Post-Quantum Lattice-Based Cryptographic Schemes for Long-Term Data-at-Rest Protection in Enterprise Database Systems
DOI:
https://doi.org/10.59992/IJCI.2026.v5n11p1Keywords:
Post-Quantum Cryptography, Lattice-Based Cryptography, ML-KEM, ML-DSA, FN-DSA, Transparent Data Encryption, Key Management, Envelope Encryption, Harvest-Now-Decrypt-Later, Crypto-Agility, Enterprise DatabasesAbstract
Enterprise databases routinely hold records — financial ledgers, electronic health records, genomic biobank entries, government archives — whose confidentiality must survive for decades, yet the asymmetric key-wrapping operations that protect them today (RSA and elliptic-curve key exchange inside transparent data encryption, TDE) are efficiently broken by a sufficiently large quantum computer running Shor's algorithm. Published resource estimates for that attack have fallen roughly three orders of magnitude in thirteen years — from approximately 10^9 physical qubits in 2012 to under 10^6 in 2025 — and the harvest-now-decrypt-later (HNDL) threat means an adversary can exfiltrate encrypted backups today and decrypt them once such a machine exists. A record's effective confidentiality horizon is therefore bounded by whichever comes first: its retention obligation, or the arrival of a cryptographically relevant quantum computer (CRQC). This paper studies that boundary at the key-management layer specifically, since bulk symmetric encryption (AES-256) already resists Grover's algorithm and is out of scope. We present a lattice-based post-quantum envelope-encryption architecture that replaces the RSA/ECC key-wrapping tier of a conventional TDE key hierarchy with a hybrid ML-KEM/classical key-encapsulation combiner, authenticates key-rotation metadata with ML-DSA or FN-DSA signatures over a hash-chained audit log, and negotiates between classical-only, hybrid, and pure post-quantum modes under policy control. The design is grounded in the Module-LWE and NTRU-lattice hardness assumptions behind NIST's finalized ML-KEM (FIPS 203) and ML-DSA (FIPS 204) and the still-draft FN-DSA (FIPS 206); we give seven explicit algorithms — hybrid encapsulation and decapsulation, enterprise-scale rekeying, signed audit and verification, crypto-agility negotiation, and exposure-ranked migration scheduling — with a composed security argument and an analytical cost model calibrated against published lattice-scheme parameters. That model puts the hybrid combiner's overhead at a modeled 9.0% added latency per key-rewrap relative to an all-classical baseline (12% at the highest NIST security level); shows full-estate rekeying of ten million keys falling from over ten hours at one worker to under ninety seconds at 512 parallel workers; and projects a signed, ML-DSA-authenticated ten-year audit trail for one thousand tenants at roughly 400 MB — about thirteen times an ECDSA baseline — a gap FN-DSA's compact, still-draft signatures narrow to roughly 100 MB. Four illustrative case studies — a 30-year financial ledger, a 50-year health/device archive, a 60-year genomic biobank, and a multinational deployment under CNSA 2.0 and EU deadlines — show migration completing in well under an hour of modeled compute for every estate, yet the two longest-horizon records would carry 41 to 57 years of residual exposure under Mosca's inequality if that migration were skipped: the key-management tier, not the migration's computational cost, is the binding constraint. The paper closes by positioning the framework against current mandates (NIST, NSA CNSA 2.0, the 2026 U.S. federal schedule, and the EU roadmap) and naming the engineering work — constant-time FN-DSA, HSM firmware support, and empirical validation — that separates this analytical architecture from a production deployment.
References
P. W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” SIAM J. Comput., vol. 26, no. 5, pp. 1484–1509, 1997.
[2] L. K. Grover, “A fast quantum mechanical algorithm for database search,” in Proc. 28th Annu. ACM Symp. Theory of Computing (STOC), 1996, pp. 212–219.
[3] M. Mosca, “Cybersecurity in an era with quantum computers: Will we be ready?,” IEEE Security & Privacy, vol. 16, no. 5, pp. 38–41, 2018.
[4] National Institute of Standards and Technology, “Module-Lattice-Based Key-Encapsulation Mechanism Standard,” FIPS 203, Aug. 2024.
[5] National Institute of Standards and Technology, “Module-Lattice-Based Digital Signature Standard,” FIPS 204, Aug. 2024.
[6] National Institute of Standards and Technology, “Stateless Hash-Based Digital Signature Standard,” FIPS 205, Aug. 2024.
[7] National Institute of Standards and Technology, “FFT-over-NTRU-Lattice-Based Digital Signature Standard (FN-DSA),” FIPS 206 (draft), submitted for approval Aug. 2025; final expected late 2026 / early 2027.
[8] O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” in Proc. 37th Annu. ACM Symp. Theory of Computing (STOC), 2005, pp. 84–93.
[9] V. Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices and learning with errors over rings,” in Advances in Cryptology — EUROCRYPT 2010, LNCS vol. 6110, Springer, 2010, pp. 1–23.
[10] A. Langlois and D. Stehlé, “Worst-case to average-case reductions for module lattices,” Des. Codes Cryptogr., vol. 75, no. 3, pp. 565–599, 2015.
[11] J. Hoffstein, J. Pipher, and J. H. Silverman, “NTRU: A ring-based public key cryptosystem,” in Algorithmic Number Theory (ANTS-III), LNCS vol. 1423, Springer, 1998, pp. 267–288.
[12] J. Bos et al., “CRYSTALS — Kyber: A CCA-secure module-lattice-based KEM,” in Proc. IEEE Eur. Symp. Security and Privacy (EuroS&P), 2018, pp. 353–367.
[13] L. Ducas et al., “CRYSTALS — Dilithium: A lattice-based digital signature scheme,” IACR Trans. Cryptogr. Hardw. Embed. Syst. (TCHES), vol. 2018, no. 1, pp. 238–268, 2018.
[14] P.-A. Fouque et al., “Falcon: Fast-Fourier lattice-based compact signatures over NTRU,” NIST Post-Quantum Cryptography Standardization submission, 2020.
[15] G. Alagic et al., “Status report on the third round of the NIST post-quantum cryptography standardization process,” NISTIR 8413, 2022.
[16] National Security Agency, “Announcing the Commercial National Security Algorithm Suite 2.0,” CNSA 2.0 Advisory, Sep. 2022.
[17] The White House, “National Security Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems,” NSM-10, May 2022.
[18] European Commission, “Recommendation on a Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,” Apr. 2024, formalized with EU member states Jun. 2025.
[19] National Institute of Standards and Technology, “Transition to Post-Quantum Cryptography Standards,” NIST IR 8547 (draft), 2024.
[20] U.S. Office of Management and Budget, memorandum on federal agency post-quantum cryptography migration planning, 2026.
[21] D. Stebila and M. Mosca, “Post-quantum key exchange for the internet and the Open Quantum Safe project,” IACR Cryptol. ePrint Arch., Rep. 2016/1017, 2016.
[22] N. Bindel, J. Brendel, M. Fischlin, B. Goncalves, and D. Stebila, “Hybrid key encapsulation mechanisms and authenticated key exchange,” in Post-Quantum Cryptography (PQCrypto 2019), LNCS vol. 11505, Springer, 2019, pp. 206–226.
[23] D. Stebila, S. Fluhrer, and S. Gueron, “Hybrid key exchange in TLS 1.3,” IETF Internet-Draft draft-ietf-tls-hybrid-design, 2023 (work in progress).
[24] National Institute of Standards and Technology, “Recommendation for Key Management, Part 1: General,” NIST SP 800-57, rev. 5, 2020.
[25] U.S. Department of Health and Human Services, “Standards for Privacy of Individually Identifiable Health Information (HIPAA Privacy Rule),” 45 C.F.R. Parts 160 and 164, 2002 (as amended).
[26] European Parliament and Council of the European Union, “Regulation (EU) 2016/679 (General Data Protection Regulation),” Official Journal of the European Union, L119, 4 May 2016.
[27] Oracle Corporation, “Advanced Security: Transparent Data Encryption,” Oracle Database Documentation, 2024.
[28] Microsoft Corporation, “Transparent Data Encryption (TDE),” SQL Server Documentation, 2024.
[29] PostgreSQL Global Development Group / Percona, “pg_tde: Transparent Data Encryption for PostgreSQL,” project documentation, 2024–2026.
[30] J. Fan and F. Vercauteren, “Somewhat practical fully homomorphic encryption,” IACR Cryptol. ePrint Arch., Rep. 2012/144, 2012.
[31] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in Cryptology — ASIACRYPT 2017, LNCS vol. 10624, Springer, 2017, pp. 409–437.
[32] Global Risk Institute, “Quantum Threat Timeline Report,” M. Mosca and M. Piani, eds., annual report series, 2023.
[33] Encryption Consulting, “FN-DSA (FIPS 206): standardization status and implementation considerations,” industry analysis, 2026.
[34] Cloud Security Alliance, “PQC compliance mandate convergence,” CSA Research Note, Jul. 2026.
[35] National Institute of Standards and Technology, “Post-Quantum Cryptography Project” overview and call for proposals, 2016.
[36] Amazon Web Services, “AWS Key Management Service cryptographic details,” AWS Documentation, 2024.
[37] L. Chen et al., “Report on post-quantum cryptography,” NISTIR 8105, 2016.
[38] C. Gidney and M. Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum, vol. 5, p. 433, 2021.
[39] C. Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits,” arXiv:2505.15917, May 2025.
[40] A. G. Fowler, M. Mariantoni, J. M. Martinis, and A. N. Cleland, “Surface codes: Towards practical large-scale quantum computation,” Phys. Rev. A, vol. 86, no. 3, p. 032324, 2012.
[41] M. Roetteler, M. Naehrig, K. M. Svore, and K. Lauter, “Quantum resource estimates for computing elliptic curve discrete logarithms,” in Advances in Cryptology — ASIACRYPT 2017, LNCS vol. 10625, Springer, 2017, pp. 241–270.
[42] D. J. Bernstein et al., “KyberSlash: Exploiting secret-dependent division timings in Kyber implementations,” IACR Trans. Cryptogr. Hardw. Embed. Syst. (TCHES), vol. 2025, no. 2, pp. 209–234, 2025.
[43] E. Alkim, L. Ducas, T. Pöppelmann, and P. Schwabe, “Post-quantum key exchange — a new hope,” in Proc. 25th USENIX Security Symp., 2016, pp. 327–343.
[44] M. R. Albrecht et al., “Estimate all the {LWE, NTRU} schemes!,” in Security and Cryptography for Networks (SCN 2018), LNCS vol. 11035, Springer, 2018, pp. 351–367.
[45] M. Dworkin, “Recommendation for block cipher modes of operation: Galois/Counter Mode (GCM) and GMAC,” NIST SP 800-38D, Nov. 2007.
[46] The Quantum Insider, “Q-Day just got closer: Three papers in three months are rewriting the quantum threat timeline,” industry analysis, Mar. 2026.
