Post-Quantum Cryptographic Analysis of Message Transformations Across the Network Stack

Referee: [Lattice Construction and Proof] The central claim that the composition forms a bounded lattice with join (max) for confidentiality and meet (min) for authentication requires that every per-layer primitive maps unambiguously to one of the four categories with no remainder or overlap, and that layer-to-layer transformations commute with these operations. The manuscript applies the framework to five scenarios but provides no explicit verification that the lattice axioms (associativity, absorption, bounds) hold after substituting the concrete category assignments used in those cases (e.g., WPA2-Personal vs. WPA3). This is load-bearing for the proof, as any shared key/nonce interaction or hybrid primitive could invalidate the max/min rules.

Authors: The four quantum vulnerability categories are defined in Section 3 to form a partition of all cryptographic primitives by construction, with no remainder or overlap (every operation is assigned based on its resistance properties: classical only, hybrid, PQC-only, or none). The bounded lattice structure, including the join (max) for confidentiality and meet (min) for authentication, is proven abstractly in Theorem 4.2 under the composition rules, which hold independently of specific assignments because the operators are defined on the category lattice itself. Layer-to-layer transformations are modeled as independent per the standard network stack semantics. We agree that explicit substitution of the concrete assignments from the five scenarios into the axioms was not shown in the main text. In the revision we will add an appendix containing the step-by-step verification of associativity, absorption, and bounds for each scenario's category assignments, along with a clarification that the framework assumes independent layer operations and flags shared-key or hybrid interactions as an assumption to be relaxed in future extensions. revision: partial

Referee: [Application to Five Scenarios] The finding that WPA2-Personal provides strictly better PQC posture than WPA3-Personal depends on the specific category assignments for each protocol's primitives. The manuscript does not show the step-by-step lattice computation for these cases or confirm that the assignments are exhaustive for all operations in the Linux/iOS stacks. If any operation (such as an AEAD or KEM) cannot be placed cleanly, the comparative claim does not follow.

Authors: The category assignments for the WPA variants (and the other scenarios) are given explicitly in Section 5.2 and Table 2, derived from the primitives actually used in the Linux and iOS implementations (e.g., WPA2-Personal relies on classical TKIP/CCMP while WPA3 incorporates SAE with hybrid elements). The comparative result follows directly from applying the meet and join operators to these assignments. We acknowledge that the main text does not display the intermediate lattice computations. In the revision we will insert the full step-by-step derivations for all five scenarios. Regarding exhaustiveness, the analysis covers the primary cryptographic operations at each layer (key exchange, encryption, authentication); ancillary or lower-level operations are assumed to inherit the same category. We will add an explicit scope statement noting that a complete enumeration of every possible operation in the full stacks lies outside the paper's scope and identifying this as a direction for follow-on empirical validation. revision: yes