Signature Placement in Post-Quantum TLS Certificate Hierarchies: An Experimental Study of ML-DSA and SLH-DSA in TLS 1.3 Authentication

• URL: http://arxiv.org/abs/2604.06100v1
• Date: Tue, 07 Apr 2026 17:13:10 GMT
• Title: Signature Placement in Post-Quantum TLS Certificate Hierarchies: An Experimental Study of ML-DSA and SLH-DSA in TLS 1.3 Authentication
• Abstract summary: Post-quantum migration in TLS 1.3 should not be understood as a flat substitution problem in which one signature algorithm is replaced by another.<n>This paper presents a local experimental study of TLS 1.3 authentication strategies built on OpenSSL 3 and oqsprovider.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Post-quantum migration in TLS 1.3 should not be understood as a flat substitution problem in which one signature algorithm is replaced by another and deployment cost is inferred directly from primitive-level benchmarks. In certificate-based authentication, the practical effect of a signature family depends on where it appears in the certification hierarchy, how much of that hierarchy is exposed during the handshake, and how cryptographic burden is distributed across client and server roles. This paper presents a local experimental study of TLS 1.3 authentication strategies built on OpenSSL 3 and oqsprovider. Using a reproducible laboratory, it compares ML-DSA and SLH-DSA across multiple certificate placements, hierarchy depths, and key-exchange modes, including classical, hybrid, and pure post-quantum configurations. The clearest discontinuity appears when SLH-DSA is placed in the server leaf certificate. In that configuration, handshake latency and server-side compute cost increase by orders of magnitude, while strategies that confine SLH-DSA to upper trust layers and preserve ML-DSA in the interactive leaf remain within a substantially more plausible operational range. The results further show that transport size alone does not explain the heavy regime: once SLH-DSA reaches the leaf, server-side cryptographic cost becomes dominant. The paper argues that post-quantum TLS migration is best evaluated as a problem of certificate-hierarchy design, chain exposure, and cryptographic cost concentration during live authentication.

Related papers

• From Sparse Features to Trustworthy Proxies: Certifying SAE-Based Interpretability [53.681678236115836]
  We study when can an SAE-based explanation be treated as a faithful view of an underlying frozen LM.<n>Our framework derives an upper bound on the base model's expected risk using four measurable quantities.<n>We show that the bound becomes non-vacuous on GPT-2 Small, Gemma-2B, and Llama-3-8B at practical sample sizes.
  arXiv  Detail & Related papers  (2026-06-16T18:28:23Z)
• Operationalising Post Quantum TLS Automated Configuration Profiling and Hybrid PQC Deployment in Financial Infrastructure [20.328800137944096]
  Post quantum cryptography (PQC) standards now exist for key exchange and digital signatures.<n>The urgent question for adopters is how to operationalise PQC in complex environments with confidence.<n>This paper presents a configuration parsing methodology that automatically extracts and normalises TLS cryptographic posture.
  arXiv  Detail & Related papers  (2026-05-18T07:10:15Z)
• Observability for Post-Quantum TLS Readiness: A Multi-Surface Evidence Framework [0.0]
  Post-quantum migration in Transport Layer Security (TLS) requires evidence-aware measurements.<n>We present a multi-surface framework for post-quantum TLS observability.
  arXiv  Detail & Related papers  (2026-05-04T01:30:00Z)
• Layered Performance Analysis of TLS 1.3 Handshakes: Classical, Hybrid, and Pure Post-Quantum Key Exchange [0.0]
  We study the impact of post-quantum cryptography (PQC) algorithms on multiple layers of stateful HTTP over TLS transactions.<n>We propose a laboratory architecture that emulates a real-world setup in which a load test of up to 100 transactions per second is sent to a load balancer.<n>Each set of tests is executed using the TLS 1.3 key exchange groups as follows: traditional (or non-PQC), hybrid PQC and pure PQC.
  arXiv  Detail & Related papers  (2026-03-11T17:27:41Z)
• SAE as a Crystal Ball: Interpretable Features Predict Cross-domain Transferability of LLMs without Training [70.84726713548099]
  SAE-based Transferability Score (STS) is a new metric to forecast post-training transferability.<n>We show that STS accurately predicts the transferability of supervised fine-tuning, achieving Pearson correlation coefficients above 0.7 with actual performance changes.
  arXiv  Detail & Related papers  (2026-03-03T12:01:09Z)
• Federated Learning-Enabled Hybrid Language Models for Communication-Efficient Token Transmission [87.68447072141402]
  Hybrid Language Models (HLMs) combine the low-latency efficiency of Small Language Models (SLMs) on edge devices with the high accuracy of Large Language Models (LLMs) on centralized servers.<n>We propose FedHLM, a communication-efficient HLM framework that integrates uncertainty-aware inference with Federated Learning (FL)
  arXiv  Detail & Related papers  (2025-06-30T02:56:11Z)
• Beyond Next Token Probabilities: Learnable, Fast Detection of Hallucinations and Data Contamination on LLM Output Distributions [60.43398881149664]
  We introduce LOS-Net, a lightweight attention-based architecture trained on an efficient encoding of the LLM Output Signature.<n>It achieves superior performance across diverse benchmarks and LLMs, while maintaining extremely low detection latency.
  arXiv  Detail & Related papers  (2025-03-18T09:04:37Z)
• Misbinding Raw Public Keys to Identities in TLS [1.821556502071398]
  This paper examines the security of TLS when using Raw Public Key (RPK) authentication.<n>This mode has not been as extensively studied as X.509 certificates and Pre-Shared Keys (PSK)<n>We develop a formal model of TLS RPK using applied pi calculus and the ProVerif verification tool, revealing that the RPK mode is susceptible to identity misbinding attacks.
  arXiv  Detail & Related papers  (2024-11-14T19:28:09Z)
• An Efficient TLS 1.3 Handshake Protocol with VC Certificate Type [0.0]
  The paper presents a step forward in the design and implementation of a Transport Layer Security (TLS) handshake protocol.<n>It enables the use of Verifiable Credential (VC) while maintaining full compliance with RFC-8446 and preserving all the security features of TLS 1.3.<n>Results pave the way for the adoption of Self-Sovereign Identity in large-scale Internet of Things (IoT) systems.
  arXiv  Detail & Related papers  (2024-07-17T13:18:16Z)
• Learnable Polyphase Sampling for Shift Invariant and Equivariant Convolutional Networks [120.78155051439076]
  LPS can be trained end-to-end from data and generalizes existing handcrafted downsampling layers. We evaluate LPS on image classification and semantic segmentation.
  arXiv  Detail & Related papers  (2022-10-14T17:59:55Z)
• Transferrable Contrastive Learning for Visual Domain Adaptation [108.98041306507372]
  Transferrable Contrastive Learning (TCL) is a self-supervised learning paradigm tailored for domain adaptation. TCL penalizes cross-domain intra-class domain discrepancy between source and target through a clean and novel contrastive loss. The free lunch is, thanks to the incorporation of contrastive learning, TCL relies on a moving-averaged key encoder that naturally achieves a temporally ensembled version of pseudo labels for target data.
  arXiv  Detail & Related papers  (2021-12-14T16:23:01Z)
• Understanding Self-supervised Learning with Dual Deep Networks [74.92916579635336]
  We propose a novel framework to understand contrastive self-supervised learning (SSL) methods that employ dual pairs of deep ReLU networks. We prove that in each SGD update of SimCLR with various loss functions, the weights at each layer are updated by a emphcovariance operator. To further study what role the covariance operator plays and which features are learned in such a process, we model data generation and augmentation processes through a emphhierarchical latent tree model (HLTM)
  arXiv  Detail & Related papers  (2020-10-01T17:51:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.