the PQC keys used to build onion layers are authentically bound to their intended owners. The paper explicitly omits integrity and message signing, yet the abstract claims authenticity and the conclusion claims that ORR prevents malicious nodes from learning the secret. A malicious first hop, or any node able to interfere with the in-band KEM negotiation, can establish the same symmetric keys as the initiator by impersonating downstream nodes, thereby recovering the secret. This is not an implementation detail; it changes whether the central security claim is true. I retain the reader's CONDITIONAL verdict because the flaw is fixable by adding authenticated key establishment, but the condition must include a demonstrated, explicit threat model and a security analysis or a MITM-resisting implementation, not only the QoS extrapolation the reader highlighted. If the proposed test shows the attack succeeds in the current code, the paper's main claim would be unsupported and a stronger rejection would be warranted.","tokens_in":9263,"tokens_out":13724,"duration_ms":145641,"concrete_test":"In the provided GitHub implementation, add a malicious-first-hop mode: during the PQC-KEM negotiation, have the first simulated node intercept and replace the public keys of all downstream hops with its own key, then run the 3-node and 11-node ORR scenarios. If the attacker can reconstruct the final secret S from the traffic it relays, the confidentiality claim as currently specified fails. If the code somehow already authenticates public keys, document that mechanism and repeat the test with the authentication disabled to confirm the attack.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central confidentiality claim rests on the PQC-KEM negotiation described in Section IV: \"Ni initiates a negotiation process with each Nint and Nd using a PQC-KEM to establish a symmetric key K_{sim}^{PQC} with each node in the circuit.\" The paper provides no authentication mechanism for the public keys used in this negotiation; Section IV explicitly states that \"integrity and message signing mechanisms are omitted since they fall outside the scope.\" In that setting, a malicious node M placed at the first hop can mount a man-in-the-middle attack during circuit setup: when Ni negotiates with downstream nodes B and Nd, M substitutes its own KEM public keys, learns the symmetric keys that Ni believes it shares with B and Nd, and later peels every onion layer as the secret passes through, recovering S. This directly contradicts the paper's conclusion that ORR \"improve[s] security by preventing the disclosure of the secret to malicious nodes.\" The argument in Section IV.A that the secret is protected by \"the symmetric PQC key of the next node\" holds only if that key is authentically bound to the next node rather than to the attacker. If an out-of-band PKI or trusted key directory is assumed, that assumption is never stated, implemented, or tested. Thus the paper's strongest claim, strong end-to-end confidentiality against a malicious intermediate node, is not established by the protocol as specified.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes Onion Routing Relay (ORR), a key-distribution protocol for QKD networks that combines key relay, onion-routing layered encryption, and PQC-KEM to share a secret between distant nodes without exposing it to intermediate nodes. The authors compare ORR against key-relay (KR) and trusted-node (TN) models in a threaded C simulation that uses a single real QKD pair (Cerberis XGR) as a key source. They report that ORR's encryption overhead is tens of microseconds and that the overall key distribution time remains comparable to KR, concluding that ORR offers competitive QoS while preventing malicious intermediate nodes from learning the secret. The paper also discusses anonymity and future integration of integrity and authenticity mechanisms.","tokens_in":9507,"tokens_out":5787,"duration_ms":53717,"significance":"If the security claim were established, ORR would be a meaningful step toward robust QKDN key relay, since current KR and TN approaches require all intermediate nodes to be trusted. The performance study has several strengths: the implementation is publicly available, the measurements are internally consistent, standard cryptographic libraries (OpenSSL, OQS) are used, no free parameters are fitted, and the comparison against two baselines is appropriate. However, the security contribution is not proven: the protocol as specified omits authentication of the KEM negotiation, so a malicious first hop can defeat the confidentiality claim. The abstract also promises integrity and authenticity that the paper explicitly defers. The performance-based feasibility conclusion depends on an untested extrapolation from thread-switch latencies to millisecond network delays. These issues affect the central claims, but they are addressable in revision.","major_comments":[{"comment":"The confidentiality claim is not supported because the PQC-KEM negotiation is unauthenticated. The protocol description states that 'Ni initiates a negotiation process with each Nint and Nd using a PQC-KEM to establish a symmetric key K_{sim}^{PQC} with each node in the circuit,' but no mechanism binds a public key to the intended node, and Section IV explicitly states that 'integrity and message signing mechanisms are omitted since they fall outside the scope.' A malicious first hop M can therefore substitute its own KEM keys during the negotiation with downstream nodes, learn the symmetric keys Ni believes it shares with Nint and Nd, and later peel every onion layer as the secret passes through, obtaining S. Section IV.A's assertion that the secret is protected by 'the symmetric PQC key of the next node' holds only if that key is authentically bound to the next node. The paper must either specify an authentication mechanism (e.g., an out-of-band public-key infrastructure or use of existing QKD keys for authentication) or explicitly state the trust assumption under which the claim is valid, and revise the security conclusions accordingly.","section":"Section IV"},{"comment":"The abstract promises that ORR 'increases the security by enhancing confidentiality, integrity, authenticity, and anonymity,' but Section IV states that 'integrity and message signing mechanisms are omitted since they fall outside the scope of this paper.' The claims of integrity and authenticity are therefore not fulfilled by the protocol as described. Either implement the missing mechanisms or revise the abstract and conclusions to claim only confidentiality and anonymity under the stated trust model.","section":"Abstract and Section IV"},{"comment":"The feasibility conclusion that 'in a real scenario in which the message sending time is likely to increase from µs to ms ... ORR can have a competitive QoS' is an untested extrapolation. The simulation transmits messages through shared variables with thread context switches on a single machine and uses a single physical QKD pair as a key source; it does not model network delays, bandwidth constraints, packet loss, or multi-hop transmission. The claim that ms-scale transmission will dominate the tens-of-microseconds encryption overhead may be true, but it is not demonstrated by the experiments. Provide a sensitivity analysis or a network-level simulation with realistic delay parameters, or explicitly present the conclusion as a conjecture.","section":"Section VII and Section V"}],"minor_comments":[{"comment":"The abstract contains two prose errors: 'ORR pretends to avoid the security risks' should read 'aims to avoid' or 'purports to avoid,' and 'Results show that the performance of the ORR model, against current key-relay (KR) and trusted-node (TN) approaches' lacks a main verb.","section":"Abstract"},{"comment":"Decimal numbers are rendered inconsistently: '1,5 to 3µs' and '45,35 µs' use commas, while other places use decimal points; choose one convention.","section":"Throughout"},{"comment":"Figures 2 and 3 report averages without error bars, confidence intervals, or the number of repetitions; add this information to support the quantitative comparisons.","section":"Section VI"},{"comment":"The notation K^{PQC}_{sim}(Nint,N) and similar expressions are ambiguous; define the indices (e.g., K_{sim}^{PQC}(N_i, N_j)) and specify the order of layered encryption clearly.","section":"Section IV"},{"comment":"The phrase '2n to2 n/2' is a typesetting artifact; it should read '2^n to 2^{n/2}'.","section":"Section I"},{"comment":"References [36] and [40] cite the same paper by Kuhn, Beck, and Strufe; use a single reference or clarify the distinction.","section":"References"},{"comment":"Section V states that a PRNG substitutes for the unavailable QRNG; since the protocol's security rests on quantum randomness, the paper should state whether this substitution affects the security evaluation or only the performance measurement.","section":"Section V"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is better characterized as a performance evaluation than a security protocol paper. The security claims need a formal treatment or an explicit trust model; otherwise the central contribution is not established. The authors should be encouraged to either add authentication to the protocol or narrow the claims to match what is actually specified and tested."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The one thing to know: the paper combines onion routing with PQC-KEM for QKD key relay. That combination is new, and the performance study is useful. But the central security claim does not hold as written: the KEM negotiation is unauthenticated, so a malicious first hop can impersonate the rest of the circuit and peel the onion.\n\nWhat the paper does well: it describes ORR clearly, provides a GitHub repo with the simulation code, and measures encryption and distribution times against key relay and trusted node models using a real QKD pair (Cerberis XGR) as the key source. The numbers are internally consistent, and the observation that ORR's extra encryption cost is tens of microseconds is a fair point if real network delays dominate.\n\nSoft spots, in order of size. First and load-bearing: Section IV explicitly omits integrity and message signing, but the KEM negotiation still needs authenticated public keys. Without authentication, an active attacker at the first hop can substitute its own KEM keys for the downstream nodes, learn the symmetric keys the initiator thinks it shares with them, and recover the secret. The conclusion that ORR \"prevents disclosure of the secret to malicious nodes\" is therefore unsupported. This is fixable with an explicit trust model or an out-of-band authenticated key directory, but it has to be stated and analyzed. Second, the abstract promises integrity and authenticity, while the body omits them—an inconsistency that needs resolving. Third, the feasibility extrapolation from thread context switches to millisecond network delays is asserted, not tested; the simulation does not include bandwidth or scheduling effects. That is minor relative to the authentication gap.\n\nRecommendation: the idea is worth engaging with, and the performance data is real. But the paper is not ready in its current form. A serious referee should see it, with the expectation of major revision: fix the security model, align the abstract with the implemented mechanisms, and either add an authentication step or clearly scope the claims. I would accept it for peer review, not as is.","headline":"Simple integration of onion routing with QKD key relay; useful performance data, but the confidentiality claim collapses without authenticated KEM negotiation.","tokens_in":10018,"tokens_out":2800,"would_cite":false,"duration_ms":26684,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Onion Routing Relay uses layered post-quantum encryption to distribute QKD secrets that stay hidden from malicious intermediate nodes, with key-delivery time competitive against standard relay schemes.","keywords":["quantum key distribution","onion routing","post-quantum cryptography","key relay","trusted node","Kyber","network security","quality of service"],"falsifier":"Measure per-hop key-delivery times between commercial QKD nodes over practical fiber distances while running ORR, key relay, and trusted-node implementations; if realistic transmission and processing times are comparable to ORR's roughly 45 to 78 microseconds of added encryption instead of milliseconds, ORR's distribution time will not stay competitive with key relay, and the paper's QoS conclusion fails.","tokens_in":9108,"feed_emoji":"🔐","tokens_out":8813,"duration_ms":78735,"temperature":0.7,"pith_summary":"The paper proposes and evaluates Onion Routing Relay (ORR), a protocol for sharing a secret key between distant nodes of a quantum key distribution (QKD) network that have no direct quantum channel. ORR wraps the secret in successive layers of post-quantum encryption, one layer per intermediate relay, so that each relay removes one layer but never sees the plaintext secret; only the intended destination unwraps the final layer. The paper claims this prevents a single malicious intermediate node from learning the distributed secret, a known weakness of the standard key-relay and trusted-node approaches, while preserving routing anonymity. Using a simulation over circuits of 3 to 11 nodes, it measures encryption time and total distribution time for ORR, key relay, and trusted-node models, and finds ORR competitive in overall distribution time even though its encryption is 10 to 40 times slower. If the claim holds, QKD networks can provide end-to-end key confidentiality without requiring every intermediate node to be trusted.","feed_headline":"Onion routing hides QKD keys from malicious relay nodes","feed_subtitle":"A hybrid PQC-QKD protocol keeps key delivery time competitive while blocking eavesdropping by intermediate nodes.","key_machinery":"The central mechanism is the layered onion cipher constructed from per-hop post-quantum symmetric keys. The initiator uses Kyber-768 encapsulation to negotiate a distinct symmetric key with every node on the circuit, then encrypts the shared secret successively outward: first with the destination's key, then with each intermediate node's key in reverse path order, and finally transports the resulting onion hop-by-hop under QKD keys shared with each neighbor. Each relay decrypts one layer with its own symmetric key, learns only its predecessor and successor, and forwards the remaining ciphertext; the destination removes the last layer and recovers the secret. This layering keeps the secret hidden from malicious intermediates, gives the protocol its anonymity property, and is the direct source of the measured encryption overhead compared with the simple XOR operations used by key relay and trusted-node models.","core_discovery":"The paper's central claim is that the Onion Routing Relay protocol delivers a shared secret between distant QKD nodes with end-to-end confidentiality and routing anonymity, while keeping key-distribution time competitive with conventional key-relay (KR) and trusted-node (TN) schemes. In ORR, the initiator first negotiates a symmetric post-quantum key with each node on the path using Kyber-768 encapsulation, then encrypts the secret in successive layers — innermost with the destination's key, then with each intermediate node's key outward — and transports the resulting onion hop-by-hop under QKD keys. Each intermediate node removes its own layer with its symmetric key, sees only the next hop's ciphertext, and forwards it; the destination removes the last layer and recovers the secret. The paper compares this against KR, where each hop decrypts and re-encrypts the secret, and TN, where a central trusted node processes all keys, and reports that ORR's encryption cost is 10 to 40 times higher than KR/TN but that total distribution time stays within about 60 microseconds of KR for an 11-node circuit. It concludes that in realistic QKD networks, where per-hop transmission times are expected to rise from microseconds to milliseconds, ORR's extra encryption overhead becomes negligible, giving security improvement without meaningful quality-of-service loss.","pith_inferences":["If ORR were combined with the integrity and authentication extensions of provably secure onion routing, the end-to-end authentication the current implementation omits could be added without changing the layering mechanism; per-hop signature verification would add a further, likely still sub-millisecond, cost.","A direct test of the feasibility claim would be to run ORR on an emulated QKD network with realistic fiber latencies and bandwidth; the paper's reasoning predicts the distribution-time gap between ORR and key relay will shrink as per-hop transmission time grows, and this is measurable without new quantum hardware.","The security guarantee depends on the PQC negotiation between initiator and each node being authentic; if an adversary could substitute keys during negotiation, confidentiality would degrade to that of plain key relay, so real deployments should authenticate the Kyber negotiation over the QKD-authenticated channel.","The same onion-encapsulation technique could be reused for other quantum-safe communication tasks over QKD backbones, such as anonymous message delivery or private information retrieval, since it only requires per-hop symmetric keys distributed via existing QKD key management."],"forward_implications":["A QKD network using ORR no longer needs every intermediate node to be trusted: a compromised relay that decrypts its QKD layer still cannot recover the distributed secret, because the secret is protected by the next node's post-quantum key.","ORR's layered encryption conceals the identity of the destination from intermediate relays, so an adversary observing one relay cannot tell where the secret is ultimately going.","ORR and key relay send the same number of hop-by-hop messages, so ORR scales with path length like key relay; the simulation reports roughly 541 microseconds average distribution time for an 11-node circuit, between key relay's about 480 microseconds and trusted-node's about 655 microseconds.","The added encryption is spent once when the onion is built at the initiator and once per hop when each relay strips a layer, so the per-secret overhead is bounded by circuit length rather than growing with the amount of key material distributed."],"supporting_citations":[{"why":"Introduces the onion-routing layered-encryption method that ORR adapts to key distribution.","marker":"[22]"},{"why":"Specifies the Kyber-768 key-encapsulation mechanism used to establish the per-hop symmetric keys.","marker":"[15]"},{"why":"Defines the key-relay QKD network model that ORR builds on and compares against.","marker":"[18]"},{"why":"Provides the standardization context for the trusted-node and key-management approach ORR targets.","marker":"[21]"},{"why":"Establishes that long-range QKD without trusted nodes is not possible with current technology, motivating the need for ORR.","marker":"[23]"},{"why":"Demonstrates that security in QKD relay networks is bounded by the least trusted intermediate node, the vulnerability ORR addresses.","marker":"[24]"},{"why":"Supplies the provably secure onion-routing model cited for ORR's end-to-end integrity and authenticity coverage.","marker":"[40]"}],"fun_headline_variants":["Onion routing adds anonymity to quantum key distribution","Post-quantum onion routing shields QKD from malicious nodes","Onion-encrypted QKD keys keep time cost minimal","Hybrid PQC-onion protocol secures QKD networks end-to-end","Onion routing for QKD: more encryption, same speed"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The feasibility conclusion rests on the assumption that real inter-node transmission times in a QKD network will be in the millisecond range and will dominate key-distribution time, making ORR's extra tens of microseconds of layered encryption negligible.","fun_headline_variants_meta":{"raw":{"variants":["Onion routing adds anonymity to quantum key distribution","Post-quantum onion routing shields QKD from malicious nodes","Onion-encrypted QKD keys keep time cost minimal","Hybrid PQC-onion protocol secures QKD networks end-to-end","Onion routing for QKD: more encryption, same speed"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00064,"raw_usage":{"total_tokens":2968,"prompt_tokens":988,"completion_tokens":1980,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":604,"completion_tokens_details":{"reasoning_tokens":1894}},"tokens_in":604,"tokens_out":1980,"duration_ms":15780,"temperature":1.0,"reasoning_tokens":1894,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:16:00.593098+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure per-hop key-delivery times between commercial QKD nodes over practical fiber distances while running ORR, key relay, and trusted-node implementations; if realistic transmission and processing times are comparable to ORR's roughly 45 to 78 microseconds of added encryption instead of milliseconds, ORR's distribution time will not stay competitive with key relay, and the paper's QoS conclusion fails.","supporting_citations":[{"cited_title":"Onion routing,","cited_arxiv_id":null,"evidence_quote":"Introduces the onion-routing layered-encryption method that ORR adapts to key distribution."},{"cited_title":"Module-lattice-based key-encapsulation mechanism standard,","cited_arxiv_id":null,"evidence_quote":"Specifies the Kyber-768 key-encapsulation mechanism used to establish the per-hop symmetric keys."},{"cited_title":"Building the quantum network,","cited_arxiv_id":null,"evidence_quote":"Defines the key-relay QKD network model that ORR builds on and compares against."},{"cited_title":"Quantum key distribution networks – Key management,","cited_arxiv_id":null,"evidence_quote":"Provides the standardization context for the trusted-node and key-management approach ORR targets."},{"cited_title":"Long-range QKD without trusted nodes is not possible with current technology,","cited_arxiv_id":null,"evidence_quote":"Establishes that long-range QKD without trusted nodes is not possible with current technology, motivating the need for ORR."},{"cited_title":"Hacking the least trusted node: Indirect eavesdropping in quantum networks,","cited_arxiv_id":null,"evidence_quote":"Demonstrates that security in QKD relay networks is bounded by the least trusted intermediate node, the vulnerability ORR addresses."},{"cited_title":"Breaking and (Partially) Fixing Provably Secure Onion Routing","cited_arxiv_id":"1910.13772","evidence_quote":"Supplies the provably secure onion-routing model cited for ORR's end-to-end integrity and authenticity coverage."}],"review_version":1}