arXiv subjects

Daniel Díaz-Sánchez

Publications and source records attributed to Daniel Díaz-Sánchez.

4 recordsLinked to original sources

arXiv2026

Entropy Bootstrapping for Wireless Embedded Systems

Cryptographic protocols require unpredictable randomness at first boot, yet wireless sensors often wake with uninitialized hardware or noise sources running in unverified operating states. In platforms like the ESP32, statistical testing cannot catch this cold-start failure because the internal random number generator continues returning statistically plausible bytes even when analog radio noise is disabled, producing pure pseudorandomness by design. To prevent nodes from silently anchoring security in a single unverified source, we introduce a defense-in-depth boot architecture governed by explicit source-state admission. The system combines three orthogonal roots of unpredictability: startup noise from uninitialized SRAM cells, local wireless RNG output gathered during a bounded window defined by an external packet burst, and a signed post-quantum asymmetric capsule delivering fresh entropy from a trusted peer without requiring local random generation. Rather than blending unverified numbers, the admission policy gates entropy credit on the verified operating mode of the hardware, admitting wireless RNG output only while the radio frequency circuits are active. Empirical trials confirm that incoming network traffic successfully bounds repeatable, uncorrelated hardware sampling windows, while remote capsule verification completes with minimal processing overhead. By coupling physical operating state to cryptographic accounting, commodity microcontrollers can bootstrap reliable seed entropy across complementary roots without relying on additional dedicated security hardware.

cs.CR↗

arXiv2026

Post-Quantum Entropy as a Service for Embedded Systems

Embedded cryptography stands or falls on entropy quality, yet small devices have few trustworthy sources and little tolerance for heavyweight protocols. We build a Quantum Entropy as a Service (QEaaS) system that moves QRNG-derived entropy from a Quantis device to ESP32-class clients over post-quantum-secured channels. On the server side, the design exposes two paths: direct quantum entropy through a custom OpenSSL provider and mixed entropy through the Linux system pool. On the client side, we extend libcoap's Zephyr support, integrate wolfSSL-based DTLS 1.3 into the CoAP stack, and add a BLAKE2s entropy pool that preserves the standard Zephyr extraction interface while introducing an injection API for server-provided entropy. Benchmarks on ESP32 hardware, targeting 100 iterations per configuration, show that ML-KEM-512 completes a DTLS 1.3 handshake in 313 ms on average without certificate verification, 35% faster than ECDHE P-256. Pairing ML-KEM-512 with ML-DSA-44 lowers the mean to 225 ms. Certificate verification adds roughly 194 ms for ECDSA but only 17 ms for ML-DSA-44, so the fully post-quantum configuration remains 63% faster than classical ECDHE P-256 with ECDSA even under full verification. Local BLAKE2s pool operations stay below 0.1 ms combined. On this platform, post-quantum key exchange and authentication are not only feasible; they are faster than the classical baseline.

cs.CR↗

arXiv2025

Implementing and Evaluating Post-Quantum DNSSEC in CoreDNS

The emergence of quantum computers poses a significant threat to current secure service, application and/or protocol implementations that rely on RSA and ECDSA algorithms, for instance DNSSEC, because public-key cryptography based on number factorization or discrete logarithm is vulnerable to quantum attacks. This paper presents the integration of post-quantum cryptographic (PQC) algorithms into CoreDNS to enable quantum-resistant DNSSEC functionality. We have developed a plugin that extends CoreDNS with support for five PQC signature algorithm families: ML-DSA, FALCON, SPHINCS+, MAYO, and SNOVA. Our implementation maintains compatibility with existing DNS resolution flows while providing on-the-fly signing using quantum-resistant signatures. A benchmark has been performed and performance evaluation results reveal significant trade-offs between security and efficiency. The results indicate that while PQC algorithms introduce operational overhead, several candidates offer viable compromises for transitioning DNSSEC to quantum-resistant cryptography.

cs.CR↗

arXiv2024

Machine Learning Predictors for Min-Entropy Estimation

This study investigates the application of machine learning predictors for min-entropy estimation in Random Number Generators (RNGs), a key component in cryptographic applications where accurate entropy assessment is essential for cybersecurity. Our research indicates that these predictors, and indeed any predictor that leverages sequence correlations, primarily estimate average min-entropy, a metric not extensively studied in this context. We explore the relationship between average min-entropy and the traditional min-entropy, focusing on their dependence on the number of target bits being predicted. Utilizing data from Generalized Binary Autoregressive Models, a subset of Markov processes, we demonstrate that machine learning models (including a hybrid of convolutional and recurrent Long Short-Term Memory layers and the transformer-based GPT-2 model) outperform traditional NIST SP 800-90B predictors in certain scenarios. Our findings underscore the importance of considering the number of target bits in min-entropy assessment for RNGs and highlight the potential of machine learning approaches in enhancing entropy estimation techniques for improved cryptographic security.

cs.LG↗