标题： IPsec的混合量子安全 显示英文标题

标题： Hybrid Quantum Security for IPsec

摘要： 量子密钥分发（QKD）为对抗量子计算威胁提供了信息论安全，但由于预先分发的量子密钥与计算密钥交换范式之间存在根本性不匹配，将QKD集成到现有安全协议中仍然是一个未解决的挑战。 本文首次系统比较了IPsec中顺序与并行混合QKD-PQC密钥建立策略，揭示了超越具体实现的基本协议设计原则。 我们提出了两种新颖的方法，将QKD集成到互联网密钥交换版本2（IKEv2）中，并支持ETSI GS QKD 004有状态和ETSI GS QKD 014无状态API规范：（1）一种纯QKD方法，用基于标识符的量子密钥协调取代计算密钥推导，（2）一种统一的QKD-KEM抽象，使量子和后量子密码方法能够在现有协议框架内进行并行组合。 我们的关键见解是，并行混合方法消除了RFC 9370规定的顺序方法固有的乘法延迟惩罚，在现实网络条件下实现了显著的性能提升。 使用基于Docker的测试框架和IDQuantique QKD硬件进行的性能评估表明，在网络延迟条件下，并行混合方法显著优于顺序方法，而纯QKD通过基于标识符的密钥协调实现了最小的带宽开销。 我们的实现提供了适用于需要纵深防御安全的关键基础设施部署的实际量子增强IPsec解决方案。 显示英文摘要

摘要： Quantum Key Distribution (QKD) offers information-theoretic security against quantum computing threats, but integrating QKD into existing security protocols remains an unsolved challenge due to fundamental mismatches between pre-distributed quantum keys and computational key exchange paradigms. This paper presents the first systematic comparison of sequential versus parallel hybrid QKD-PQC key establishment strategies for IPsec, revealing fundamental protocol design principles that extend beyond specific implementations. We introduce two novel approaches for incorporating QKD into Internet Key Exchange version 2 (IKEv2) with support for both ETSI GS QKD 004 stateful and ETSI GS QKD 014 stateless API specifications: (1) a pure QKD approach that replaces computational key derivation with identifier-based quantum key coordination, and (2) a unified QKD-KEM abstraction that enables parallel composition of quantum and post-quantum cryptographic methods within existing protocol frameworks. Our key insight is that parallel hybrid approaches eliminate the multiplicative latency penalties inherent in sequential methods mandated by RFC 9370, achieving significant performance improvements under realistic network conditions. Performance evaluation using a Docker-based testing framework with IDQuantique QKD hardware demonstrates that the parallel hybrid approach significantly outperforms sequential methods under network latency conditions, while pure QKD achieves minimal bandwidth overhead through identifier-based key coordination. Our implementations provide practical quantum-enhanced IPsec solutions suitable for critical infrastructure deployments requiring defense-in-depth security.