Hybrid cryptography virtual private networks
A virtual private network (VPN) client receives data including a pre-shared key (PSK). The VPN client decrypts the data based on a short-term key pair to obtain a ciphertext. The VPN client then decrypts the ciphertext based on a short-term quantum-resistant key pair to obtain the PSK. A VPN tunnel is then established between the VPN client and a VPN server based on the PSK.
1 . A method, comprising:
receiving, by a virtual private network (VPN) client, data including a pre-shared key (PSK), wherein the data includes a ciphertext generated by encrypting the PSK using a public key of a short-term quantum-resistant key pair associated with the VPN client and then encrypting the ciphertext using a public key of a short-term key pair associated with the VPN client, wherein the VPN client is a single device, and wherein the data is received in response to a request to establish a VPN tunnel transmitted by the VPN client, and wherein the short-term key pair and the short-term quantum-resistant key pair are different from long-term public keys exchanged during a handshake process;
decrypting, by the VPN client, the data based on a short-term private key of the short-term key pair to obtain the ciphertext;
decrypting, by the VPN client, the ciphertext based on a short-term private key of the short-term quantum-resistant key pair to obtain the PSK; and
establishing the VPN tunnel between the VPN client and a VPN server using the long-term public keys and based on the PSK.
2 . The method of claim 1 , wherein in response to the request to establish the VPN tunnel received from the VPN client, the VPN server authenticates and authorizes the VPN client.
3 . The method of claim 1 , further comprising:
generating, by the VPN client, the short-term key pair based on an elliptic-curve Diffie-Hellman (ECDH) algorithm.
4 . The method of claim 1 , further comprising:
generating the short-term quantum-resistant key pair based on a Kyber algorithm.
5 . The method of claim 1 , further comprising:
selecting, by the VPN client with the VPN server, a tunnel protocol from a set comprising Open VPN, Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol with IPSec (L2TP/IPSec), Point-to-Point Tunneling Protocol (PPTP), Secure Socket Tunneling Protocol (SSTP), and WireGuard.
6 . The method of claim 1 , further comprising:
using, by the VPN client, the PSK to encrypt subsequent communications after the VPN tunnel is established.
7 . The method of claim 1 , wherein the short-term key pair uses lattice-based cryptography.
8 . A system, comprising:
a virtual private network (VPN) client that is a single device, the VPN client configured to execute instructions to:
receive, from a VPN server, data including a pre-shared key (PSK), wherein the data includes a ciphertext generated by encrypting the PSK using a public key of a short-term quantum-resistant key pair associated with the VPN client and then encrypting the ciphertext using a public key of a short-term key pair associated with the VPN client, wherein the data is received in response to a request to establish a VPN tunnel transmitted by the VPN client, and wherein the short-term key pair and the short-term quantum-resistant key pair are different from long-term public keys exchanged during a handshake process;
decrypt the data based on a short-term private key of the short-term key pair to obtain the ciphertext;
decrypt the ciphertext based on a short-term private key of the short-term quantum-resistant key pair to obtain the PSK; and
establish the VPN tunnel between the VPN client and the VPN server based on the PSK; and
the VPN server, the VPN server configured to execute instructions to:
transmit the data including the PSK to the VPN client.
9 . The system of claim 8 , wherein the short-term key pair is generated using an elliptic-curve Diffie-Hellman (ECDH) algorithm.
10 . The system of claim 8 , wherein the VPN server is further configured to execute instructions to:
authenticate and authorize the VPN client in response to the request from the VPN client to establish the VPN tunnel.
11 . The system of claim 8 , wherein the VPN server is further configured to execute instructions to:
encrypt the PSK based on the short-term quantum-resistant key pair to obtain the ciphertext; and
encrypt the ciphertext based on the short-term key pair to obtain the data.
12 . The system of claim 8 , wherein the short-term quantum-resistant key pair is generated using a Kyber algorithm.
13 . The system of claim 8 , wherein the VPN client and the VPN server are further configured to execute respective instructions to select a tunnel protocol from a set comprising OpenVPN, Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol with IPSec (L2TP/IPSec), Point-to-Point Tunneling Protocol (PPTP), Secure Socket Tunneling Protocol (SSTP), and WireGuard.
14 . A non-transitory computer-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations comprising:
receiving, by a virtual private network (VPN) client, data including a pre-shared key (PSK), wherein the data includes a ciphertext generated by encrypting the PSK using a public key of a short-term quantum-resistant key pair associated with the VPN client and then encrypting the ciphertext using a public key of a short-term key pair associated with the VPN client, wherein the VPN client is a single device, and wherein the data is received in response to a request to establish a VPN tunnel transmitted by the VPN client, and wherein the short-term key pair and the short-term quantum-resistant key pair are different from long-term public keys exchanged during a handshake process;
decrypting, by the VPN client, the data based on a short-term private key of the short-term key pair to obtain the ciphertext;
decrypting, by the VPN client, the ciphertext based on a short-term private key of the short-term quantum-resistant key pair to obtain the PSK; and
establishing the VPN tunnel between the VPN client and a VPN server using the long-term public keys and based on the PSK.
15 . The non-transitory computer-readable storage medium of claim 14 , wherein in response to the request to establish the VPN tunnel received from the VPN client, the VPN server authenticates and authorizes the VPN client.
16 . The non-transitory computer-readable storage medium of claim 14 , wherein the short-term key pair is generated using an elliptic-curve Diffie-Hellman (ECDH) algorithm.
17 . The non-transitory computer-readable storage medium of claim 14 , wherein the short-term quantum-resistant key pair is generated using a Kyber algorithm.
18 . The non-transitory computer-readable storage medium of claim 14 , further comprising:
selecting, by the VPN client with the VPN server, a tunnel protocol from a set comprising OpenVPN, Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol with IPSec (L2TP/IPSec), Point-to-Point Tunneling Protocol (PPTP), Secure Socket Tunneling Protocol (SSTP), and WireGuard.
19 . The non-transitory computer-readable storage medium of claim 14 , wherein the PSK is used to encrypt subsequent communications after the VPN tunnel is established.
20 . The non-transitory computer-readable storage medium of claim 14 , wherein the short-term key pair uses lattice-based cryptography.