Post-Quantum Secure Cryptography for Edge Devices on L4Re Microkernel
Version 0.2.0 | OpenSSL 3.6 FIPS Provider | ML-KEM + ML-DSA + AES-256-GCM
DOUBLE-LAYER SECURITY
====================================================================================
+------------+ +-------------------+ +-----------------------+
| DEVICE | | PQ-EDGE-GATEWAY | | PQ-PROXY |
| (Sensor) | | (L4Re Microkernel)| | (Cloudflare/Nginx) |
| | | | | |
| Sensor Data|---->| Layer 1: Payload |-------->| Layer 1: remains |
| | | ML-KEM + AES-GCM | HTTPS | encrypted |
| | | | (443) | |
| | | Layer 2: Transport| | Layer 2: TLS |
| | | TLS 1.3 + ML-KEM | | terminated |
+------------+ +-------------------+ +-----------+-----------+
|
v
+-----------------------------------------------------+
| BACKEND |
| |
| +----------+ +----------+ +------------------+ |
| | API | | ML/AI | | Database | |
| | Server | | Process. | | (encrypted) | |
| +----------+ +----------+ +------------------+ |
| |
+-----------------------------------------------------+
Why 2 Layers?
------------------------------------------------------------------------------------
Layer 2 (Transport): Protects against MITM, but proxy sees plaintext
Layer 1 (Payload): End-to-end, only backend can decrypt
=> Even compromised proxy = no data leak
The WvdS Crypto Service is a ready-to-use black box:
| Request-Type | Name | Description |
0x01 | AES_ENCRYPT | AES-256-GCM encryption |
0x02 | AES_DECRYPT | AES-256-GCM decryption |
0x10 | MLDSA_SIGN | ML-DSA signature creation |
0x11 | MLDSA_VERIFY | ML-DSA signature verification |
0x20 | MLKEM_KEYGEN | ML-KEM key pair generation |
0x21 | MLKEM_ENCAPS | ML-KEM encapsulation |
0x22 | MLKEM_DECAPS | ML-KEM decapsulation |
Support: Wolfgang van der Stille / EMSR DATA d.o.o. / DATECpro GmbH