Access the previous version of this journal Access it here

STAP Journal of Security Risk Management

ISSN: 3080-9444 (Online)

open accessOpen Access

Article

👁️1views

Post-Quantum Lattice-Based Cryptographic Schemes for Long-Term Data-at-Rest Protection in Enterprise Database Systems

by 

Haider H. Razzaq Orcid link

PDF logoPDF

Published: 2026/11/03

Abstract

Enterprise databases store sensitive financial, healthcare, genomic, and governmental records requiring long-term confidentiality. However, quantum computing threatens conventional RSA and elliptic-curve cryptography through Shor’s algorithm, while harvest-now-decrypt-later attacks expose encrypted archives to future decryption. This paper proposes a lattice-based post-quantum envelope-encryption architecture that replaces conventional key-wrapping mechanisms in transparent data encryption (TDE) systems while preserving AES-256 bulk encryption. The framework integrates a hybrid Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) and classical cryptographic combiner, Module-Lattice-Based Digital Signature Algorithm (ML-DSA) or Falcon Digital Signature Algorithm (FN-DSA) authentication, hash-chained audit logging, and policy-driven cryptographic agility. Seven algorithms support hybrid encapsulation, decapsulation, enterprise rekeying, audit verification, mode negotiation, and exposure-aware migration scheduling. An analytical performance model estimates a 9% latency increase per hybrid key-rewrapping operation, reaching 12% at the highest security level. Parallel processing reduces the projected rekeying time for ten million keys from over ten hours to under ninety seconds using 512 workers. A ten-year ML-DSA-authenticated audit trail across 1,000 tenants requires approximately 400 MB, compared with approximately 100 MB using FN-DSA. Four case studies covering financial, healthcare, genomic, and multinational systems demonstrate computationally feasible migration within one hour. Without migration, long-retention records face estimated residual exposure periods of 41–57 years under Mosca’s inequality. The findings indicate that cryptographic key management, rather than computational migration costs, represents the primary challenge in protecting enterprise databases against quantum threats. Future work includes hardware security module integration, constant-time implementations, and empirical validation under operational enterprise workloads.

Keywords

Post-Quantum CryptographyEnterprise Database SecurityLattice-Based CryptographyHybrid Key EncapsulationML-KEMML-DSATransparent Data Encryption (TDE)Cryptographic AgilityQuantum-Resistant Key Managementand Harvest-Now-Decrypt-Later Attacks.

Doi Link

https://doi.org/10.63180/jsrm.thestap.2026.1.9

How to Cite the Article

Razzaq, H. H. (2026). Post-Quantum Lattice-Based Cryptographic Schemes for Long-Term Data-at-Rest Protection in Enterprise Database Systems. STAP Journal of Security Risk Management, 2026(1), 130–164. https://doi.org/10.63180/jsrm.thestap.2026.1.9

Post-Quantum Lattice-Based Cryptographic Schemes for Long-Term Data-at-Rest Protection in Enterprise Database Systems is licensed under CC BY 4.0CCBY

References

  1. Alagic, G., Apon, D., Cooper, D., Dang, Q., Dang, T., Kelsey, J., Lichtinger, J., Liu, Y.-K., Miller, C., Moody, D., Peralta, R., Perlner, R., Robinson, A., & Smith-Tone, D. (2022). Status report on the third round of the NIST Post-Quantum Cryptography Standardization process (, Ed.). National Institute of Standards and Technology (U.S.). https://doi.org/10.6028/nist.ir.8413-upd1
  2. Alagic, G., Barker, E., Chen, L., Moody, D., Robinson, A., Silberg, H., & Waller, N. (2025). Recommendations for key-encapsulation mechanisms (, Ed.). National Institute of Standards and Technology (U.S.). https://doi.org/10.6028/nist.sp.800-227
  3. Albrecht, M. R., Curtis, B. R., Deo, A., Davidson, A., Player, R., Postlethwaite, E. W., Virdia, F., & Wunderer, T. (2018). Estimate All the {LWE, NTRU} Schemes! Security and Cryptography for Networks, 351–367. https://doi.org/10.1007/978-3-319-98113-0_19
  4. Garcia, D., & Liu, H. (2021). A Study of Post Quantum Cipher Suites for Key Exchange. 2021 IEEE International Symposium on Technologies for Homeland Security (HST), 1–7. https://doi.org/10.1109/hst53381.2021.9619839
  5. Amazon Web Services. (n.d.). AWS Key Management Service cryptographic details. AWS Documentation. https://docs.aws.amazon.com/kms/latest/developerguide/kms-cryptography.html
  6. Barker, E., & Barker, W. (2019). Recommendation for key management: Part 2—Best practices for key management organizations (NIST Special Publication 800-57 Part 2, Revision 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-57pt2r 1
  7. Bernstein, D. J., Bhargavan, K., Bhasin, S., Chattopadhyay, A., Chia, T. K., Kannwischer, M. J., Kiefer, F., Paiva, T., Ravi, P., & Tamvada, G. (2025). KyberSlash: Exploiting secret-dependent division timings in Kyber implementations. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2025(2), 209–234. https://doi.org/10.46586/tches.v2025.i2.209-234
  8. Bindel, N., Brendel, J., Fischlin, M., Goncalves, B., & Stebila, D. (2019). Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange. Post-Quantum Cryptography, 206–226. https://doi.org/10.1007/978-3-030-25510-7_12
  9. Bos, J., Ducas, L., Kiltz, E., Lepoint, T., Lyubashevsky, V., Schanck, J. M., Schwabe, P., Seiler, G., & Stehlé, D. (2018). CRYSTALS—Kyber: A CCA-secure module-lattice-based KEM. In 2018 IEEE European Symposium on Security and Privacy (EuroS&P) (pp. 353–367). IEEE. https://doi.org/10.1109/EuroSP.2018.00032
  10. Chen, L., Jordan, S., Liu, Y.-K., Moody, D., Peralta, R., Perlner, R., & Smith-Tone, D. (2016). Report on post-quantum cryptography (NIST Interagency Report 8105). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.IR.8105
  11. Ducas, L., Kiltz, E., Lepoint, T., Lyubashevsky, V., Schwabe, P., Seiler, G., & Stehlé, D. (2018). CRYSTALS—Dilithium: A lattice-based digital signature scheme. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2018(1), 238–268. https://doi.org/10.13154/TCHES.V2018.I1.238-268
  12. Dworkin, M. (2007). Recommendation for block cipher modes of operation: Galois/Counter Mode (GCM) and GMAC (NIST Special Publication 800-38D). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-38D
  13. European Commission. (2024). Commission Recommendation (EU) 2024/1101 of 11 April 2024 on a coordinated implementation roadmap for the transition to post-quantum cryptography. Official Journal of the European Union. https://eur-lex.europa.eu/eli/reco/2024/1101/oj
  14. Fowler, A. G., Mariantoni, M., Martinis, J. M., & Cleland, A. N. (2012). Surface codes: Towards practical large-scale quantum computation. Physical Review A, 86(3), Article 032324. https://doi.org/10.1103/PhysRevA.86.032324
  15. Gidney, C., & Ekerå, M. (2021). How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits. Quantum, 5, 433. CLOCKSS. https://doi.org/10.22331/q-2021-04-15-433
  16. Gidney, C., & Ekerå, M. (2021). How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits. Quantum, 5, Article 433. https://doi.org/10.22331/q-2021-04-15-433
  17. Grover, L. K. (1996). A fast quantum mechanical algorithm for database search. In Proceedings of the 28th Annual ACM Symposium on Theory of Computing (pp. 212–219). Association for Computing Machinery. https://doi.org/10.1145/237814.237866
  18. Hoffstein, J., Pipher, J., & Silverman, J. H. (1998). NTRU: A ring-based public key cryptosystem. Algorithmic Number Theory, 267–288. https://doi.org/10.1007/bfb0054868
  19. Langlois, A., & Stehlé, D. (2014). Worst-case to average-case reductions for module lattices. Designs, Codes and Cryptography, 75(3), 565–599. https://doi.org/10.1007/s10623-014-9938-4
  20. Lyubashevsky, V., Peikert, C., & Regev, O. (2010). On Ideal Lattices and Learning with Errors over Rings. Advances in Cryptology – EUROCRYPT 2010, 1–23. https://doi.org/10.1007/978-3-642-13190-5_1
  21. Carvalho, M., Sá, F., & Bernardino, J. (2025). Evaluation of the Impact of AES Encryption on Query Read Performance Across Oracle, MySQL, and SQL Server Databases. Cryptography, 9(4), 77. https://doi.org/10.3390/cryptography9040077
  22. Moody, D., Perlner, R., Regenscheid, A., Robinson, A., & Cooper, D. (2024). Transition to post-quantum cryptography standards (NIST Interagency Report 8547, Initial Public Draft). National Institute of Standards and Technology. https://csrc.nist.gov/pubs/ir/8547/ipd
  23. Mosca, M. (2018). Cybersecurity in an Era with Quantum Computers: Will We Be Ready? IEEE Security &Amp; Privacy, 16(5), 38–41. https://doi.org/10.1109/msp.2018.3761723
  24. National Institute of Standards and Technology. (2024a). Module-lattice-based digital signature standard (Federal Information Processing Standards Publication 204). U.S. Department of Commerce. https://doi.org/10.6028/NIST.FIPS.204
  25. National Institute of Standards and Technology. (2024b). Module-lattice-based key-encapsulation mechanism standard (Federal Information Processing Standards Publication 203). U.S. Department of Commerce. https://doi.org/10.6028/NIST.FIPS.203
  26. National Institute of Standards and Technology. (2024c). Stateless hash-based digital signature standard (Federal Information Processing Standards Publication 205). U.S. Department of Commerce. https://doi.org/10.6028/NIST.FIPS.205
  27. National Institute of Standards and Technology. (2020). Recommendation for key management: Part 1—General (NIST Special Publication 800-57 Part 1, Revision 5). U.S. Department of Commerce. https://doi.org/10.6028/NIST.SP.800-57pt1r5
  28. National Security Agency. (2022). Announcing the Commercial National Security Algorithm Suite 2.0 [Cybersecurity advisory].
  29. Office of Management and Budget. (2026, June 24). Execution of the migration to post-quantum cryptography (Memorandum M-26-15). Executive Office of the President. https://www.whitehouse.gov/wp-content/uploads/2026/06/m-26-15-execution-of-the-migration-to-post-quantum-cryptography.pdf
  30. Oracle Corporation. (n.d.). Advanced security: Transparent data encryption. Oracle Database Documentation. https://docs.oracle.com/en/database/
  31. Percona. (n.d.). pg_tde: Transparent data encryption for PostgreSQL [Software documentation]. https://docs.percona.com/pg-tde/
  32. Regev, O. (2005). On lattices, learning with errors, random linear codes, and cryptography. In Proceedings of the 37th Annual ACM Symposium on Theory of Computing (pp. 84–93). Association for Computing Machinery. https://doi.org/10.1145/1060590.1060603
  33. Roetteler, M., Naehrig, M., Svore, K. M., & Lauter, K. (2017). Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms. Advances in Cryptology – ASIACRYPT 2017, 241–270. https://doi.org/10.1007/978-3-319-70697-9_9
  34. Shor, P. W. (1997). Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing, 26(5), 1484–1509. https://doi.org/10.1137/S0097539795293172
  35. Stebila, D., Fluhrer, S., & Gueron, S. (2026). Hybrid key exchange in TLS 1.3 (RFC 9954). Internet Engineering Task Force. https://doi.org/10.17487/RFC9954
  36. Stebila, D., & Mosca, M. (2016). Post-quantum key exchange for the internet and the Open Quantum Safe project (Cryptology ePrint Archive, Paper 2016/1017). International Association for Cryptologic Research. https://eprint.iacr.org/2016/1017
  37. The White House. (2022). National security memorandum on promoting United States leadership in quantum computing while mitigating risks to vulnerable cryptographic systems (NSM-10). https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2022/05/04/national-security-memorandum-on-promoting-united-states-leadership-in-quantum-computing-while-mitigating-risks-to-vulnerable-cryptographic-systems/
  38. U.S. Department of Health and Human Services. (2002). Standards for privacy of individually identifiable health information (HIPAA Privacy Rule) (45 C.F.R. Parts 160 and 164, as amended). https://www.hhs.gov/hipaa/for-professionals/privacy/index.html
  39. European Parliament & Council of the European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L119, 1–88. https://eur-lex.europa.eu/eli/reg/2016/679/oj
  40. National Institute of Standards and Technology. (2023). FFT-over-NTRU-lattice-based digital signature standard (FN-DSA) (FIPS Publication 206, in development). U.S. Department of Commerce. https://csrc.nist.gov/projects/post-quantum-cryptography.
  41. Barker, E., & Roginsky, A. (2019). Transitioning the use of cryptographic algorithms and key lengths (NIST Special Publication 800-131A, Revision 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-131Ar2
  42. Barker, E., Chen, L., & Davis, R. (2020). Recommendation for key-derivation methods in key-establishment schemes (NIST Special Publication 800-56C, Revision 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-56Cr2
  43. Barnes, R., Bhargavan, K., Lipp, B., & Wood, C. (2022). Hybrid public key encryption (RFC 9180). Internet Research Task Force. https://doi.org/10.17487/RFC9180
  44. Tjhai, C. J., Tomlinson, M., Bartlett, G., Fluhrer, S., Van Geest, D., Garcia-Morchon, O., & Smyslov, V. (2023). Multiple key exchanges in the Internet Key Exchange Protocol Version 2 (IKEv2) (RFC 9370). Internet Engineering Task Force. https://doi.org/10.17487/RFC9370
  45. Barker, E., Smid, M., Branstad, D., & Chokhani, S. (2013). A framework for designing cryptographic key management systems (NIST Special Publication 800-130). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-130
  46. Krawczyk, H., & Eronen, P. (2010). HMAC-based extract-and-expand key derivation function (HKDF) (RFC 5869). Internet Engineering Task Force. https://doi.org/10.17487/RFC5869.