Pith. sign in

REVIEW 2 major objections 4 minor 34 references

Versatile Quantum-Safe Hybrid Key Exchange and Its Application to MACsec

T0 review · 2 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read VMuckle adapts the Muckle+ hybrid authenticated key exchange so a single run can use PSK, post-quantum signatures, or both, and uses this to give MACsec a quantum-safe root key.

desk verdict VMuckle is a genuinely useful HAKE variant and MACsec integration, but the security proof delegates the cases that the protocol actually changes, and the empty-PSK mode is outside Theorem 1. read the letter →

arxiv 2505.14162 v2 pith:2PFBE6CU submitted 2025-05-20 quant-ph cs.CR

Jaime S. Buruaga , Augustine Bugler , Juan P. Brito , Vicente Martin , Christoph Striecks This is my paper · ORCID
classification quant-phcs.CR
keywords macsecprotocolscryptographyquantumalreadydatahakehybrid
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

VMuckle is an authenticated key exchange for two network devices. At the start, each side creates one ephemeral public-secret pair with a classical key encapsulation mechanism and one with a post-quantum KEM; they exchange those public keys together with random nonces. Each side then combines three shared secrets: the classical KEM secret, the post-quantum KEM secret, and a secret key taken from a QKD system, by chaining pseudorandom-function calls through intermediate keys k0, k1, k2, k3. The final values feed a master secret and also traffic keys used to encrypt the rest of the handshake. Authentication is done in two tracks: the responder and initiator each send a certificate and a post-quantum signature, and each also sends a MAC tag computed from a pre-shared key. If one track is configured away with an empty psk or an empty signing key, the other must be present.
Extended reading notes

Core claim

The paper's load-bearing assertion is Theorem 1: if F is a post-quantum dual PRF, DSS and MAC are post-quantum EUF-CMA secure, KEMpq is post-quantum IND-CPA secure, psk is uniformly random, and kq is from QKD, then VMuckle is post-quantum HAKE secure under cleanness predicate cleanVM. If correct, VMuckle provides a quantum-safe authenticated key exchange supporting both PSK and post-quantum signature authentication, and can supply MACsec's MKA protocol with a secure root key while leaving the 802.1AE and 802.1X standards unchanged.

Load-bearing premise

The cleanest load-bearing premise is the reduction of VMuckle's security to the Muckle+ proof: Appendix C repeatedly states that cases 1.2 and 3.1 to 3.4 follow the proof in [18] without presenting the game transitions or demonstrating that the boxed modifications in Fig. 2, namely the classical KEM kc, the added k1/k2 chain, and the PSK-MAC authentication track, preserve those advantages. A second fragile premise is Theorem 1's assumption that psk is uniformly random, while the protocol text explicitly permits an empty or known psk; the cleanness predicate cleanVM does not visibly exclude an empty-PSK mode from its no-CorruptSK branch. If either reduction fails or the empty-PSK branch is outside the theorem, the stated versatility guarantee is weaker than claimed.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes VMuckle, a hybrid authenticated key exchange (HAKE) protocol that combines a classical KEM, a post-quantum KEM, a QKD-supplied key, and authentication via either post-quantum digital signatures or a pre-shared key (or both). The protocol is designed as a drop-in replacement for the 802.1X authentication step in MACsec, feeding its output as the Master Session Key into the MKA key hierarchy without modifying the 802.1AE or 802.1X standards. The authors claim post-quantum HAKE security under a new cleanness predicate cleanVM (Theorem 1, Appendix C), with the proof largely delegated to the Muckle+ proof from [18] at several critical subcases. The paper also reports a Python/liboqs prototype and benchmarks comparing many KEM/signature combinations in terms of CPU cycles and bandwidth, and it compares VMuckle's handshake size with EAP-TLS.

Significance. If the security claim is established, VMuckle would be a valuable contribution: it is the first HAKE protocol to allow both PSK-based and signature-based authentication to be chosen flexibly while preserving a single proof framework, and the proposed MACsec integration is concrete and standards-compatible. The paper has several concrete strengths: the key schedule is explicitly specified with labeled PRF calls and a dual-PRF assumption; the protocol is instantiated with standardized NIST PQC algorithms; the prototype and benchmark tables provide useful engineering evidence; and the cleanness predicate is stated precisely enough to expose exactly which compromises are tolerated. The main unresolved issue is that the central proof, Theorem 1, is not self-contained at exactly the points where VMuckle deviates from Muckle+, and the protocol text permits an empty or known PSK mode that falls outside the theorem's uniform-random-PSK hypothesis.

major comments (2)
  1. [Appendix C, Subcases 1.2 and 3.1–3.4] The proof of Theorem 1 delegates the core reductions to [18] without presenting the game transitions, but VMuckle is not Muckle+. The boxed modifications in Fig. 2 insert a classical KEM share kc, chain it through k1 = F(kc, ℓ3||k0), then chain the QKD share kq through k2 = F(kq, ℓ4||k1), and add a PSK-MAC authentication track. Each of these insertions changes which keys are known in the adversary's view and therefore requires a re-derived hybrid argument. For example, in Subcase 3.2 (only the QKD key kq uncompromised), the adversary may know kc, k0, SecState, and all long-term keys; the reduction must prove that k2 = F(kq, ℓ4||k1) still hides the tested master secret even when k1 is known, which requires a carefully ordered dual-PRF argument that is not supplied. Likewise, Theorem 1 makes no security assumption on KEMc, so the proof must explicitly handle an adversarially known kc. Footnote 2 further states that a different cleanness predicate than [18] is used and that this gives a 'slightly tighter bound', yet no derivation is provided. Please present the missing hybrids or a formal reduction theorem with an explicit game sequence; a citation to [18] is not sufficient at these load-bearing points.
  2. [Section III and Theorem 1] The protocol specification explicitly permits an empty or known pre-shared key: Section III states 'psk may be an empty string' and 'If psk is an empty or known string, key confirmation can still be achieved via f kS'. Theorem 1, however, assumes 'psk ∈ S be a uniformly random pre-shared key'. The cleanness predicate cleanVM (Definition 11) does not exclude the empty-PSK case: condition 4 only requires that either no CorruptQK(i) or no CorruptSK(i) query was issued, and an empty PSK remains 'uncorrupted' in the sense that no CorruptSK was issued. In Subcase 1.1 (Appendix C), Game 4 replaces fC = F(psk, f kC) and fS = F(psk, f kS) with uniformly random values using a PRF challenger, justified by 'no CorruptSK queries have been issued'. If psk is empty, this replacement is invalid because F(empty, ·) is a deterministic function that the adversary can evaluate. Thus the theorem does not cover a mode that the protocol text explicitly supports. Please either restrict the proven configuration to a secret, randomly chosen PSK and state this restriction in the protocol specification, or extend the security analysis to the empty/known-PSK case by relying on the other authentication mechanism.
minor comments (4)
  1. [Appendix C, Subcase 1.2] The subcase is titled 'No CorruptQK has been issued' but the text then says 'we assume that the signing key skI is not corrupted'. Please clarify explicitly that the post-quantum long-term key used for signatures is the key covered by CorruptQK, or introduce a separate corruption identifier for the signing key, to avoid ambiguity.
  2. [Appendix C, Subcase 3.3] The text 'the proof of case 3.3 in [18] 2' contains a stray superscript '2' that appears to be a leftover footnote marker; please remove it or attach the footnote text clearly.
  3. [Tables III and IV] The table headers and footnotes are inconsistent: Table III uses '(1)' and '(2)' footnotes that are not all defined, 'Cycles (G)' is ambiguous (it is later referred to as giga cycles), and the table would benefit from stating which variants include the classical ECDH contribution and which include QKD-256 explicitly for every row group.
  4. [Definition 10 and Appendix C final derivation] Definition 10 first states HAKE security for 'any PPT adversary A' and then defines post-quantum security by requiring the same for QPT adversaries; the text should be consistent about whether the base definition also allows QPT adversaries or whether the QPT version is the only one used in Theorem 1. Also, the final advantage bound sums subcases that use different reductions with the same symbol A; please make the standard composition argument explicit, since the per-subcase adversaries and their running times are not identical.
Assumptions & free parameters 0 free parameters · 7 assumptions · 0 invented entities

No numerical parameters are fitted. The protocol borrows standard cryptographic primitives and the prior HAKE security model. The nonstandard assumptions are the uniform-PSK premise, which is in tension with the empty-PSK mode, and the transfer of Muckle+ proof cases to the modified VMuckle flow.

assumptions (7)
  • domain assumption F is a post-quantum dual PRF with R subset of S and D.
    Theorem 1 assumes this for the key schedule; it is a standard cryptographic assumption, not established for every concrete KDF.
  • domain assumption KEMpq is post-quantum IND-CPA secure.
    Theorem 1 assumes this for the post-quantum KEM component, as satisfied by candidates such as ML-KEM under module-lattice assumptions.
  • domain assumption DSS and MAC are post-quantum EUF-CMA secure.
    Theorem 1 assumes this for the two authentication tracks.
  • ad hoc to paper psk is uniformly random in S.
    Theorem 1 assumes a uniform pre-shared key, but the protocol text explicitly permits an empty or known psk; the empty-PSK mode is not covered by the theorem.
  • domain assumption kq obtained from QKD is uniformly random in S.
    Assumed via GetKeyqkd in Fig. 2; this is an ideal QKD model and practical finite-size QKD security is not treated.
  • domain assumption The HAKE security model of [18] and [19] applies to VMuckle's multi-stage sessions.
    Appendix B recalls that model, and the proof is a reduction within it.
  • ad hoc to paper The Muckle+ proof subcases transfer to VMuckle's modified protocol flow.
    Appendix C delegates subcases 1.2 and 3.1 to 3.4 to [18] without writing the game transitions for the boxed changes.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Versatile Quantum-Safe Hybrid Key Exchange and Its Application to MACsec." pith.science (2026). https://pith.science/paper/2PFBE6CU

@misc{pith2026250514162,
  author       = {Pith},
  title        = {Pith review of: Versatile Quantum-Safe Hybrid Key Exchange and Its Application to MACsec},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2PFBE6CU}},
  note         = {Machine review of arXiv:2505.14162}
}
read the original abstract

Advancements in quantum computing pose a significant threat to most of the cryptography currently deployed. Fortunately, cryptographic building blocks to mitigate the threat are already available; mostly based on post-quantum and quantum cryptography, but also on symmetric cryptography techniques. Notably, quantum-safe building blocks must be deployed as soon as possible due to the ``harvest-now decrypt-later'' attack scenario, which is already challenging our sensitive and encrypted data today. Following an agile defense-in-depth approach, Hybrid Authenticated Key Exchange (HAKE) protocols have recently been gaining significant attention. Such protocols modularly combine conventional, post-quantum, and quantum cryptography to achieve confidentiality, authenticity, and integrity guarantees for network channels. Unfortunately, only a few protocols have yet been proposed (mainly Muckle and Muckle+) with different flexibility guarantees. Looking at available standards in the network domain (especially at the Media Access Control Security (MACsec) standard), we believe that HAKE protocols could already bring strong security benefits to MACsec today. MACsec is a standard designed to secure communication at the data link layer in Ethernet networks by providing security for all traffic between adjacent entities. In addition, MACsec establishes secure channels within a Local Area Network (LAN), ensuring that data remain protected from eavesdropping, tampering, and unauthorized access, while operating transparently to higher layer protocols. Currently, MACsec does not offer enough protection in the event of cryptographically relevant quantum computers. In this work, we tackle the challenge and propose a new versatile HAKE protocol, dubbed VMuckle, which is sufficiently flexible for the use in MACsec to provide LAN participants with hybrid key material ensuring secure communication.

Figures

Figures reproduced from arXiv: 2505.14162 by the authors.

Figure 1
Figure 1. MACsec Key Agreement protocol operation in a 3-node [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. One stage of the VMuckle protocol with a classical KEM [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The key schedule of one stage of the VMuckle protocol, [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: The proposed operation for employing VMuckle as [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 29 canonical work pages

  1. [18]

    Muckle+: End-to-End Hybrid Authenticated Key Exchanges,

    S. Bruckner, S. Ramacher, and C. Striecks, “Muckle+: End-to-End Hybrid Authenticated Key Exchanges,” in Post-Quantum Cryptography, T. Johansson and D. Smith-Tone, Eds. Cham: Springer Nature Switzerland, 2023, pp. 601–633

    work page 2023

  2. [1]

    Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,

    P. W. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,” SIAM J. Comput. , vol. 26, no. 5, p. 1484–1509, October 1997. [Online]. Available: https://doi.org/10.1137/S0097539795293172

    doi:10.1137/s0097539795293172 1997

  3. [2]

    Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process,

    G. Alagic, D. Cooper, Q. Dang, T. Dang, J. M. Kelsey, J. Lichtinger, Y .-K. Liu, C. A. Miller, D. Moody, R. Peralta, R. Perlner, A. Robinson, D. Smith-Tone, and D. Apon, “Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process,” NIST IR 8413-upd1, Tech. Rep., July 2022

    work page 2022

  4. [3]

    Module-Lattice-Based Key- Encapsulation Mechanism Standard,

    N. I. of Standards and Technology, “Module-Lattice-Based Key- Encapsulation Mechanism Standard,” U.S. Department of Commerce, Washington, D.C., Tech. Rep. Federal Information Processing Standards Publications (FIPS PUBS) 203, August 2024

    work page 2024

  5. [4]

    Module-Lattice-Based Digital Signature Standard,

    ——, “Module-Lattice-Based Digital Signature Standard,” U.S. Depart- ment of Commerce, Washington, D.C., Tech. Rep. Federal Information Processing Standards Publications (FIPS PUBS) 204, August 2024

    work page 2024

  6. [5]

    Stateless Hash-Based Digital Signature Standard,

    ——, “Stateless Hash-Based Digital Signature Standard,” U.S. Depart- ment of Commerce, Washington, D.C., Tech. Rep. Federal Information Processing Standards Publications (FIPS PUBS) 205, August 2024

    work page 2024

  7. [6]

    Quantum cryptography,

    N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. , vol. 74, pp. 145–195, Mar 2002. [Online]. Available: https://link.aps.org/doi/10.1103/RevModPhys.74. 145

    doi:10.1103/revmodphys.74 2002

  8. [7]

    Post-quantum cryptography—dealing with the fallout of physics success,

    D. J. Bernstein and T. Lange, “Post-quantum cryptography—dealing with the fallout of physics success,” Cryptology ePrint Archive, Paper 2017/314, 2017. [Online]. Available: https://eprint.iacr.org/2017/314

    work page 2017

Show all 34 references
  1. [8]

    The security of practical quantum key distribution,

    V . Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Rev. Mod. Phys. , vol. 81, pp. 1301–1350, Sep 2009. [Online]. Available: https://link.aps.org/doi/10.1103/RevModPhys.81. 1301

    2009 doi

  2. [9]

    Quantum- Resistant MACsec and IPsec for Virtual Private Networks,

    S.-L. Gazdag, S. Grundner-Culemann, T. Heider, D. Herzinger, F. Schärtl, J. Y . Cho, T. Guggemos, and D. Loebenberger, “Quantum- Resistant MACsec and IPsec for Virtual Private Networks,” in Security Standardisation Research , F. Günther and J. Hesse, Eds. Cham: Springer Nature...

    2023

  3. [10]

    Quantum-safe integration of tls in sdn networks,

    J. S. Buruaga, R. B. Méndez, J. P. Brito, and V . Martin, “Quantum-safe integration of tls in sdn networks,” 2025

    2025

  4. [11]

    A survey and comparison of post-quantum and quantum blockchains,

    Z. Yang, H. Alfauri, B. Farkiani, R. Jain, R. D. Pietro, and A. Erbad, “A survey and comparison of post-quantum and quantum blockchains,” IEEE Communications Surveys & Tutorials , vol. 26, no. 2, pp. 967– 1002, 2024

    2024

  5. [12]

    Decentralization using quantum blockchain: A theoretical analysis,

    Z. Yang, T. Salman, R. Jain, and R. D. Pietro, “Decentralization using quantum blockchain: A theoretical analysis,” IEEE Transactions on Quantum Engineering, vol. 3, pp. 1–16, 2022

    2022

  6. [13]

    IEEE Standard for Local and Metropolitan Area Networks-Media Access Control (MAC) Security,

    “IEEE Standard for Local and Metropolitan Area Networks-Media Access Control (MAC) Security,” IEEE Std 802.1AE-2018 (Revision of IEEE Std 802.1AE-2006) , pp. 1–239, 2018

    2018

  7. [14]

    Information technology — Open Systems Interconnection — Basic Reference Model: The Basic Model,

    “Information technology — Open Systems Interconnection — Basic Reference Model: The Basic Model,” International Organization for Standardization, Geneva, CH, Standard, 11 1994

    1994

  8. [15]

    Quantum Security Analysis of AES,

    X. Bonnetain, M. Naya-Plasencia, and A. Schrottenloher, “Quantum Security Analysis of AES,” IACR Transactions on Symmetric Cryptology, vol. 2019, no. 2, pp. 55–93, Jun. 2019. [Online]. Available: https://inria.hal.science/hal-02397049

    2019

  9. [16]

    IEEE Standard for Local and Metropolitan Area Networks-Port-Based Network Access Control,

    “IEEE Standard for Local and Metropolitan Area Networks-Port-Based Network Access Control,” IEEE Std 802.1X-2020 , 2020

    2020

  10. [17]

    Hybrid key exchange in TLS 1.3,

    D. Stebila, S. Fluhrer, and S. Gueron, “Hybrid key exchange in TLS 1.3,” Internet Engineering Task Force, Internet-Draft draft-ietf- tls-hybrid-design-11, Oct. 2024, work in Progress. [Online]. Available: https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/11/

    2024

  11. [19]

    Many a Mickle Makes a Muckle: A Framework for Provably Quantum-Secure Hybrid Key Exchange,

    B. Dowling, T. B. Hansen, and K. G. Paterson, “Many a Mickle Makes a Muckle: A Framework for Provably Quantum-Secure Hybrid Key Exchange,” in Post-Quantum Cryptography, J. Ding and J.-P. Tillich, Eds. Cham: Springer International Publishing, 2020, pp. 483–502

    2020

  12. [20]

    The European Quantum Communication Infrastructure (EuroQCI) Initiative,

    E. Comission, “The European Quantum Communication Infrastructure (EuroQCI) Initiative,” 10 2024, https://digital-strategy.ec.europa.eu/en/ policies/european-quantum-communication-infrastructure-euroqci [Ac- cessed: (29/10/2024)]

    2024

  13. [21]

    Post-quantum MACsec in Ethernet Networks,

    J. Y . Cho and A. Sergeev, “Post-quantum MACsec in Ethernet Networks,” Journal of Cyber Security and Mobility , vol. 10, no. 1, p. 161–176, Mar. 2021. [Online]. Available: https://journals. riverpublishers.com/index.php/JCSANDM/article/view/5973

    2021

  14. [22]

    Using QKD in MACsec for secure Ethernet networks,

    ——, “Using QKD in MACsec for secure Ethernet networks,” IET Quantum Communication , vol. 2, no. 3, pp. 66–73, 2021. [Online]. Available: https://ietresearch.onlinelibrary.wiley.com/doi/abs/ 10.1049/qtc2.12006

    2021 doi

  15. [23]

    A cryptographic analysis of the TLS 1.3 handshake protocol,

    B. Dowling, M. Fischlin, F. Günther, and D. Stebila, “A cryptographic analysis of the TLS 1.3 handshake protocol,” Journal of Cryptology , vol. 34, no. 4, p. 37, Oct. 2021

    2021

  16. [24]

    Post-quantum Key Exchange for the Internet and the Open Quantum Safe Project,

    D. Stebila and M. Mosca, “Post-quantum Key Exchange for the Internet and the Open Quantum Safe Project,” in Selected Areas in Cryptography – SAC 2016, R. Avanzi and H. Heys, Eds. Cham: Springer International Publishing, 2017, pp. 14–37

    2016

  17. [25]

    Quantum-safe hybrid key exchanges with kem-based authentication,

    C. Battarbee, C. Striecks, L. Perret, S. Ramacher, and K. Verhaeghe, “Quantum-safe hybrid key exchanges with kem-based authentication,”

  18. [26]

    High-Speed High-Security Signatures,

    D. J. Bernstein, N. Duif, T. Lange, P. Schwabe, and B.-Y . Yang, “High-Speed High-Security Signatures,” in Cryptographic Hardware and Embedded Systems – CHES 2011 , B. Preneel and T. Takagi, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011, pp. 124–142

    2011

  19. [27]

    The Transport Layer Security (TLS) Protocol Version 1.3,

    E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.3,” RFC 8446, ago 2018

    2018

  20. [28]

    EAP-TLS 1.3: Using the Extensible Authentication Protocol with TLS 1.3,

    J. P. Mattsson and M. Sethi, “EAP-TLS 1.3: Using the Extensible Authentication Protocol with TLS 1.3,” RFC 9190, feb 2022

    2022

  21. [29]

    MadQCI: a heterogeneous and scalable SDN-QKD network deployed in production facilities,

    V . Martin, J. P. Brito, L. Ortiz, R. B. Mendez, J. S. Buruaga, R. J. Vicente, A. Sebastián-Lombraña, D. Rincon, F. Perez, C. Sanchez, M. Peev, H. H. Brunner, F. Fung, A. Poppe, F. Fröwis, A. J. Shields, R. I. Woodward, H. Griesser, S. Roehrich, F. D. L. Iglesia, C. Abellan, M...

    2024

  22. [30]

    Symmetric and dual PRFs from standard assumptions: A generic validation of an HMAC assumption,

    M. Bellare and A. Lysyanskaya, “Symmetric and dual PRFs from standard assumptions: A generic validation of an HMAC assumption,” Cryptology ePrint Archive, Report 2015/1198, 2015, https://eprint.iacr. org/2015/1198

    2015

  23. [31]

    OCB: a block-cipher mode of operation for efficient authenticated encryption,

    P. Rogaway, M. Bellare, J. Black, and T. Krovetz, “OCB: a block-cipher mode of operation for efficient authenticated encryption,” in Proceedings of the 8th ACM Conference on Computer and Communications Security , ser. CCS ’01. New York, NY , USA: Association for Computing Mach...

    2001

  24. [32]

    Aggregate proxy signature and verifiably encrypted proxy signature,

    J. Li, K. Kim, F. Zhang, and X. Chen, “Aggregate proxy signature and verifiably encrypted proxy signature,” in Provable Security, W. Susilo, J. K. Liu, and Y . Mu, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2007, pp. 208–217

    2007

  25. [33]

    Beyond eCK: Perfect Forward Secrecy under Actor Compromise and Ephemeral-Key Reveal,

    C. Cremers and M. Feltz, “Beyond eCK: Perfect Forward Secrecy under Actor Compromise and Ephemeral-Key Reveal,” in Computer Security – ESORICS 2012 , S. Foresti, M. Yung, and F. Martinelli, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2012, pp. 734–751

    2012

  26. [2024]

    Available: https://arxiv.org/abs/2411.04030

    [Online]. Available: https://arxiv.org/abs/2411.04030

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.