# Post-Quantum Migration of the Tor Application
## 2 Literature Review
### Schemes
#### 2.2.1 Key Exchange  
For key exchange, Tor almost always uses X25519 (Tables 1 and 11). It is known for its efficiency and is used in multiple PQC hybrid instantiations [22; 28]. The work of [PERSON] et al. [11] is also a hybridisation of X25519 with ntrues443 ep1 and HKDF-SHA256. In proposal #269 [5], a hybrid handshake alternative, it mainly differs from notr in the computation of the authentication tag and key derivation. Two lattice-based schemes have been instantiated as examples in the proposal:  
* NTRUE KEM with the EESS443 EP2-specific parameter set, estimated at 128-bit security for both traditional and quantum-resistant settings. The design declares the maximum \begin{table}
\begin{tabular}{l l l l l} \hline
**Layer** & **Protocol/ Venus** & **Solware** & **Sensitivity Category** & **Rule** \\ \hline \multirow{4}{*}{Credit-channel} & \multirow{2}{*}{after} & BIAC-SHA256 & 2 & Mongege integrity in health, authenticity \\  & & HKDF & 2 Key distribution from shared secret \\  & & EESS5519 & unsurie & Eddy identity verification \\  & & euro 3-and G5-S5-26 & 2 & happing, authenticity of weapons \\  & & SHA28-256 & 4 & Keying initial generation with randomness \\  & & AR1-256-17 & 1 & Measure current cryptographic key-database \\  & & X25519 & unsurie & Key agreement \\ \hline \multirow{4}{*}{Ralty} & \multirow{4}{*}{Standard-driven} & SUL-256 & unsurie & Call based integrity check (binary based secret) \\  & & SUL-256-17 & 1 & Call based integrity check \\  & & EESS5619 & unsurie & Safety verification and key signing \\  & OS-3 & SUL-256-17 & 5 & Energetic for the integrity and integrity validation validation \\  & & EESS5619 & unsurie & 1,0000-1000 \\  & & Directory authenticity & SUL-256 & 2 & Keying initials \\  & & RSA2018-032 & unsurie & Uniteity based of consumer documents and descriptors \\ \hline \multirow{4}{*}{Link} & TS 1.2 & RSA2018 & unsurie & Uniteity based integrity verification \\  & & DHE & unsurie & Fundamental key exchange with licensed secrecy \\  & TS 1.3 & AR2018 & 1 & Channel encryption (e.g., AS-SCSC, Ch Chock20-Jy105, having both in integrity checks \\  & All & SUL-256-17 & unsurie & Response integrity, authenticity, key information \\  & & ECDHE & unsurie & Equipment key exchange with licensed secrecy \\  & & N-309 & unsurie & Certificate bond identity and link verification \\ \hline \end{tabular}
\end{table} 
Table 1: Cryptography schemes of Tor’s main layers. For clarity, the “directory authorities” section is presented within the relay layer; however, it may be more appropriately classified as a distinct category. For further specifications, refer to Figure 11.  
message size as \(m=49\) bytes, the KEM public key length as \(|PK|=615\) bytes, and a KEM ciphertext size of \(|CT|=610\) bytes. * NewHope KEM is declared with \(|PK|=1824\) and \(|CT|=2048\). The chosen NTRU parameter EESS443 EP2 is interesting as it proposes relatively small keys; [PERSON] et al. [29] showed the performance of the EES parameters in constrained devices. Yet, according to [PERSON] et al. [30], this classic NTRU parameter falls under a category vulnerable to automorphism-based exploits and other attacks such as lattice reduction. In contrast, NTRU Prime is still of interest from a security point of view, achieving IND-CCA2; it is a third-round NIST candidate with its \"Streamlined\" and \"LPRime\" variants. The preferred parameter is Streamlined, sntrup761, as a balance of performance and security; it approximately achieves NIST category two post-quantum security with an estimation of \(2^{153}\) based on the Core-SVP. Another KEM scheme that was not selected for standardisation by NIST in 2022 is FrodoKEM. For randomness generation, its main implementations rely either on AES-CTR or SHAKE XOF, with the latter offering better performance across a broader range of hardware types, as demonstrated by [PERSON] et al. [31]. FrodoKEMs claimed categories 1, 3, and 5 of NIST PQC security according to the given parameters; FrodoKEM-640 targets the first level and FrodoKEM-976 the third.