Session Key Research Articles

Probabilistic shaping probability distribution scrambling based on a chaotic system for integrating secure transmission and adaptive key updating

A probabilistic shaping probability distribution scramble (PSPDS) scheme based on chaotic systems is proposed to fulfill both secure transmission and adaptive key updating. The chaotic Chen and logistic systems are adopted to generate a chaotic random sequence. The probabilistic shaping is achieved by constant composition distribution matching (CCDM) and probabilistic amplitude shaping architecture. The chaotic, random sequences are used to scramble the probability distribution of CCDM, improving security. The session key is embedded into a probability distribution. The legal receiver extracts the error-free session key when OSNR is higher than the requirement of the forward error correction threshold. We employ a coherent OFDM 16QAM transmission experiment on 120 km fiber, confirming our proposed scheme with a net rate of 9.95 Gbit/s. The results show that the PSPDS scheme has no encryption penalty compared with the baseline without encryption. The key updating rate has the ability to vary adaptively and reaches 224.2 Mbit/s by adjusting the block length of CCDM in our experiment. The key space reaches 10136. Even if an illegal party obtains a ciphertext signal, the plaintext and session key can hardly be inferred due to a probability distribution scramble.

Lightweight Mutually Authenticated Key Exchange with Physical Unclonable Functions

Authenticated key exchange is desired in scenarios where two participants must exchange sensitive information over an untrusted channel but do not trust each other at the outset of the exchange. As a unique hardware-based random oracle, physical unclonable functions (PUFs) can embed cryptographic hardness and binding properties needed for a secure, interactive authentication system. In this paper, we propose a lightweight protocol, termed PUF-MAKE, to achieve bilateral mutual authentication between two untrusted parties with the help of a trusted server and secure physical devices. At the end of the protocol, both parties are authenticated and possess a shared session key that they can use to encrypt sensitive information over an untrusted channel. The PUF’s underlying entropy hardness characteristics and the key-encryption-key (KEK) primitive act as the root of trust in the protocol’s construction. Other salient properties include a lightweight construction with minimal information stored on each device, a key refresh mechanism to ensure a fresh key is used for every authentication, and robustness against a wide range of attacks. We evaluate the protocol on a set of three FPGAs and a desktop server, with the computational complexity calculated as a function of primitive operations. A composable security model is proposed and analyzed considering a powerful adversary in control of all communications channels. In particular, session key confidentiality is proven through formal verification of the protocol under strong attacker (Dolev-Yao) assumptions, rendering it viable for high-security applications such as digital currency.

Combining Semi-Tensor Product Compressed Sensing and Session Keys for Low-Cost Encryption of Batch Information in WBANs

Combining Semi-Tensor Product Compressed Sensing and Session Keys for Low-Cost Encryption of Batch Information in WBANs

Generating Boolean lattices with few elements and exchanging session keys

Generating Boolean lattices with few elements and exchanging session keys

Secure device authentication and key agreement mechanism for LoRaWAN based IoT networks

SummaryThe proposed work introduces two schemes for secure device authentication and key agreement (SDA & KA) mechanisms. Initially, an efficient implicit certificate approach based on the Elliptic curve Qu–Vanstone (EIC‐EcQuV) scheme is developed in the first stage to instantly concur on the session key. The proposed scheme implicitly performs quick authentication of the public key. Also, this scheme prevents the attacker from creating fake key combinations. Through EIC‐EcQuV, the implicit certificate (IC) is distributed which helps to implicitly authenticate the user. This work also proposes ithe developed Public Key Certificateless Cryptosystem (PKCIC) scheme in the second stage, whch was also for the SDA & KA mechanism. In the EIC‐EcQuV scheme, efficient authentication is enabled, but public key theft is possible. However, in the PKCIC scheme, authentication is performed through partial keys, and the public key is secured via the Schnorr signature. The efficiency of the proposed schemes is proved by comparing the attained results with previous schemes. The proposed method obtains the computational cost of 0.0583 s for end‐to‐end devices, 0.06111 for network servers, and 0.00071 s for the gateway, with an execution time of 78.624 for 1000 devices. The attained key agreement of the proposed EIC‐EcQuV is 0.953 s, and PKCIC is 0.9988 s.

A network security protection scheme for tax system based on elliptic curve cryptography

With the rapid development of modern information technology and network technology, the construction of tax informatization plays an important role in improving the level of tax management and work efficiency. However, in the centralized data processing mode, the establishment of large data center and the efficient, stable, and secure connection of server bandwidth have become key challenges. Moreover, the openness and interconnectivity of the tax system network pose various network security threats, seriously threatening the integrity and security of data. For the above issues, this article proposes a tax system network security protection scheme based on elliptic curve cryptography. This scheme combines hash function and elliptic curve cryptography to achieve user anonymity and secure generation of session keys, effectively ensuring the secure transmission of confidential information. The security and effectiveness of the scheme are verified through informal and formal security analysis based on security proof, BAN logic and AVISPA tool. And a comprehensive evaluation of the scheme is conducted, and the results show that the scheme significantly reduced the costs while providing security features.

An Efficient Cryptographic Scheme based on Optimized Watermarking Scheme for Securing Internet of Things

In this work, a new efficient cryptographic scheme based on the concept of chaotic map and optimized watermarking scheme is proposed. In the optimized watermarking scheme, a combination of discrete wave transformation (DWT), hessenberg decomposition (HD), and singular value decomposition (SVD) are used. In this, the host image is first broken down into several sub-bands using multi-level DWT, and the resulting coefficients are then fed into HD during the embedding phase. Simultaneous watermark operation is performed on SVD. Finally, the scale factor embeds the watermark into the host image. The Differential evolution method is used to find the best scaling factor for the optimized watermarking scheme. The resulting watermarked image is then encrypted by the session key based scheme. In this scheme for each image encryption, a new random session key will be produced. The presented approach uses 64-bit plaintext and a variable size key that will be decided at the time of encryption for encrypting an image. Since session keys change with each transmission, this approach does not involve extracting and remembering session keys in order to produce subsequent session keys. IoT devices are used to test the developed method for security. The experiment’s findings shows that the suggested method works better than the current scheme in several aspects.

Evaluating cryptographic vulnerabilities created by quantum computing in industrial control systems

AbstractQuantum computing is expected to eventually be able to break the public‐key cryptography algorithms currently used throughout information technology (IT) infrastructure, undermining foundational tools used to maintain information security across the country's critical infrastructure. As these systems converge, the security posture of operational technology (OT) systems has to adapt to a new threat landscape and adopt some of the same security controls as those used in enterprise IT, especially cryptographic controls that rely on public‐key cryptography, which are ubiquitous in enterprise IT systems. Operators and manufacturers of industrial control systems (ICSs) and OT systems will need to understand and address the unique ways in which these systems will be vulnerable to adversaries equipped with quantum computers. We assessed quantum computing–facilitated cryptographic vulnerabilities in ICSs and OT systems to identify the issues in need of the most‐urgent attention from ICS and OT owners, operators, and manufacturers. Employing a modified consequence‐driven, cyber‐informed engineering process informed by literature review and analysis, we mapped protocols using or enabling cryptographic protections across common ICS network topologies as part of an assessment of how an attacker could cause harm, especially damaging physical consequences resulting from manipulation of cyber–physical systems, through the cryptographic compromise of ICS and OT networks and components. Our evaluation of identified and ranked risks to related control systems was also informed by relevant literature on ICS risk assessment and mitigation, cyber harms, and historical attacks on critical infrastructure. Using our analysis, we assessed the overall difficulty in mitigating risk from each of the identified vulnerability archetypes. The resulting analysis identified vulnerabilities associated with code‐signing processes as the highest priority for attention when updating systems for a postquantum future. This risk was followed by vulnerabilities associated with forged certificates for identification and vulnerabilities associated with forged session keys, identified as lower priorities but still of concern. Informed by our findings, we offer recommendations related to the protection of these vulnerabilities and the improvement of ICS security in developed systems.

Telecardiology in “New Normal” COVID-19: Efficacy of Neuro-Metaheuristic Session Key (NMSK) and Encryption Through Bipartite New State-of-Art Sharing

Telecardiology in “New Normal” COVID-19: Efficacy of Neuro-Metaheuristic Session Key (NMSK) and Encryption Through Bipartite New State-of-Art Sharing

Security authentication scheme based on chebyshev chaotic mapping for library network

With the rapid advancement of information technology, the security of digital libraries, as critical platforms for modern knowledge dissemination, has become increasingly significant. User identity authentication in digital libraries is pivotal to ensuring system security. Traditional authentication methods often have security vulnerabilities and cannot effectively prevent unauthorized access. Therefore, this paper proposes a security authentication scheme based on chebyshev chaotic mapping for library. It addresses security issues in identity authentication in digital libraries. The proposed scheme integrates smart card, password and biometric factor, leveraging the chebyshev chaotic mapping algorithm to achieve stringent user authentication and generate secure session keys, thereby effectively countering security threats. Additionally, the scheme employs physical unclonable function (PUF) to enhance the protection of stored confidential data. The security of this scheme is rigorously analyzed using the Scyther. Security analysis and performance experiments indicate that the scheme not only ensures security but also optimizes authentication efficiency.

Authentication communication by using visualization cryptography for UAV networks

Utilizing unmanned aerial vehicles (UAVs) to support V2X requirements leverages their versatility and line-of-sight communication. Our prior work explored a multi-agent learning approach for resource optimization, maximizing task offloading while maintaining QoS. This paper focuses on securing UAV communication, particularly authentication. Traditional methods are often unsuitable due to UAV limitations. We propose a novel authentication mechanism for a single ground control station (GCS) interacting with multiple UAVs across flight sessions. The system utilizes a key generation method based on chaotic maps to create unique flight session keys for each pre-defined flight plan. These keys, along with flight plans, are registered in a secure database. During flight, the GCS verifies UAV identity by employing the flight session key and corresponding flight plan for message authentication. This approach reduces computational and communication overhead compared to traditional certificate exchanges and asymmetric cryptography, which are energy-intensive for UAVs. While not a comprehensive security solution, this method provides an initial layer of protection for the UAV network.

Understanding the security failures of four user authentication schemes for wireless sensor networks in IoT environment

User authentication protocols are applied to provide a secure conversation between participating entities in wireless sensor networks (WSNs). To identify how to ensure security in these schemes, it is imperative to look into the security vulnerabilities of these authentication mechanisms. As a part of this study, we examine the security of four 2-factor authentication schemes for WSNs (namely, Zhang and Wen, Jangirala et al., Maurya and Sastry and Singh et al.). Security verification result shows that they are all confronted by serious security weaknesses (like sensor node capture attack, exposer of session key by gateway node attack, smart card lost attack, malicious gateway node attack, and session-specific ephemeral information loss attack) and lack of important security functionalities (like multi-factor security, perfect forward secrecy, user anonymity and untraceability, and session key security). This research concentrates on the ‘root cause of the problem. This will help in the research and development of reliable and efficient user authentication mechanisms for WSNs. Our research results point out some new challenges in building reliable multi-factor mechanisms of user authentication for WSNs. We additionally identify some significant insights from the cryptanalysis results of these mechanisms.

SLAKA-IoD: A Secure and Lightweight Authentication and Key Agreement Protocol for Internet of Drones

The existing authentication and key agreement (AKA) schemes for the internet of drones (IoD) still suffer from various security attacks and fail to ensure required security properties. Moreover, drones generally have limited memory and computation capability. Motivated by these issues, a secure and lightweight AKA protocol for IoD (SLAKA-IoD) is proposed based on physical unclonable function (PUF), “exclusive or” (XOR) operation and hash function, which are simple cryptographic operations and functions that can provide better performance. In the SLAKA-IoD protocol, a drone and the ground station (GS) perform mutual authentication and establish a secure session key between them, and any two drones can also perform mutual authentication and establish a secure session key between them. Via informal security analysis, formal security analysis using the strand space model, and security verification based on the Scyther tool, the SLAKA-IoD protocol is proven to resist various security attacks and ensure required security properties. Further comparative analysis shows that the SLAKA-IoD protocol can provide more security features, and is generally lightweight as compared with these related AKA protocols for IoD, so it is suitable for IoD.

2FAKA-C/S: A Robust Two-Factor Authentication and Key Agreement Protocol for C/S Data Transmission in Federated Learning

As a hot technology trend, the federated learning (FL) cleverly combines data utilization and privacy protection by processing data locally on the client and only sharing model parameters with the server, embodying an efficient and secure collaborative learning model between clients and aggregated Servers. During the process of uploading parameters in FL models, there is susceptibility to unauthorized access threats, which can result in training data leakage. To ensure data security during transmission, the Authentication and Key Agreement (AKA) protocols are proposed to authenticate legitimate users and safeguard training data. However, existing AKA protocols for client–server (C/S) architecture show security deficiencies, such as lack of user anonymity and susceptibility to password guessing attacks. In this paper, we propose a robust 2FAKA-C/S protocol based on ECC and Hash-chain technology. Our security analysis shows that the proposed protocol ensures the session keys are semantically secure and can effectively resist various attacks. The performance analysis indicates that the proposed protocol achieves a total running time of 62.644 ms and requires only 800 bits of communication overhead, showing superior computational efficiency and lower communication costs compared to existing protocols. In conclusion, the proposed protocol securely protects the training parameters in a federated learning environment and provides a reliable guarantee for data transmission.

TOPAS\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {TOPAS}$$\\end{document}2-pass key exchange with full perfect forward secrecy and optimal communication complexity

We present Transmission optimal protocol with active security (TOPAS\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {TOPAS}$$\\end{document}), the first key agreement protocol with optimal communication complexity (message size and number of rounds) that provides security against fully active adversaries. The size of the protocol messages and the computational costs to generate them are comparable to the basic Diffie-Hellman protocol over elliptic curves (which is well-known to only provide security against passive adversaries). Session keys are indistinguishable from random keys—even under reflection and key compromise impersonation attacks. What makes TOPAS\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {TOPAS}$$\\end{document}stand out is that it also features a security proof of full perfect forward secrecy (PFS), where the attacker can actively modify messages sent to or from the test-session. The proof of full PFS relies on two new extraction-based security assumptions. It is well-known that existing implicitly-authenticated 2-message protocols like HMQV\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {HMQV}$$\\end{document}cannot achieve this strong form of (full) security against active attackers (Krawczyk, Crypto’05). This makes TOPAS\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {TOPAS}$$\\end{document}the first key agreement protocol with full security against active attackers that works in prime-order groups while having optimal message size. We also present a variant of our protocol, TOPAS+\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {TOPAS+}$$\\end{document}, which, under the Strong Diffie-Hellman assumption, provides better computational efficiency in the key derivation phase. Finally, we present a third protocol termed FACTAS\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {FACTAS}$$\\end{document}(for factoring-based protocol with active security) which has the same strong security properties as TOPAS\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {TOPAS}$$\\end{document}and TOPAS+\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\ extsf {TOPAS+}$$\\end{document}but whose security is solely based on the factoring assumption in groups of composite order (except for the proof of full PFS).

Quantum-attack-resilience OTP-based multi-factor mutual authentication and session key agreement scheme for mobile users

Due to rapid advancements in hardware and mobile communication technologies, the usage of various mobile-based online applications is increasing tremendously. However, security and privacy are two of the most essential features of wireless communication. Using a Mutual Authentication and Session Key Agreement (MASK) scheme, an authorized mobile user can login to a remote server over the Internet. In quantum contexts, many of the MASK schemes are not secure. This paper proposes a One-Time Password (OTP) and biometric-based Multi-Factor MASK (OTP-MF-MASK) scheme for mobile users. We used Peikert’s authentication and reconciliation mechanism, defined for the post-quantum environments. The OTP-MF-MASK scheme used a password, mobile device, biometric, and OTP as login credentials. To avoid the biometric acquisition problem, we used the fuzzy extractor in the OTP-MF-MASK scheme. We proved that the OTP-MF-MASK scheme is semantically secure in the Random Oracle Model (ROM) based on the hardness assumption of the Ring Learning With Errors (RLWE) problem. The OTP-MF-MASK scheme is compared with state-of-the-art schemes to justify the attack-resilience and computation efficiencies in quantum environments.

Secured lightweight authentication for 6LoWPANs in machine-to-machine communications

The development of machine-to-machine (M2M) technologies is becoming increasingly important in the rapidly growing domain of wireless sensor networks (WSNs) and the Internet of Things (IoT). Adopting IPv6 over 6LoWPANs (Low-Power Wireless Personal Area Networks) is instrumental in communicating across diverse domains within WSNs, albeit with its challenges. Particularly, resource limitations and security vulnerabilities remain significant concerns. 6LoWPAN-based M2M protocols that rely on authentication and key establishment schemes (AKE) often fall short due to inadequate security issues and excessive resource requirements. This paper addresses these challenges by introducing a secure and resource-efficient framework—Lightweight AKE for 6LoWPAN Nodes (LAKE-6LN). LAKE-6LN capitalizes on the clustering architecture's merits and contrasts conventional router-centric approaches. To ensure lightweight and efficient operation, it uses hash functions, XOR functions, and symmetric encryption techniques. Pseudo-identity, sequence tracking numbers, and secure parameters ensure privacy and protection against attacks, including traceability, perfect forward secrecy, ephemeral secret leakage, and secure the session key. An informal analysis of LAKE-6LN's security confirms that compliance with all essential security properties has been achieved. In addition, the framework's logical robustness and security analysis are rigorously verified using BAN logic, AVISPA, and Scyther tools. LAKE-6LN has demonstrated superior performance over related schemes, demonstrating a reduction in storage costs (by 33.33 % to 85.71 %), computational overhead (by 14.28 % to 95.97 %), communication overhead (by 16.12 % to 51.85 %), and energy consumption (by 22.04 % to 99.40 %). In our comparative analysis, LAKE-6LN demonstrates its resilience against various security threats, demonstrating its potential to secure 6LoWPAN networks in M2M.

Secure-by-Design Real-Time Internet of Medical Things Architecture: e-Health Population Monitoring (RTPM)

The healthcare sector has undergone a profound transformation, owing to the influential role played by Internet of Medical Things (IoMT) technology. However, there are substantial concerns over these devices’ security and privacy-preserving mechanisms. The current literature on IoMT tends to focus on specific security features, rather than wholistic security concerning Confidentiality, Integrity, and Availability (CIA Triad), and the solutions are generally simulated and not tested in a real-world network. The proposed innovative solution is known as Secure-by-Design Real-Time IoMT Architecture for e-Health Population Monitoring (RTPM) and it can manage keys at both ends (IoMT device and IoMT server) to maintain high privacy standards and trust during the monitoring process and enable the IoMT devices to run safely and independently even if the server is compromised. However, the session keys are controlled by the trusted IoMT server to lighten the IoMT devices’ overheads, and the session keys are securely exchanged between the client system and the monitoring server. The proposed RTPM focuses on addressing the major security requirements for an IoMT system, i.e., the CIA Triad, and conducts device authentication, protects from Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks, and prevents non-repudiation attacks in real time. A self-healing solution during the network failure of live e-health monitoring is also incorporated in RTPM. The robustness and stress of the system are tested with different data types and by capturing live network traffic. The system’s performance is analysed using different security algorithms with different key sizes of RSA (1024 to 8192 bits), AES (128 to 256 bits), and SHA (256 bits) to support a resource-constraint-powered system when integrating with resource-demanding secure parameters and features. In the future, other security features like intrusion detection and prevention and the user’s experience and trust level of such a system will be tested.

An identity authentication and key agreement protocol for the internet of vehicles based on trusted cloud-edge-terminal architecture

The continuous progression in cloud computing, edge computing, and associated technologies has notably hastened the progress of vehicle networking technology. This advancement is increasingly assuming a crucial role in enhancing driving safety, optimizing traffic management, and revolutionizing traffic control methodologies. The principal aim of Internet of Vehicles (IoV) technology is to establish a secure, convenient, and efficient novel driving paradigm, enabling intelligent transportation through wireless communication connecting roadside units and vehicles. Nevertheless, this wireless communication method is susceptible to potential attacks, including remote control, information monitoring, and identity simulation. Given this situation, effective authentication is required to address this security concern. Thus, this study proposes an identity authentication and key negotiation protocol grounded in a trusted cloud-edge-terminal architecture. This protocol facilitates mutual authentication, generates secure session keys for communication, guarantees the security of vehicle communication, and supports functionalities including privacy protection and password alteration for vehicle users. Time tree technology is employed for managing the edge nodes, facilitating the sharing of vehicle certification information among these nodes, and enhancing certification efficiency. Formal security analysis and informal security analysis are conducted to demonstrate the security of the proposed protocol, evaluating its security and practicality. Theoretical comparisons and experimental results demonstrate the outstanding computational and communication performance of the proposed protocol.

[formula omitted]: Isogeny-based Secret Handshakes with friendly communication costs

Secret handshake schemes allow members from the same organization to authenticate each other anonymously. After its proposal, various schemes have been introduced to achieve advanced privacy protection. Regrettably, all the schemes based on number theoretic assumptions are insecure under quantum computers, and the known post-quantum designs are impractical because of the overhead cost (> 10 MB). To fill the gap, we present the first isogeny-based secret handshake scheme (i.e., ISH) with a friendly communication cost (67 KB). In particular, we apply the CSI-FiSh signature scheme to generate group keys and credentials. For each zero-knowledge transcript in the credential, we generate a signature for handshake via the Fiat–Shamir paradigm, while it fails anonymous authentication. To fix the issue, we modify the Fiat–Shamir-type signature by embedding the CSIDH ephemeral private key into the challenge space. After verifying the modified signatures, two users recover the right ephemeral private key if they are in the same group, then they can negotiate a session key and authenticate each other. Our scheme is proved secure under the Group Action Inverse Problems (GAIP) in the random oracle model, and deniability, as an attractive property, also holds for ISH, enabling user’s ability to deny their interactions in the finished handshakes. Via choosing appropriate parameters, the communication cost surpasses all the existing post-quantum secret handshakes.