Post Quantum Migration for OT Security: An Exploratory Study in PQ-PUFbased Device Authentication for CPS & IoT

Post Quantum Migration for OT Security: An Exploratory Study in PQ-PUFbased Device Authentication for CPS & IoT | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Post Quantum Migration for OT Security: An Exploratory Study in PQ-PUFbased Device Authentication for CPS & IoT Kashif Rahim, Hassaan Qureshi, Anjum Ashraaf, Qasim Ali This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8304255/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 8 You are reading this latest preprint version Abstract The possible risk of Quantum attacks on the communication security of Cyber Physical Systems (CPS) and Internet of Things (IoT) emphasizes the necessity for proactive actions. The ongoing efforts of the US National Institute of Standards and Technology (NIST) to standardize quantum-resistant algorithms play a vital role in integrating security measures. Our research delves into the practical implications of migrating to Post-Quantum (PQ) algorithms in authentication schemes. We propose a novel Physical Unclonable Functions (PUF) based device authentication mechanism with the adoption of PQ algorithms to perform sensitive interactions in real-time. Moreover, we focus on resource-constrained implementation and performance analysis of quantum algorithms for achieving crypto agility. The results provide insight into the real-world use of NIST PQ algorithms and highlight the temporal complexities of key pair generation, encryption and decryption processes with the integration of PUF based device authentication measures. We have identified that in our proposed PQ-PUF based authentication scheme, DILITHIUM5 with SHA3-512 has performed significantly better than RSA1024 with SHA2-256 during the stages of central registration and verification. The results also shed light on the sizes of plaintext, ciphertext, and public and private keys, which will be important factors in resource-constrained implementations. Post Quantum Cryptography Cyber Physical System Blockchain Security Authentication Schemes Crypto Agility Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Reviews received at journal 11 Feb, 2026 Reviewers agreed at journal 27 Dec, 2025 Reviewers agreed at journal 27 Dec, 2025 Reviewers agreed at journal 26 Dec, 2025 Reviewers invited by journal 26 Dec, 2025 Editor assigned by journal 26 Dec, 2025 Submission checks completed at journal 14 Dec, 2025 First submitted to journal 08 Dec, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8304255","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":556747241,"identity":"501323d6-afd8-46fb-a5e8-7c293898159f","order_by":0,"name":"Kashif Rahim","email":"","orcid":"","institution":"National University of Sciences and Technology","correspondingAuthor":false,"prefix":"","firstName":"Kashif","middleName":"","lastName":"Rahim","suffix":""},{"id":556747242,"identity":"cb224c8f-c2ca-44df-a427-c0f4240fa34e","order_by":1,"name":"Hassaan Qureshi","email":"","orcid":"","institution":"National University of Sciences and Technology","correspondingAuthor":false,"prefix":"","firstName":"Hassaan","middleName":"","lastName":"Qureshi","suffix":""},{"id":556747244,"identity":"6b028ab1-5d73-4765-a78b-e6f2925e9649","order_by":2,"name":"Anjum Ashraaf","email":"","orcid":"","institution":"Bahria University","correspondingAuthor":false,"prefix":"","firstName":"Anjum","middleName":"","lastName":"Ashraaf","suffix":""},{"id":556747245,"identity":"5857e8db-78d4-4bd8-98d4-0ce3d34efcf0","order_by":3,"name":"Qasim Ali","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA40lEQVRIie3RPQrCMBTA8SeFuDwzt/h1hUDBSTxLpaBLDiA46Oaku7eoNwhmyCJ0rXRRRF3cXNw0KSK4xLoJ5g+hyfArLy2Ay/WjCb0apDotDhX98EoRJCi+ICYEPypJqFL7dQY9pMH5uLpBt5mImmQ2Emw4kxxiJHXeyREGYSJoHNkIExw08QwhOYDsJwJDYSXpeafJBEmgTtsb3EuQLDKDSSQ+dDIEURDrYEF20YQp/ZHNXVgcLiWNrden6fBw5aNxqz0zg416zYWaS99Giv8Ir7eajYdW8CTvfSIul8v1bz0ADV9J6UkCQqkAAAAASUVORK5CYII=","orcid":"","institution":"Government College University, Lahore","correspondingAuthor":true,"prefix":"","firstName":"Qasim","middleName":"","lastName":"Ali","suffix":""}],"badges":[],"createdAt":"2025-12-08 06:38:11","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8304255/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8304255/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":97845180,"identity":"c180156a-30b7-41c6-b3fd-b5a155339137","added_by":"auto","created_at":"2025-12-10 05:14:00","extension":"json","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5985,"visible":true,"origin":"","legend":"","description":"","filename":"bdba406efb8e469bb0277d84282cfd3b.json","url":"https://assets-eu.researchsquare.com/files/rs-8304255/v1/571c39bfde76bef4087d0616.json"},{"id":97897470,"identity":"7a4ac81d-2560-4504-9db3-bf933041cf2b","added_by":"auto","created_at":"2025-12-10 15:37:50","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1103284,"visible":true,"origin":"","legend":"","description":"","filename":"PostQuantumMigrationforOTSecurityAnExploratoryStudyinPQPUFbasedDeviceAuthenticationforCPSIoT.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8304255/v1_covered_5680dd58-e22b-45ea-ad9d-52c0a5d968bc.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Post Quantum Migration for OT Security: An Exploratory Study in PQ-PUFbased Device Authentication for CPS \u0026 IoT","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"wireless-personal-communications","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"wire","sideBox":"Learn more about [Wireless Personal Communications](https://www.springer.com/journal/11277)","snPcode":"11277","submissionUrl":"https://submission.nature.com/new-submission/11277/3","title":"Wireless Personal Communications","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Post Quantum Cryptography, Cyber Physical System, Blockchain Security, Authentication Schemes, Crypto Agility","lastPublishedDoi":"10.21203/rs.3.rs-8304255/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8304255/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"The possible risk of Quantum attacks on the communication security of Cyber Physical Systems (CPS) and Internet of Things (IoT) emphasizes the necessity for proactive actions. The ongoing efforts of the US National Institute of Standards and Technology (NIST) to standardize quantum-resistant algorithms play a vital role in integrating security measures. Our research delves into the practical implications of migrating to Post-Quantum (PQ) algorithms in authentication schemes. We propose a novel Physical Unclonable Functions (PUF) based device authentication mechanism with the adoption of PQ algorithms to perform sensitive interactions in real-time. Moreover, we focus on resource-constrained implementation and performance analysis of quantum algorithms for achieving crypto agility. The results provide insight into the real-world use of NIST PQ algorithms and highlight the temporal complexities of key pair generation, encryption and decryption processes with the integration of PUF based device authentication measures. We have identified that in our proposed PQ-PUF based authentication scheme, DILITHIUM5 with SHA3-512 has performed significantly better than RSA1024 with SHA2-256 during the stages of central registration and verification. The results also shed light on the sizes of plaintext, ciphertext, and public and private keys, which will be important factors in resource-constrained implementations.","manuscriptTitle":"Post Quantum Migration for OT Security: An Exploratory Study in PQ-PUFbased Device Authentication for CPS \u0026amp; IoT","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-12-10 05:13:55","doi":"10.21203/rs.3.rs-8304255/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"editorInvitedReview","content":"","date":"2026-02-12T04:25:19+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"137534922231558366478732465802522447711","date":"2025-12-27T20:04:13+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"228180773271585073506691485356815863181","date":"2025-12-27T07:14:20+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"283600535113880377037207672384737104325","date":"2025-12-26T15:51:56+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-12-26T14:46:33+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-12-26T14:45:21+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-12-15T03:40:48+00:00","index":"","fulltext":""},{"type":"submitted","content":"Wireless Personal Communications","date":"2025-12-08T06:29:17+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"wireless-personal-communications","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"wire","sideBox":"Learn more about [Wireless Personal Communications](https://www.springer.com/journal/11277)","snPcode":"11277","submissionUrl":"https://submission.nature.com/new-submission/11277/3","title":"Wireless Personal Communications","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"8629ba6c-0c0a-4bb0-92a9-ca53dfe1bf8e","owner":[],"postedDate":"December 10th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2025-12-26T14:53:20+00:00","versionOfRecord":[],"versionCreatedAt":"2025-12-10 05:13:55","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8304255","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8304255","identity":"rs-8304255","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}