arXiv subjects

Javier Blanco-Romero

Publications and source records attributed to Javier Blanco-Romero.

11 recordsLinked to original sources

arXiv2026

Entropy Bootstrapping for Wireless Embedded Systems

Cryptographic protocols require unpredictable randomness at first boot, yet wireless sensors often wake with uninitialized hardware or noise sources running in unverified operating states. In platforms like the ESP32, statistical testing cannot catch this cold-start failure because the internal random number generator continues returning statistically plausible bytes even when analog radio noise is disabled, producing pure pseudorandomness by design. To prevent nodes from silently anchoring security in a single unverified source, we introduce a defense-in-depth boot architecture governed by explicit source-state admission. The system combines three orthogonal roots of unpredictability: startup noise from uninitialized SRAM cells, local wireless RNG output gathered during a bounded window defined by an external packet burst, and a signed post-quantum asymmetric capsule delivering fresh entropy from a trusted peer without requiring local random generation. Rather than blending unverified numbers, the admission policy gates entropy credit on the verified operating mode of the hardware, admitting wireless RNG output only while the radio frequency circuits are active. Empirical trials confirm that incoming network traffic successfully bounds repeatable, uncorrelated hardware sampling windows, while remote capsule verification completes with minimal processing overhead. By coupling physical operating state to cryptographic accounting, commodity microcontrollers can bootstrap reliable seed entropy across complementary roots without relying on additional dedicated security hardware.

cs.CR↗

arXiv2026

Modular Lower Bounds on Reeh-Schlieder State Preparation

The Reeh-Schlieder theorem says that every target vector can be approximated from the vacuum by an operator localized in an arbitrarily small spacetime region, but it gives no quantitative cost for doing so. This note isolates a standard Tomita-Takesaki estimate as a model-independent preparation bound. Targets with deeply negative modular energy require large local operators. After rescaling such an operator to a physical contraction, the same estimate becomes a lower bound on postselection overhead. In geometries where the modular Hamiltonian is known, the bound becomes explicit. Bisognano-Wichmann turns it into a boost energy statement for wedges, and the Casini-Huerta-Myers formula gives a stress-tensor version for bounded regions of conformal field theories. Local unitaries can only reach states of nonnegative modular energy. Negative modular sectors require nonunitary or postselected outcomes, giving a preparation cost bound that complements vacuum embezzlement in type III local algebras.

hep-th↗

arXiv2026

Variational and Majorization Principles in Lattice Reduction

Lattice reduction smooths the Gram-Schmidt profile, and we use majorization to describe the local swap mechanism behind that smoothing. In this language, each non-degenerate Lovász swap acts as a T-transform on the log-norm profile. As a consequence, every strictly Schur-convex measure of profile spread decreases at such a swap. Two structural consequences follow. First, the worst-case GSA envelope admits a variational interpretation. It is the unique minimum-variance profile compatible with the Lovász gap geometry, so its slope is determined by the LLL parameter alone. Second, the realized swap trajectory satisfies an exact telescoping identity for variance dissipation. The same viewpoint also helps organize deep-insertion heuristics. It suggests a thermal family of Schur-convex scoring rules, motivates adaptive selection within that family, and leads to two concrete selectors: Thermal-Adaptive, which reduces operation counts relative to SS-GG on flat profiles in our benchmarks while recovering SS-GG on $q$-ary inputs, and Geodesic Deep-LLL, which reduces equivalent-swap counts on structured lattices in our benchmarks at higher wall-clock cost.

cs.CR↗

arXiv2026

Post-Quantum Entropy as a Service for Embedded Systems

Embedded cryptography stands or falls on entropy quality, yet small devices have few trustworthy sources and little tolerance for heavyweight protocols. We build a Quantum Entropy as a Service (QEaaS) system that moves QRNG-derived entropy from a Quantis device to ESP32-class clients over post-quantum-secured channels. On the server side, the design exposes two paths: direct quantum entropy through a custom OpenSSL provider and mixed entropy through the Linux system pool. On the client side, we extend libcoap's Zephyr support, integrate wolfSSL-based DTLS 1.3 into the CoAP stack, and add a BLAKE2s entropy pool that preserves the standard Zephyr extraction interface while introducing an injection API for server-provided entropy. Benchmarks on ESP32 hardware, targeting 100 iterations per configuration, show that ML-KEM-512 completes a DTLS 1.3 handshake in 313 ms on average without certificate verification, 35% faster than ECDHE P-256. Pairing ML-KEM-512 with ML-DSA-44 lowers the mean to 225 ms. Certificate verification adds roughly 194 ms for ECDSA but only 17 ms for ML-DSA-44, so the fully post-quantum configuration remains 63% faster than classical ECDHE P-256 with ECDSA even under full verification. Local BLAKE2s pool operations stay below 0.1 ms combined. On this platform, post-quantum key exchange and authentication are not only feasible; they are faster than the classical baseline.

cs.CR↗

arXiv2026

On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks

Harvest-now, decrypt-later (HN-DL) attacks threaten today's encrypted communications by archiving ciphertext until a quantum computer can break the underlying key exchange. This paper reframes HN-DL as an economic problem, quantifying adversary costs across Transport Layer Security (TLS) 1.2, TLS 1.3, QUIC, and Secure Shell (SSH) with an open-source testbed that reproduces the full attack sequence. Our model shows that retaining intercepted traffic is economically trivial, shifting the defensive question from whether an adversary can archive to how much decryption will cost. We evaluate protocol configuration strategies that act along two independent cost axes: storage overhead and quantum workload. Beyond the ongoing migration to post-quantum cryptography, these strategies provide defense in depth with current infrastructure. Encrypted Client Hello forces indiscriminate bulk collection, inflating the archive the adversary must retain, while aggressive rekeying and larger key exchange parameters multiply the quantum computations required to recover plaintext. Because storage inflation penalizes both sides while quantum cost inflation targets the adversary alone, rekeying and key size selection offer the strongest defensive levers.

cs.CR↗

arXiv2025

Hybrid Quantum Security for IPsec

Quantum Key Distribution (QKD) offers information-theoretic security against quantum computing threats, but integrating QKD into existing security protocols remains an unsolved challenge due to fundamental mismatches between pre-distributed quantum keys and computational key exchange paradigms. This paper presents the first systematic comparison of sequential versus parallel hybrid QKD-PQC key establishment strategies for IPsec, revealing fundamental protocol design principles that extend beyond specific implementations. We introduce two novel approaches for incorporating QKD into Internet Key Exchange version 2 (IKEv2) with support for both ETSI GS QKD 004 stateful and ETSI GS QKD 014 stateless API specifications: (1) a pure QKD approach that replaces computational key derivation with identifier-based quantum key coordination, and (2) a unified QKD-KEM abstraction that enables parallel composition of quantum and post-quantum cryptographic methods within existing protocol frameworks. Our key insight is that parallel hybrid approaches eliminate the multiplicative latency penalties inherent in sequential methods mandated by RFC 9370, achieving significant performance improvements under realistic network conditions. Performance evaluation using a Docker-based testing framework with IDQuantique QKD hardware demonstrates that the parallel hybrid approach significantly outperforms sequential methods under network latency conditions, while pure QKD achieves minimal bandwidth overhead through identifier-based key coordination. Our implementations provide practical quantum-enhanced IPsec solutions suitable for critical infrastructure deployments requiring defense-in-depth security.

cs.CR↗

arXiv2025

Implementing and Evaluating Post-Quantum DNSSEC in CoreDNS

The emergence of quantum computers poses a significant threat to current secure service, application and/or protocol implementations that rely on RSA and ECDSA algorithms, for instance DNSSEC, because public-key cryptography based on number factorization or discrete logarithm is vulnerable to quantum attacks. This paper presents the integration of post-quantum cryptographic (PQC) algorithms into CoreDNS to enable quantum-resistant DNSSEC functionality. We have developed a plugin that extends CoreDNS with support for five PQC signature algorithm families: ML-DSA, FALCON, SPHINCS+, MAYO, and SNOVA. Our implementation maintains compatibility with existing DNS resolution flows while providing on-the-fly signing using quantum-resistant signatures. A benchmark has been performed and performance evaluation results reveal significant trade-offs between security and efficiency. The results indicate that while PQC algorithms introduce operational overhead, several candidates offer viable compromises for transitioning DNSSEC to quantum-resistant cryptography.

cs.CR↗

arXiv2025

Onion Routing Key Distribution for QKDN

The advance of quantum computing poses a significant threat to classical cryptography, compromising the security of current encryption schemes such as RSA and ECC. In response to this challenge, two main approaches have emerged: quantum cryptography and post-quantum cryptography (PQC). However, both have implementation and security limitations. In this paper, we propose a secure key distribution protocol for Quantum Key Distribution Networks (QKDN), which incorporates encapsulation techniques in the key-relay model for QKDN inspired by onion routing and combined with PQC to guarantee confidentiality, integrity, authenticity and anonymity in communication. The proposed protocol optimizes security by using post-quantum public key encryption to protect the shared secrets from intermediate nodes in the QKDN, thereby reducing the risk of attacks by malicious intermediaries. Finally, relevant use cases are presented, such as critical infrastructure networks, interconnection of data centers and digital money, demonstrating the applicability of the proposal in critical high-security environments.

cs.CR↗

arXiv2025

QKD-KEM: Hybrid QKD Integration into TLS with OpenSSL Providers

Quantum Key Distribution (QKD) promises information-theoretic security, yet integrating QKD into existing protocols like TLS remains challenging due to its fundamentally different operational model. In this paper, we propose a hybrid QKD-KEM protocol with two distinct integration approaches: a client-initiated flow compatible with both ETSI 004 and 014 specifications, and a server-initiated flow similar to existing work but limited to stateless ETSI 014 APIs. Unlike previous implementations, our work specifically addresses the integration of stateful QKD key exchange protocols (ETSI 004) which is essential for production QKD networks but has remained largely unexplored. By adapting OpenSSL's provider infrastructure to accommodate QKD's pre-distributed key model, we maintain compatibility with current TLS implementations while offering dual layers of security. Performance evaluations demonstrate the feasibility of our hybrid scheme with acceptable overhead, showing that robust security against quantum threats is achievable while addressing the unique requirements of different QKD API specifications.

cs.CR↗

arXiv2024

Guided Waves in Static Curved Spacetimes

This work investigates the propagation of electromagnetic waves in waveguides within static curved spacetimes. We develop a covariant formalism using Hertzian potentials to describe guided electromagnetic modes in spacetimes with metrics that depend on the proper length along the waveguide axis. The Maxwell equations are solved using a Hertzian potential ansatz, resulting in wave equations for TE and TM modes. We analyze the axial and transverse components of the solutions and derive expressions for the cutoff frequency and guide wavelength. The special case of TEM modes is also examined. As an illustrative example, we apply the formalism to radial propagation in Schwarzschild spacetime. This work provides a framework for studying guided electromagnetic waves in curved spacetime geometries, opening up potential applications in precision tests of general relativity and relativistic quantum optics.

gr-qc↗

arXiv2024

Machine Learning Predictors for Min-Entropy Estimation

This study investigates the application of machine learning predictors for min-entropy estimation in Random Number Generators (RNGs), a key component in cryptographic applications where accurate entropy assessment is essential for cybersecurity. Our research indicates that these predictors, and indeed any predictor that leverages sequence correlations, primarily estimate average min-entropy, a metric not extensively studied in this context. We explore the relationship between average min-entropy and the traditional min-entropy, focusing on their dependence on the number of target bits being predicted. Utilizing data from Generalized Binary Autoregressive Models, a subset of Markov processes, we demonstrate that machine learning models (including a hybrid of convolutional and recurrent Long Short-Term Memory layers and the transformer-based GPT-2 model) outperform traditional NIST SP 800-90B predictors in certain scenarios. Our findings underscore the importance of considering the number of target bits in min-entropy assessment for RNGs and highlight the potential of machine learning approaches in enhancing entropy estimation techniques for improved cryptographic security.

cs.LG↗