Merkle Tree Certificate Post-Quantum PKI for Kubernetes and Cloud-Native 5G/B5G Core

• URL: http://arxiv.org/abs/2604.04191v1
• Date: Sun, 05 Apr 2026 17:17:07 GMT
• Title: Merkle Tree Certificate Post-Quantum PKI for Kubernetes and Cloud-Native 5G/B5G Core
• Abstract summary: Merkle Tree Certificates (MTC) replace per-certificate issuer signatures with Merkle inclusion proofs and, in the landmark mode, eliminate on-wire signatures from certificate authentication entirely.<n>We implement MTC proof construction and verification in Go/tls and crypto/x509 packages.<n>Our measurements on an Intel i9-12900 show MTC landmark verification completing in under 2 s compared to 24 microseconds for ECDSA signature verification-with no measurable impact on TLS handshake time.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Post-quantum signature schemes such as ML-DSA-65 produce signatures of 3,309 bytes and public keys of 1,952 bytes over 50 times larger than classical Ed25519. In TLS-authenticated environments like Kubernetes control planes and 5G Core networks, where every inter-component connection is mutually authenticated, this overhead compounds across thousands of handshakes per second. Merkle Tree Certificates (MTC), currently under development at IETF, replace per-certificate issuer signatures with Merkle inclusion proofs and, in the landmark mode, eliminate on-wire signatures from certificate authentication entirely. We present MTC-based PKI architectures for Kubernetes and 3GPP 5G Service-Based Architecture. Starting from the infrastructure layer, we replace the Kubernetes cluster CA with an MTCA deployment that issues MTC certificates to control plane components, with cosigners and a DaemonSet-based landmark distributor. Building on this, we design a certificate lifecycle for 5G Network Functions deployed against QORE, a post-quantum 5G Core. We implement MTC proof construction and verification in Go crypto/tls and crypto/x509 packages. Our measurements on an Intel i9-12900 show MTC landmark verification completing in under 2 μs compared to 24 microseconds for ECDSA signature verification-with no measurable impact on TLS handshake time. We further propose a 6G-native architecture where the NRF serves as the MTCA and the SCP as witness cosigner, and discuss applicability to Non-Terrestrial Networks.

Related papers

• Battlefield 5G: Dual-PKI and TPM-Based UE Attestation for Tactical 5G Standalone Networks [2.0344286047762363]
  5G-AKA authenticates a subscriber credential stored on a USIM but does not authenticate the physical device that holds that credential or verify its boot state.<n>We present Battlefield 5G, a pre-authentication framework for 5G standalone networks.<n>We implement these capabilities by extending the Radio Access Network of the Software Radio System.
  arXiv  Detail & Related papers  (2026-08-11T17:22:47Z)
• Deploying and validating a metropolitan QKD secure network: architecture and field performance [76.02413102965598]
  Quantum Key Distribution provides information-theoretic security for key establishment.<n>A metropolitan-scale quantum-secure network between data centers in Milan is reported.<n>Results establish the technical and operational readiness of metropolitan QKD networks for production deployment.
  arXiv  Detail & Related papers  (2026-07-13T15:51:26Z)
• FIDEM: A Standard-Compliant Framework for Secure Binding of MUD Profiles to IoT Devices [90.91375734523943]
  FIDEM is a standard-compliant framework for securing DHCP-based MUD URL issuance.<n>It provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication.
  arXiv  Detail & Related papers  (2026-05-28T09:16:50Z)
• Network Impact of Post-Quantum Certificate Chain sizes on Time to First Byte in TLS Deployments [0.256101750765765]
  Post-Quantum Cryptography (PQC) introduces significant deployment challenges in real-world networks.<n>We evaluate the latency cost of transitioning existing internet infrastructure to quantum-safe certificate schemes.<n>We additionally examine how CDN properties such as session resumption, certificate size optimizations, and geographical distribution reduce latency penalties.
  arXiv  Detail & Related papers  (2026-04-27T18:00:23Z)
• zk-X509: Privacy-Preserving On-Chain Identity from Legacy PKI via Zero-Knowledge Proofs [0.0]
  zk-X509 is a privacy-preserving identity system with public ledgers via a RISC-V zero-knowledge virtual machine (zkVM)<n>Users prove ownership of standard X.509 certificates without revealing private keys or personal identifiers.<n>The system achieves 11.8M cycles for ECDSA P-256 (17.4M for RSA-2048), with on-chain Groth16 verification costing 300K gas.
  arXiv  Detail & Related papers  (2026-03-26T08:55:26Z)
• Efficient ML-DSA Public Key Management Method with Identity for PKI and Its Application [34.906142924769675]
  We propose a novel identity-based public key management framework for PKI based on post-quantum cryptography, termed textitIPK-pq.<n>Building on the concept of the Composite Public Key (CPK), textitIPK-pq addresses the linear collusion problem inherent in CPK through an enhanced identity mapping mechanism.<n>We provide a formal security proof for textitIPK-pq, covering both individual private key components and the composite private key.
  arXiv  Detail & Related papers  (2026-03-26T05:26:31Z)
• A Lightweight Defense Mechanism against Next Generation of Phishing Emails using Distilled Attention-Augmented BiLSTM [34.0814379994364]
  The MobileBERT teacher receives fine-tuning before its transformation into a BiLSTM model with multi-head attention.<n>The system demonstrates excellent performance in terms of accuracy and latency while maintaining a compact size.<n>The paper examines system performance under high traffic conditions and security measures for privacy protection and implementation methods for operational deployment.
  arXiv  Detail & Related papers  (2026-02-24T20:06:45Z)
• Post-Quantum Identity-Based TLS for 5G Service-Based Architecture and Cloud-Native Infrastructure [0.5735035463793009]
  We present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption (IBE)<n>Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation.<n>We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks.
  arXiv  Detail & Related papers  (2026-02-04T05:55:41Z)
• QoeSiGN: Towards Qualified Collaborative eSignatures [42.13843953705695]
  EU's eIDAS regulation specifies, e.g., advanced and qualified (QES) eSignatures.<n>QESs are based on a qualified certificate issued by a qualified trust service provider (QTSP)<n>We perform a threat analysis on the QES-creation process of Austria's national eID.<n>We present QoeSiGN, utilizing novel P2C2 technologies.
  arXiv  Detail & Related papers  (2025-12-15T18:07:17Z)
• TPM-Based Continuous Remote Attestation and Integrity Verification for 5G VNFs on Kubernetes [0.8427427828815586]
  We present a TPM 2.0-based continuous remote attestation solution for core 5G components deployed on runtime.<n>We integrate the open-source Keylime framework with a custom IMA template that isolates pod-level measurements, allowing per-pod integrity verification.<n>The experimental results show that the system detects unauthorized modifications in real time, labels each pod's trust state, and generates detailed audit logs.
  arXiv  Detail & Related papers  (2025-10-03T17:54:15Z)
• Cross-Service Token: Finding Attacks in 5G Core Networks [58.86003502940164]
  We present FivGeeFuzz, a grammar-based fuzzing framework designed to uncover security flaws in 5G core SBIs.<n>Using FivGeeFuzz, we discovered 8 previously unknown vulnerabilities in free5GC, leading to runtime crashes, improper error handling, and unauthorized access to resources.
  arXiv  Detail & Related papers  (2025-09-10T20:40:33Z)
• CryptoFormalEval: Integrating LLMs and Formal Verification for Automated Cryptographic Protocol Vulnerability Detection [41.94295877935867]
  We introduce a benchmark to assess the ability of Large Language Models to autonomously identify vulnerabilities in new cryptographic protocols. We created a dataset of novel, flawed, communication protocols and designed a method to automatically verify the vulnerabilities found by the AI agents.
  arXiv  Detail & Related papers  (2024-11-20T14:16:55Z)
• An Enhanced Online Certificate Status Protocol for Public Key Infrastructure with Smart Grid and Energy Storage System [0.6757476692230008]
  We introduce the OCSP Stapling approach to optimize OCSP query costs in our smart grid environment.<n>Our experimental results show that OCSP stapling increases both efficiency and security, creating a more robust architecture for the smart grid.
  arXiv  Detail & Related papers  (2024-09-17T06:57:17Z)
• First demonstration of a post-quantum key-exchange with a nanosatellite [58.579141089302816]
  We demonstrate a post-quantum key-exchange with the nanosatellite SpooQy-1 in low Earth orbit using Kyber-512. This implementation demonstrates the feasibility of a quantum-safe authenticated key-exchange and encryption system on SWaP constrained nanosatellites.
  arXiv  Detail & Related papers  (2022-06-02T10:45:27Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.