Search papers, labs, and topics across Lattice.
This paper introduces a commitment-based hybrid post-quantum cryptographic model designed to enhance authentication efficiency for multi-file cloud storage against quantum threats. By integrating AES-256-GCM encryption with a novel hybrid key encapsulation and signature mechanism, the model significantly reduces the computational burden associated with signing multiple files. The key finding demonstrates that this approach can decrease signing-phase time by factors of up to 725 for large file batches, making it feasible for practical use in cloud environments.
Reducing signing-phase time by over 700 times for multi-file uploads could revolutionize secure cloud storage in a post-quantum world.
Cloud storage clients increasingly require authentication that remains secure against future quantum-capable adversaries, motivating hybrid constructions that combine classical primitives with standardized post-quantum alternatives. Extended naively to multi-file upload, such constructions incur a per-file lattice signing cost that dominates authentication time and becomes prohibitive at realistic batch sizes. This paper presents a commitment-based hybrid post-quantum model that addresses this bottleneck. It comprises AES-256-GCM bulk encryption, a hybrid X25519 with ML-KEM-768 key encapsulation mechanism, and a hybrid Ed25519 with ML-DSA-65 dual signature, computed over a SHA3-256 batch commitment. The commitment binds all ciphertexts in a batch to a single fixed-size digest that is signed once, reducing the number of post-quantum signature invocations per batch from n to one, independent of batch size; the remaining encryption and hashing is bounded by fast symmetric throughput. On a commodity client platform, averaged over 20 repetitions, this holds signing-phase time near-constant as the batch grows while the per-file baseline scales linearly. At n = 1000, the model reduces signing-phase time by factors of 629, 606, and 725 for 100 KB, 1 MB, and 10 MB files respectively, against a per-file dual-signing baseline sharing every other primitive.
