{"id":"f779bf17-df6f-425c-8d79-1e854cd54b77","arxiv_id":"2507.21325","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"PQC-based authentication protocols for QKD are proven secure in a hybrid adversary model, yielding information-theoretic keys only against a restricted adversary.","lead":"This paper proposes and analyzes three protocols that use post-quantum cryptography and public key infrastructure to authenticate the classical channel of quantum key distribution, removing the need for pre-shared keys. If the protocols work as proven, new users could join quantum networks remotely and securely, solving a scalability bottleneck.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"clean_HPT permits pre-accept corruption of exactly the impersonated party's long-term PQC key, while the Case 1 proof assumes neither key is compromised; Theorem 0 is therefore not established as stated.","rationale":"The central claim is HAKE-security under cleanness predicate clean_HPT and the derived ITS statement. The proof's game hops determine the actual coverage of that claim, and I found a direct mismatch: Definition 21 Condition 3 is disjunctive over pairs of corruption queries, allowing single-sided long-term PQC corruption before accept, whereas Section 8.1.1 Game 4 explicitly requires that neither CorruptQK(i) nor CorruptQK(j) has been issued. This is not a cosmetic ambiguity: single-sided corruption is exactly the natural impersonation scenario in the no-origin-session case, so the defined cleanness predicate and the proven statement disagree on a central adversarial case. The T_HPT estimation issue highlighted by the reader is real and important for interpreting the practical claim, but it concerns an external assumption about adversary runtime; the present concern is internal and must be repaired even if Equation 1 is granted. The paper contains no machine-checked proof, so this notation-level inconsistency carries real weight. I therefore recommend rejecting Theorem 0 as stated, while noting that a corrected cleanness predicate and a reworked proof might salvage the underlying protocol idea.","tokens_in":52561,"tokens_out":17475,"duration_ms":241533,"concrete_test":"Formalize the no-origin Case 1 instantiation of \\Pi_\\Sigma with n_P=2, n_S=1, n_T=1: set the pre-accept corruption list to CorruptQK(Bob) and CompromiseSK(Alice), with no CompromiseSS queries. Check whether Definition 21 clean_HPT evaluates to true under the literal 'one of the following set' semantics. If it is true, execute Alice's accept transition with adversary-generated \\sigma_B and \\tau_B and test whether the adversary can distinguish the session key; a non-negligible Test advantage gives a concrete counterexample to Theorem 0. If the authors intend a different reading of clean_HPT, Definition 21 and all subsequent case analyses must be revised and the theorem re-proved.","verdict_should_be":"REJECT","load_bearing_attack":"The load-bearing flaw is internal to the proof. Definition 21 (clean_HPT), Condition 3, for a test session with no origin session says the session is clean if 'one of the following set of queries has not been issued' before accept; for the first bullet this means only that not both CorruptQK(i,s,t) and CorruptQK(j,r,t) were issued. That permits pre-accept corruption of exactly the intended partner's long-term PQC key, say sk_B for an initiator test session, provided the initiator's key is not also corrupted. The Case 1 proof for \\Pi_\\Sigma, however, replaces sk_B by a random value in Game 4 because 'the HPT adversary A has not issued either CorruptQK(i,j) or CorruptQK(j,i)' (Section 8.1.1). This is a strictly stronger condition and is not implied by clean_HPT. With sk_B leaked, the public initial SecState, and a CompromiseSK(i) query (which Condition 3 does not exclude unless CompromiseSS is also issued on both sides), an adversary can compute K0, K1, and the MAC keys and produce a valid responder signature and MAC before accept while the session remains clean under the literal predicate. Thus the game-hopping argument does not cover all clean sessions and Theorem 0 does not follow. This is independent of Equation 1: even granting T_HPT-term security for the PQC primitives, the predicate/proof mismatch is fatal to the claim as written.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a general approach for authenticating the classical channel of quantum key distribution (QKD) using post-quantum cryptography (PQC) rather than pre-shared keys, so that new users can join a quantum network remotely. It presents three protocols: a signature-then-MAC protocol (Π_Σ), a KEM-then-MAC protocol (Π_KEM), and a MAC-only protocol (Π_MAC) for subsequent QKD iterations, and analyzes them in an adapted version of the HAKE framework of the Muckle series. The main theorem (Section 8, 'Theorem 0') claims that all three protocols are HAKE-secure under the clean_HPT cleanness predicate and that the distilled QKD keys are information-theoretically secure (ITS) and (ε_QKD + ε_auth)-secure, with ε_auth being the PQC authentication advantage. The security model introduces a hybrid polynomial-time (HPT) bounded adversary and a 'conditioned unbounded adversary' that can control the quantum channel and read the classical QKD traffic but is not allowed to interact with the authentication steps. The proof is a game-hopping argument with a union bound over signature, KEM, MAC, PRF, AEAD, hash, and QKD advantages.","tokens_in":52921,"tokens_out":10428,"duration_ms":112615,"significance":"If the main theorem were established as stated, the paper would provide a useful scalable authentication option for QKD networks, formalizing a design pattern already present in experimental prototypes and connecting it to the Muckle HAKE framework. The paper is transparent about its main assumption: it explicitly introduces T_HPT-term PQC security (Definition 17, Eq. (1)) and acknowledges the practical difficulty of estimating T_HPT (Section 4.2). It also gives full protocol listings and a detailed game sequence, which is valuable for implementers. However, the proof as written does not support the theorem statement: there is a mismatch between the cleanness predicate and the corruption assumptions used in the game hops, one of the central replacements (uniform-random PQC secret keys) is not justified by the primitive definitions, and the claimed ITS property is conditional on an adversary model that is weaker than the standard unbounded adversary. These issues are repairable in a revision, but they currently block the paper's central claim.","major_comments":[{"comment":"Definition 21, Condition 3, for a test session with no origin session, states that one of the listed query sets has not been issued; in particular the first bullet permits exactly one of CorruptQK(i,s,t) and CorruptQK(j,r,t) to be issued before accept. In the Case 1 proof for Π_Σ (Section 8.1.1, Game 4), the replacement of sk_B by a random value is justified by the assertion that 'the HPT adversary A has not issued either CorruptQK(i,j) or CorruptQK(j,i)' — a strictly stronger condition than the predicate. The same gap affects Section 8.1.3, Game 4, for Π_KEM. Consequently the game-hopping argument does not cover all sessions that are clean under clean_HPT, and Theorem 0 is not established as stated. Concretely, if CorruptQK(j,r,t) and CompromiseSK(i,s,t') are issued for an initiator test session, the session can remain clean under a literal reading of Condition 3 while the adversary obtains sk_B and ss_QKD; with the public initial SecState it can then compute K0, K1, and the MAC keys and impersonate the responder before accept.","section":"Definition 21 / Section 8.1.1"},{"comment":"The proofs replace the PQC secret key sk_B (resp. k_B) with 'a uniformly random and independent value of the same length', asserting that the original key is itself uniformly random and independent. Definitions 9 and 11 only require KeyGen to output a key pair; EUF-CMA and IND-CCA security do not imply that the secret key is uniformly distributed over its bit-string encoding (e.g., RSA or lattice secret keys are not uniform). The replacement is therefore not distribution-preserving, and the game hop is invalid as written. A repair would be to replace the key by a fresh independent sample from the scheme's KeyGen distribution, with an appropriate security reduction, or to add an explicit uniformity requirement to the primitive definitions.","section":"Section 8.1.1, Game 4; Section 8.1.3, Game 4"},{"comment":"Theorem 0 states its hypotheses only in terms of standard EUF-CMA, IND-CCA, PRF, and MAC security, but the protocols' security is conditional on the T_HPT-term security assumption and Eq. (1) introduced in Section 4 and used in Section 7.1. Without an explicit hypothesis that Σ and KEM are T_HPT-term HPT-secure and that the runtime condition of Eq. (1) holds, the theorem is false in the stated model, since an HPT adversary could in principle break the PQC authentication if given enough time. The theorem statement and the final security claim should quantify T_HPT and include Eq. (1) as a premise.","section":"Theorem 0 / Section 4.2 and Definition 17"},{"comment":"The 'ITS' conclusion is stated for the conditioned unbounded adversary of Definition 2, which is explicitly forbidden from interacting with the authentication steps. Since an unbounded adversary can always break the PQC authentication (the paper itself notes in Section 7.5 that 'if an adversary is permanently unbounded, the presented algorithms are not secure'), the final QKD keys are not ITS against the standard unbounded adversary. The theorem and abstract should state the security guarantee as conditional on the conditioned-adversary model, not as ITS in the usual sense; otherwise the headline claim overstates what is proved.","section":"Definitions 1–2 / Section 7.5"}],"minor_comments":[{"comment":"There is a typographical error at the start of the EUF-CMA definition: 'vThe signature scheme' should read 'The signature scheme'.","section":"Definition 10"},{"comment":"The main result is called 'Theorem 0' in Section 8 but is referred to as 'Theorem 23' in Section 6 and in the discussion; the numbering should be made consistent.","section":"Section 6 / Section 8"},{"comment":"The logical structure of Condition 3 is ambiguous: it is not clear whether each bullet is a conjunction that must not be issued as a whole, or a list of individual queries. Formal Boolean conditions, such as ¬(A∧B) versus ¬A∧¬B, would remove the ambiguity that is central to the proof gap discussed above.","section":"Definition 21, Condition 3"},{"comment":"The claimed IND-CPA game for AEAD, described as 'the same as Experiment 4 but there is no public key involved', is not a standard AEAD IND-CPA experiment; Experiment 4 is written for KEM with adversary-chosen keys, whereas AEAD IND-CPA should encrypt challenge messages under a fixed key.","section":"Definition 16"},{"comment":"The claim that the adversary 'can target six different digests: H(m'_QKD, m1 to mi), i∈{2,3,4,6,7,8}' is unclear because the hash inputs in the protocol combine the QKD transcript with nonces and labels; the list should be tied to the exact protocol messages and the union bound should be explicit.","section":"Section 8.1.1, Game 4"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and relevant problem, and the authors are honest about the conditional nature of their security claims. However, the proof as written has a load-bearing mismatch between the cleanness predicate and the corruption assumptions in the game hops, and the uniform-random replacement of PQC secret keys is not justified by the primitive definitions. These issues can likely be repaired within the scope of the manuscript, but the revised version should either strengthen clean_HPT to match the proof (e.g., forbid any CorruptQK before accept for no-origin sessions) or extend the proof to cover one-sided corruption. The 'ITS' claim should also be scoped to the conditioned-unbounded-adversary model in the abstract and conclusion."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a serious, detailed formal-security analysis of PQC-authenticated QKD, but the main theorem is not established as stated. Definition 21's clean_HPT predicate permits the adversary to corrupt exactly one of the two parties' long-term PQC keys before accept, while the Case 1 proof assumes neither CorruptQK query has been issued. That mismatch is load-bearing: with sk_B leaked, the public initial SecState, and a CompromiseSK(i) query that the predicate also permits, an adversary can compute K0, K1, and the MAC keys, forge Bob's signature and MAC, and make Alice accept a session the predicate calls clean. The HAKE advantage bound in Theorem 0 therefore does not cover all clean sessions.\n\nWhat deserves credit: the paper adapts the HAKE/Muckle framework to the QKD mono-authentication setting with real care. The protocols (SIGMA-like and KEMTLS-like) are spelled out step by step, the HPT adversary and T_HPT-term security assumptions are explicit, and the composed bounds include QKD's epsilon_QKD plus authentication advantages. The related-work engagement is honest and not circular: QKD security is taken from prior composable results, and the HAKE framework is external. The paper also openly acknowledges the fragility of Equation 1, the T_HPT estimate, which is a plus.\n\nSoft spots beyond the main gap: the 'conditioned unbounded adversary' is defined so that it cannot attack the authentication layer, so the ITS claim is only against that restricted adversary. That is a modeling choice, but it should be stated more prominently as a limitation rather than an ITS result against a true unbounded adversary. The proof is a game-hopping sketch with several casual hops (for example, 'if the session accepts, the adversary must have decapsulated k_B') that need tightening before the bounds can be taken as proven. None of these are as serious as the predicate/proof mismatch, but they reinforce that Theorem 0 needs repair.\n\nWho this is for: researchers in quantum-safe networking, QKD authentication, and composable key exchange. It deserves a serious referee, not a desk reject; the question is whether the authors can fix the cleanness predicate or restrict the proof accordingly. I would want to see a revision before relying on the result.","headline":"Serious formal analysis of PQC-authenticated QKD, but clean_HPT allows one long-term key corruption while the proof assumes none, so Theorem 0 overreaches as written.","tokens_in":53411,"tokens_out":5573,"would_cite":true,"duration_ms":62126,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A60","81P94"],"pacs":["03.67.Dd"],"model":"deepseek-v4-flash","headline":"This paper proves that Post-Quantum Cryptography authentication can bootstrap QKD sessions to information-theoretic security, provided the PQC algorithms stay unbroken during the protocol's active window.","keywords":["Quantum Key Distribution","Post-Quantum Cryptography","hybrid authenticated key exchange","T_HPT-term security","information-theoretic security","key encapsulation mechanism","signature-then-MAC authentication","bounded adversary"],"falsifier":"Run one of the protocols with a concrete NIST-standard signature or KEM, record the wall-clock time from the first public PQC material to the final accept, and compare with the best documented attack time against that algorithm: a successful forgery or decapsulation within that measured window would directly contradict Theorem 0. Alternatively, a distinguishing attack against the dual PRF with a non-negligible advantage in a polynomial number of queries would invalidate the key-derivation chain.","tokens_in":52330,"feed_emoji":"🔐","tokens_out":7418,"duration_ms":78417,"temperature":0.7,"pith_summary":"Quantum Key Distribution promises information-theoretically secure keys, but only if the classical channel used to distill them is authenticated, and pre-shared keys do not scale to large networks. This paper tries to establish that Post-Quantum Cryptography with certificates can replace those pre-shared keys for the very first QKD iteration, and that the keys distilled in that iteration can then authenticate all later iterations. It formally specifies two PQC-authenticated key exchanges, one signature-based and one KEM-based, plus a shared-key MAC-based protocol for later rounds, and proves them secure in a hybrid authenticated key exchange model against a bounded hybrid polynomial-time adversary together with a conditioned unbounded adversary. The central conclusion is that, as long as the PQC algorithms remain unbroken during the active window of the protocol, the distilled QKD keys are information-theoretically secure and $\\varepsilon_{\\mathrm{QKD}} + \\varepsilon_{\\mathrm{auth}}$-secure, which makes remote onboarding of new QKD users scalable.","feed_headline":"PQC can bootstrap QKD to information-theoretic security","feed_subtitle":"The paper proves signature- and KEM-based authentication make distilled QKD keys secure under a bounded-adversary time window.","key_machinery":"The load-bearing machinery is the hybrid authenticated key exchange (HAKE) security experiment with cleanness predicate $\\mathrm{clean}_{\\mathrm{HPT}}$, paired with $T_{\\mathrm{HPT}}$-term security of PQC primitives: an algorithm is secure for a specified time $T < T_{\\mathrm{HPT}}$, where $T_{\\mathrm{HPT}}$ is the estimated time a hybrid adversary needs to break it. Each protocol treats the unauthenticated QKD key as an ephemeral secret, binds the QKD transcript and nonces to derived keys through a dual pseudorandom function and a hash, authenticates identities with a PQC signature or KEM, and confirms liveness with a MAC tag, while the cleanness predicate forces the adversary to leave at least one authentication secret uncompromised during the active window. This carries the argument because every game hop in the proof replaces only uncompromised key material with random values.","core_discovery":"The paper's central claim is Theorem 0: the multi-stage and dynamic protocol family $\\Pi \\in \\{\\Pi_\\Sigma, \\Pi_{\\mathrm{KEM}}, \\Pi_{\\mathrm{MAC}}\\}$ is HAKE-secure with cleanness predicate $\\mathrm{clean}_{\\mathrm{HPT}}$ and confidentiality secure, meaning that for any hybrid polynomial-time adversary and any conditioned unbounded adversary, the advantage in the HAKE key-indistinguishability game is negligible in the security parameter $\\kappa$. Consequently, the QKD keys distilled with an authenticated transcript are information-theoretically secure and $(\\varepsilon_{\\mathrm{QKD}} + \\varepsilon_{\\mathrm{auth}})$-secure, where $\\varepsilon_{\\mathrm{auth}}$ is the post-quantum authentication security. The proof covers the case of an initiator session without an origin session, a responder session without an origin session, and a matching-session case, in each case splitting by which protocol is run. This construction gives forward secrecy for stored QKD keys, and it permits later QKD iterations to switch from PQC to non-ITS MAC authentication once the shared secret key pool is populated.","pith_inferences":["Editorial inference: the runtime condition $T_A + T_B + T_T < T_{\\mathrm{HPT}}$ could be turned into an operational parameter by issuing certificates whose validity period is set by a conservative lower bound on $T_{\\mathrm{HPT}}$, and by requiring fresh PQC keys once that period lapses; the paper gestures at such certificates but does not specify how the bound is certified.","Editorial inference: a practical deployment would need a way for honest parties to learn $T_{\\mathrm{HPT}}$; one testable benchmark is to measure the wall-clock time of the full protocol with a specific NIST KEM and compare it with the best published attack time against that KEM on realistic hardware.","Editorial inference: if $T_{\\mathrm{HPT}}$ is overestimated, the security collapse is total rather than a graceful degradation from ITS to computational security, because the affected session's authentication is simply absent; this suggests an engineering preference for conservative, short-lived PQC keys.","Editorial inference: the same framework could be reused to compare the cost of PQC bootstrap against pure pre-shared ITS-MAC authentication, quantifying by how much $\\varepsilon_{\\mathrm{auth}}$ worsens when pre-shared secrets are removed."],"forward_implications":["A new QKD user with a valid certificate can join a quantum network remotely, without a physical meeting to exchange pre-shared key material.","After the first PQC-authenticated iteration, later QKD iterations can be authenticated with non-ITS MACs from the shared key pool, so PQC use can be limited to the bootstrap stage.","Even if the PQC secret keys are revealed after a session reaches accept, previous and current stored QKD keys remain information-theoretically secure because the protocol has perfect forward secrecy.","The security analysis is agnostic to the QKD protocol and to the concrete PQC signature or KEM, so the bound applies across discrete-variable and continuous-variable QKD with any NIST-class algorithm.","The overall advantage grows polynomially in the number of parties, sessions, and stages, so the first-distilled keys are the most secure ones and should be preferred for later MAC authentication."],"supporting_citations":[{"why":"Supplies the HAKE key-indistinguishability experiment, the cleanness predicate structure, and the adversarial query model on which Theorem 0 is built.","marker":"[15]"},{"why":"Supplies the signature-then-MAC binding order that prevents person-in-the-middle and misbinding attacks, the structure the protocols follow.","marker":"[13]"},{"why":"Supplies the KEM-based handshake pattern without signatures that the $\\Pi_{\\mathrm{KEM}}$ protocol adapts.","marker":"[19]"},{"why":"Supplies the TLS-style traffic-secret and session-key derivation pattern used for confidentiality and integrity.","marker":"[14]"},{"why":"Provides the direct security proof that QKD with an authenticated classical channel is secure against an unbounded adversary, giving the $\\varepsilon_{\\mathrm{QKD}} + \\varepsilon_{\\mathrm{auth}}$ composition.","marker":"[26]"},{"why":"Provides the composable-security step that upgrades an unauthenticated QKD transcript plus an authentication step into an authenticated QKD key.","marker":"[27]"},{"why":"Supplies the composable QKD security definitions and the practical epsilon $\\varepsilon_{\\mathrm{QKD}}$ used throughout the bounds.","marker":"[23]"},{"why":"Supplies the sequence-of-games and Difference Lemma technique used in the security proof.","marker":"[43]"},{"why":"Supplies the signature-based HAKE sub-case proof structure used for the $\\Pi_\\Sigma$ analysis.","marker":"[17]"},{"why":"Supplies the KEM-based HAKE sub-case proof structure used for the $\\Pi_{\\mathrm{KEM}}$ analysis.","marker":"[18]"}],"fun_headline_variants":["PQC auth replaces pre-shared keys for scalable QKD","Post-quantum auth gives QKD ITS security at scale","QKD scales without key explosion via PQC auth","PQC-authenticated QKD resists bounded adversaries"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole argument rests on equation 1: the honest parties' combined authentication computation and transmission time must stay below the estimated time $T_{\\mathrm{HPT}}$ it would take a hybrid polynomial-time adversary to break the PQC algorithm, and the paper admits that $T_{\\mathrm{HPT}}$ is very hard to estimate and may be overestimated; if a PQC break lands inside the active window, authentication is subverted and the QKD keys are neither authenticated nor information-theoretically secure.","fun_headline_variants_meta":{"raw":{"variants":["PQC auth replaces pre-shared keys for scalable QKD","Post-quantum auth gives QKD ITS security at scale","QKD scales without key explosion via PQC auth","PQC-authenticated QKD resists bounded adversaries"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000723,"raw_usage":{"total_tokens":3234,"prompt_tokens":927,"completion_tokens":2307,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":543,"completion_tokens_details":{"reasoning_tokens":2239}},"tokens_in":543,"tokens_out":2307,"duration_ms":19596,"temperature":1.0,"reasoning_tokens":2239,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T12:53:48.232958+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run one of the protocols with a concrete NIST-standard signature or KEM, record the wall-clock time from the first public PQC material to the final accept, and compare with the best documented attack time against that algorithm: a successful forgery or decapsulation within that measured window would directly contradict Theorem 0. Alternatively, a distinguishing attack against the dual PRF with a non-negligible advantage in a polynomial number of queries would invalidate the key-derivation chain.","supporting_citations":[{"cited_title":"Many a Mickle Makes a Muckle: A Framework for Provably Quantum-Secure Hyb rid Key Exchange","cited_arxiv_id":null,"evidence_quote":"Supplies the HAKE key-indistinguishability experiment, the cleanness predicate structure, and the adversarial query model on which Theorem 0 is built."},{"cited_title":"SIGMA: The ‘SIGn-and-MAc’ Approach to Authenticated Diffie- Hellman and Its Use in the IKE Protocols","cited_arxiv_id":null,"evidence_quote":"Supplies the signature-then-MAC binding order that prevents person-in-the-middle and misbinding attacks, the structure the protocols follow."},{"cited_title":"Rescorla","cited_arxiv_id":null,"evidence_quote":"Supplies the TLS-style traffic-secret and session-key derivation pattern used for confidentiality and integrity."},{"cited_title":"The Universal Composable Securi ty of Quantum Key Distri- bution","cited_arxiv_id":null,"evidence_quote":"Provides the composable-security step that upgrades an unauthenticated QKD transcript plus an authentication step into an authenticated QKD key."},{"cited_title":"Sequences of games: a tool for taming complexity in security proofs","cited_arxiv_id":null,"evidence_quote":"Supplies the sequence-of-games and Difference Lemma technique used in the security proof."}],"review_version":1}