Search papers, labs, and topics across Lattice.
This study investigates the security implications of integrating Post-Quantum Cryptography (PQC) into TLS 1.3, revealing that the added computational overhead can significantly exacerbate TLS handshake exhaustion attacks, leading to heightened Distributed Denial-of-Service (DDoS) vulnerabilities. Through an empirical testbed with a PQC-enabled TLS server and multiple attacking nodes, the research demonstrates that these attacks can increase server CPU utilization by up to 88 times. Additionally, the performance of state-of-the-art deep learning-based Intrusion Detection Systems (IDS) is critically compromised, with detection rates dropping to around 50% recall and AU-ROC scores nearing random chance under PQC conditions.
Integrating PQC into TLS could make servers 88 times more vulnerable to DDoS attacks while crippling the effectiveness of existing intrusion detection systems.
Post-Quantum Cryptography (PQC) is increasingly being integrated into TLS 1.3 to enhance resilience against quantum-enabled attacks. However, the additional computational and communication overhead introduced by PQC primitives during the handshake phase may also amplify the impact of TLS handshake exhaustion attacks, leading to more severe Distributed Denial-of-Service (DDoS) threats. In this study, we establish an empirical testbed consisting of one PQC-enabled TLS server and ten attacking nodes, generating over 16.5 GB of mixed traffic data that includes both legitimate browsing behavior and high-intensity handshake exhaustion attacks. Experimental results show that PQC-TLS can prolong periods of sustained high CPU utilization on the server by up to 88 times, significantly amplifying the effectiveness of such attacks. Furthermore, we evaluate state-of-the-art deep learning-based Intrusion Detection Systems (IDS) and observe a substantial decline in attack detection performance under PQC traffic conditions. In particular, exosphere achieves only around 50% recall, while HyperVision's AU-ROC degrades to near-random levels (0.49), revealing critical detection blind spots in existing IDS when operating in PQC environments. The main contributions of this work are threefold: (1) we systematically quantify and analyze the root causes of IDS detection blind spots in PQC settings; (2) we publicly release a comprehensive PQC-DDoS hybrid traffic dataset, including precise attack timestamps and server-side resource monitoring data; and (3) we open-source all experimental code and AWS deployment scripts, enabling a fully reproducible cloud-based testing environment. These resources aim to support both academia and industry in developing next-generation PQC-aware intrusion detection systems.
