# A Practical Implementation of Post-Quantum Cryptography for Secure Wireless Communication +
## 3 PQC-Based PKE Protocols for Using the PQC Algorithm
### PQC Standalone PKE Protocol
```
1:Input: Data to be transmitted (\(data_{c}\) from Client, \(data_{s}\) from Server)
2:Output: Securely exchanged data
3:Client (C):
4:Generate PQC KEM key pair: \((pkk_{c},skk_{c})\)
5:Generate PQC Signature key pair: \((pks_{c},sks_{c})\)
6:\(cert[pkk_{c}]\leftarrow\text{Sign}(sks_{c},pkk_{c})\)
7:Send \((cert[pkk_{c}],pks_{c},pkk_{c})\) to Server (S)
8:Server (S):
9:Generate PQC KEM key pair: \((pkk_{s},skk_{s})\)
10:Generate PQC Signature key pair: \((pks_{s},sks_{s})\)
11:\(\text{valid}_{c}\leftarrow\text{Verify}(pks_{c},cert[pkk_{c}],pkk_{c})\)
12:if\(\text{valid}_{c}=\text{TRUE}\)then
13:\((ct_{c},sk_{c})\leftarrow\text{Encapsulate}(pkk_{c})\)
14:\(cert[pkk_{s}]\leftarrow\text{Sign}(sks_{s},pkk_{s})\)
15:Send \((cert[pkk_{s}],pks_{s},pkk_{s},ct_{c})\) to Client (C)
16:else
17:Abort
18:endif
19:Client (C):
20:\(\text{valid}_{s}\leftarrow\text{Verify}(pks_{s},cert[pkk_{s}],pkk_{s})\)
21:if\(\text{valid}_{s}=\text{TRUE}\)then
22:\(s{s}_{c}^{\prime}\leftarrow\text{Decapsulate}(skk_{c},ct_{c})\)
23:\((ct_{s},ss_{s})\leftarrow\text{Encapsulate}(pkk_{s})\)
24: Send \(ct_{s}\) to Server (S)
25:\(seq_{c}\leftarrow\text{GenerateSequenceNumber}()\)
26:\(mac_{c}\leftarrow\text{HMAC-SHA256}(s{s}_{c}^{\prime}||ss_{s},\"\text{ confirmation}\"||seq_{c})\)
27: Send \(mac_{c}\) to Server (S)
28:else
29:Abort
30:endif
31:\(s{s}_{s}^{\prime}\leftarrow\text{Decapsulate}(skk_{s},ct_{s})\)
32:\(seq_{s}\leftarrow\text{GenerateSequenceNumber}()\)
33:\(mac_{s}\leftarrow\text{HMAC-SHA256}(s{s}_{c}^{\prime}||ss_{s},\"\text{ confirmation}\"||seq_{s})\)
34:if\(mac_{c}=\text{HMAC-SHA256}(s{s}_{c}||ss_{s}^{\prime},\"\text{ confirmation}\"||seq_{c})\)then
35: Send \(mac_{s}\) to Client(C)
36:else
37:Abort
38:endif
39:Client(C):
41:if\(mac_{s}=\text{HMAC-SHA256}(s{s}_{c}^{\prime}||ss_{s},\"\text{ confirmation}\"||seq_{s})\)then
42: Secure communication is established. 43:else
44:Abort
45:endif
46:Client-to-Server Data Transfer:
47:\(ct_{data_{c}}\leftarrow\text{PQC-Encrypt}(pkk_{s},data_{c}||seq_{c})\)
48:Send \(ct_{data_{c}}\) to Server (S)
49:Server (S):
50:\(data_{c}^{\prime}||seq_{c}^{\prime}\leftarrow\text{PQC-Decrypt}(skk_{s},ct_{ data_{c}})\)
51:if\(seq_{c}^{\prime}\) is valid (not replayed) then
52: Process \(data_{c}^{\prime}\)
53:else
54:Reject // Replay detected
55:endif
```  
**Algorithm 1** PQC standalone PKE protocol To ensure that both parties have derived identical shared secrets and to prevent MITM attacks, a robust key confirmation process is employed. After deriving their respective shared secrets, both parties compute message authentication codes (MACs) using \"hash-based message authentication code using the secure hash algorithm 256-bit (HMAC-SHA256)\" over a combination of their shared secrets, a predefined \"confirmation\" string, and unique sequence numbers generated independently by each party. The MACs are exchanged between the client and server. After receiving a MAC, each party verifies that it matches its locally computed MAC. If both MACs match, it confirms that no MITM attack has occurred and that both parties share identical secrets (i.e., as shown for the client and the server in Algorithm 1, lines 31-45). Once mutual confirmation is achieved, secure communication is established. The proposed protocols utilize core PQC primitives (KEMs and digital signatures) for key establishment and authentication, which is similar to the PQC-TLS/PQC-SSH handshake without the additional message negotiation steps (i.e., ClientHELLO/ServerHELLO) required in PQC-TLS. For data transfer from the client to the server, the client encrypts the data (\(data_{c}\)) along with its sequence number (\(seq_{c}\)) using the server's public KEM key (\(pkk_{s}\)). The resulting ciphertext (\(ct_{data_{c}}\)) is sent to the server (Algorithm 1, lines 46-48). The server receives and decrypts the ciphertext using its private KEM key (\(skk_{s}\)), retrieves both the data and sequence number, and checks whether the sequence number is valid (i.e., not replayed or out of order).