Autonomous UPQ-PAKE Quantum-Resistant Vehicular Network Scheme

Abstract

Vehicular networks require privacy-preserving and secure authentication mechanisms to protect safety-critical communications against evolving cyber threats. Conventional authentication schemes relying on elliptic-curve cryptography (ECC) and RSA are vulnerable to quantum attacks, making them unsuitable for next-generation intelligent transportation systems. This paper proposes a unified post-quantum pseudonymous authentication and key establishment (UPQ-PAKE) scheme for secure vehicular networks. The proposed framework integrates dynamic pseudonymous identity construction, post-quantum digital signatures, and dual ephemeral key encapsulation into a single transcript-bound authenticated key exchange protocol. ML-DSA is employed for mutual authentication, while ML-KEM enables quantum-resistant session key establishment. Dynamic session-specific pseudonyms provide identity privacy and unlinkability. Furthermore, transcript binding, nonce freshness verification, and contributory dual-ephemeral session entropy strengthen the protocol against replay attacks, provide forward secrecy, and resist man-in-the-middle attacks under the quantum polynomial-time adversarial model. Formal security analysis demonstrates that the proposed scheme achieves authenticated key exchange security based on the IND-CCA security of ML-KEM and the EUF-CMA security of ML-DSA. Performance evaluation demonstrates that the proposed authentication technique maintains practical computational and communication overhead and provides post-quantum mutual authentication, dual-directional key establishment, and dynamic unlinkability, making it suitable for large-scale, real-time IoV deployments.

1. Introduction

Rapid advancement in intelligent transportation system (ITS) and Internet of Vehicles (IoV) have transformed vehicular communications into a necessity of modern smart cities. Vehicles are engaged in continuous communication, exchanging safety and beacon messages such as traffic conditions, road hazards, collision warnings, navigation data and emergency notifications through Vehicle-to-Infrastructure (V2I) and Vehicle-to-Vehicle (V2V) communications [1]. In ITS, this communication is crucial to improve traffic management, for efficient transportation, and for the safety of passengers; however, it introduces privacy and cybersecurity challenges. As the wireless communications take place in open networks and channels, adversaries can easily exploit the vulnerabilities to launch various cyber-attacks such as replay attacks, impersonation, man-in-the-middle, message tampering, and session hijacking. This results in catastrophic results for public infrastructure and road safety [2].

Authentication has thus become a basic security requirement in vehicular communication. A secure vehicular authentication approach must ensure integrity, confidentiality, anonymity, authenticity, resistance against cyber-attacks and unlinkability and low latency and lightweight communication overhead for dynamic vehicular environments [3]. Conventional vehicular authentication approaches mainly rely on Public Key Infrastructure (PKI), RSA-based digital signature and Elliptic Curve Cryptography (ECC) for authentication and session/key establishment [4]. Though these approaches provide security under classical assumptions still they are vulnerable to quantum attacks due to quantum computing. Shor’s algorithm can compromise the hard mathematical problems efficiently using conventional cryptographic schemes, such as integer factorization in RSA and the elliptic-curve point multiplication problem underlying ECC [5]. As a result, the traditional vehicular authentication protocols are becoming unsuitable for future quantum enabled communication setups.

To address these challenges, post-quantum cryptography (PQC) has emerged as promising solution for designing cryptographic systems that are resilient to quantum adversaries. Lattice-based cryptographic primitives, especially ML-DSA and ML-KEM standardized by NIST, have recently gained attention due to strong security, computational efficiency and suitability for resource constraints networks [6,7]. Recent studies have also explored the integration of post-quantum cryptography in vehicular communication to obtain quantum-resilient authentication and secure key/session establishment [8]. However, current post-quantum vehicular authentication schemes face severe practical and security limitations.

First, various available authentication approaches fail to ensure strong privacy preservation and unlinkability. Although pseudonyms conceal identities, still insufficiently updated or persistent pseudonyms can help adversaries correlate communications that helps in tracking and behavioral profiling. Hence, dynamic pseudonym generation/update techniques are required for preserving unlinkability in vehicular networks. Second, various post-quantum authentication approaches introduce computational and communication overhead due to size of ciphertext, large signatures and latency issues, that further make them less suitable for real-time vehicular networks. Third, various available approaches are dependent on unilateral ephemeral key exchange techniques providing weak forward secrecy and insufficient contribution entropy from the communicating entities. Furthermore, numerous protocols are not effective to bind all the critical transcript components in authentication process, thereby leaving the network vulnerable to transcript manipulation and man-in-the-middle attacks. Another challenge being faced by vehicular authentication schemes is balancing efficiency and security simultaneously. Strong security generally is achieved at the expense of computational cost, while lightweight approaches compromise privacy significantly [9]. Designing a unified framework ensuring privacy, quantum resilience [10], forward secrecy, transcript integrity, unlinkability, replay resistance and mutual authentication hence remains an open research challenge in the next generation of vehicular communications.

Motivated by these challenges, this paper proposes UPQ-PAKE an authentication and session/key establishment scheme for secure vehicular communication. Figure 1 shows the graphical abstract of the proposed protocol.

Figure 1. Graphical abstract of the proposed system.

The main contributions of this paper are summarized as follows:

(i)

We propose a unified post-quantum pseudonymous authentication and key establishment framework for secure IoV communications.

(ii)

We design a dynamic session-specific pseudonym generation mechanism that enhances identity privacy, unlinkability, and resistance to vehicle tracking.

(iii)

We develop a dual-ephemeral ML-KEM-based authenticated key establishment protocol that provides contributory entropy and strong forward secrecy.

(iv)

We introduce a transcript-bound authentication mechanism that cryptographically binds all session parameters to resist man-in-the-middle and replay attacks.

(v)

We present a formal security analysis in the quantum polynomial-time (QPT) adversarial model, demonstrating session key indistinguishability, mutual authentication, identity privacy, and forward secrecy.

The rest of the paper is organized as follows: Section 2 reviews the existing literature, Section 3 presents the system model, adversarial assumptions and design goals, Section 4 elaborates the proposed protocol, Section 5 presents security analysis, Section 6 evaluates the performance of proposed scheme and Section 7 concludes the paper with a future outline.

2. Related Work

2.1. Classical Vehicular Authentication Schemes

Traditional vehicular authentication schemes are heavily dependent on PKI, ECC and bilinear pairing-based authentication for secure V2V and V2I communication. These traditional approaches provide message integrity, efficient authentication, and lightweight computation suitable for vehicular environments. Secure vehicular authentication frameworks have been investigated and emphasized the importance of lightweight and low-latency authentication protocols for real-time vehicular communication [11].

Despite the efficiency of traditional techniques, they rely on computationally hard problems, such as the elliptic-curve point multiplication problem in ECC and integer factorization in RSA. With the arrival of quantum computing, severe threat is posed to these techniques because Shor’s algorithm can solve both problems effectively in polynomial time. Formally, let ${\mathcal{A}}_Q$ denote a quantum polynomial-time adversary. Under such an adversarial model, the computational hardness assumptions underlying ECC and RSA can be efficiently broken. Hence,

$${Adv}_{\mathrm{ECC}}^{{\mathcal{A}}_Q}\left(\lambda \right)\approx 1,{Adv}_{\mathrm{RSA}}^{{\mathcal{A}}_Q}\left(\lambda \right)\approx 1.$$

(1)

under enough quantum computations. As a result, ECC- and RSA-based authentications are no longer suitable to be deployed in future ITS.

Furthermore, traditional authentication mechanisms employ static pseudonyms for preserving privacy of users such as

$${\mathrm{PID}}_v=H\left({\mathrm{ID}}_v\parallel r_v\right),$$

(2)

where $r_v$ denotes the registration randomness. However, the repeated use of ${\mathrm{PID}}_v$ across multiple communication sessions enables an adversary to correlate different sessions belonging to the same vehicle, thereby compromising unlinkability. Formally,

$${\mathrm{PID}}_v^{\left(i\right)}={\mathrm{PID}}_v^{\left(j\right)},\forall i,j.$$

(3)

This allows the long-term behavioral profiling and tracking of vehicles. Therefore, despite being lightweight, classical authentication schemes fail to provide quantum resilience and unlinkability.

2.2. Post-Quantum Vehicular Authentication Schemes

To address the quantum threats, recent studies are focused on integrating post-quantum cryptography (PQC) into vehicular communication systems. Lattice-based cryptography such as ML-KEM and ML-DSA standardized by NIST has emerged as a practical solution due to having strong security and computational efficiency.

A post-quantum secure vehicular authentication protocol has been proposed using lattice-based primitives for secure key establishment and authentication [2]. This scheme demonstrates strong resistance against quantum attacks and improves the robustness of authentication process. However, it reuses static pseudonymous identities during repeated communication enabling the session correlation attacks under passive adversarial observation.

Similarly, PQAKA, a post-quantum authentication and session key agreement approach, has been proposed for the IoV over 5G communication infrastructure [12]. The framework integrates post-quantum key encapsulation and digital signatures for quantum-resistant authentication. Although it has achieved authenticated key establishment successfully, it primarily focuses on the correctness of authentication and does not address transcript integrity and dynamic unlinkability.

Lightweight lattice-based authentication schemes have been investigated mainly for resource-constrained vehicular communication, highlighting the trade-off between communication efficiency and security robustness [11]. The analysis proves that large ciphertext and signature remain one of the major challenges in practical post-quantum vehicular deployments. A quantum-resistant blockchain architecture for VANETs has been proposed, integrating ML-KEM with PoP and PoA consensus for secure message dissemination and identification management [13]. PQ-AuthV is a post-quantum secure authentication scheme for smart vehicular network providing conditional privacy and mutual authentication through aggregated authentication mechanism [2]. QSSNET is a quantum-safe distributed trust architecture for V2X communication combining federated trust with threshold ML-DSA signature and symmetric authentication [14]. V-PISL is a lattice-based post-quantum identity-based signature technique for secure authentication in VANETs leveraging Dilithium for providing resilience against quantum attacks [15].

DAME-IoV is a post-quantum authentication for IoV integrating adaptive security techniques having multi-edge processing for supporting secure and scalable vehicular communication [16]. A quantum-resistant ring signature-based authentication scheme for VANETs using lattice-based cryptography provides privacy-preserving authentication, forward security and message integrity [17]. A secure post-quantum mutual authentication for IoV based on the hardness of the Small Integer Solution (SIS) problem targets secure and efficient communication [18].

Despite having all these advancements, available post-quantum authentication schemes [19,20] suffer from severe limitations. First, some of the protocols are dependent on the resuse of static pseudonyms, which allows adversaries to correlate the authentication sessions. Second, some of the approaches mainly focus on the correctness of authentication while neglecting transcript-bound session derivation. Third, available approaches employ unilateral ephemeral key exchange providing weak forward secrecy.

2.3. Post-Quantum Authenticated Key Exchange Protocols

Authenticated key exchange (AKE) protocols are another important addition to secure post-quantum communication systems. PQ-AKE frameworks use key encapsulation mechanisms (KEMs) for establishing quantum-resistant session keys and integrating digital signatures for mutual authentication simultaneously [21].

AKE protocols have been analyzed under formal security models and established a theoretical foundation for secure session establishment under active adversarial environments [22]. An authenticated post-quantum session protocol integrates ML-KEM for key establishment, AES-256-GCM and ML-DSA for authentication security and protected communication [23]. A lightweight lattice-based authentication and key agreement protocol for multilayer IoT smart grids has been proposed for post-quantum session key establishment and mutual authentication [24]. Lightweight post-quantum key agreement and authentication protocol for smart-home IoT ensures secure session key and mutual authentication against quantum threats [25].

Similarly a three-party password authentication key exchange scheme has been proposed based on the Module Learning with Errors (MLWE) problem for ensuring quantum-resilient authentication and secure key establishment [26]. A Butterfly protocol for mutual authentication and secure key exchange through Remote Quantum Key Distribution (QKD) nodes supports secure communication without a direct QKD link [20]. Blockchain-based batch authentication with a symmetric group key agreement protocol for the MEC environment allows the authentication of multiple users with secure group-wise session key establishment [27]. The RLWE-based three-party AKA scheme for IIoT ensures quantum-resilient mutual authentication and session key establishment [28]. Apart from lattice-based, a QLight-IIOT protocol deploys hash-based security to achieve quantum-resistant authentication that reduces the burden on resource-constrained devices [29]. Blockchain, VAANETs and three-party key agreement known as BCL-3AKA is introduced to target reduced communication and computation overhead [30]. The RLWE-based three-party authentication approach for multi-server networks addresses mutual authentication, session key establishment with applications in various domains including healthcare [31]. A post-quantum AKE framework for BCI/EEG environments combines LWE-based quantum resilience with biometric derived authentication, providing a total new application of PQ-AKE [32].

This analysis demonstrates that transcript integrity and authenticated session derivation are the main requirements for secure communication systems. Modern PQ-AKE protocols employ transcript-bound session derivation functions of the form

$${\mathrm{Key}}_{\mathrm{sess}}=\mathrm{HKDF}\left(ss\parallel \beta \right),$$

(4)

where $ss$ denotes the shared secret, and $\beta$ denotes the transcript-dependent entropy.

Recent authenticated PQ sessions protocols extend this idea further by integrating transcript binding into session derivation process [33]. These protocols compute transcript binders using

$$\beta =H\left({\mathrm{epk}}_v\parallel {\mathrm{epk}}_R\parallel ct\parallel n_v\parallel n_R\right).$$

(5)

Hence ensuring that all the session parameters must be cryptographically bound in final key derivation. This approach strengthens the resilience against transcript manipulation and man-in-the-middle (MITM) attacks.

However, the majority of the available PQ-AKE protocols use unilateral ephemeral entropy contribution such as in Equation (4), where only one communicating party contributes ephemeral randomness. Such approaches provide weak forward secrecy because if a single ephemeral component is compromised, it will affect the overall session entropy. Moreover, the majority of the available PQ-AKE protocols are for generic client–server environments and hence do not address unlinkability and privacy explicitly.

2.4. Research Gaps and Motivation

Despite the latest advances in PQ-vehicular authentication, there are still numerous critical research gaps that need to be addressed as compared in Table 1.

Table 1. Comparison of recent post-quantum authentication protocols.

Ref.	Cryptographic Basis	QR	MA	SK	DU	TB	FS	DE	RR	MR	FA	Ovh.	Limitation
[2]	Lattice-based PQ	✓	✓		×	×		×	✓	✓		M	Static pseudonym reuse allowing session correlation
[13]	ML-KEM + PQ signatures	✓	✓	✓		×		×	✓	✓		M–H	Limited transcript integrity and weak unlinkability
[11]	Lightweight lattice authentication	✓	✓		×	×	×	×				L	Weak privacy and limited forward secrecy
[34]	ECC/PKI	×	✓	✓			✓	×	✓	✓		L	Vulnerable to Shor’s quantum attacks
[12]	PQ-KEM-based AKE	✓	✓	✓	×	✓		×	✓	✓	✓	M	Mainly designed for client–server systems
[14]	QSSNET	✓	✓			×		×	✓	✓		M–H	Distributed trust with increased protocol complexity
[15]	V-PISL/Dilithium	✓	✓			×		×	✓	✓		M	Primarily focuses on identity-based authentication
[16]	DAME-IoV	✓	✓	✓		×		×	✓	✓		M	Relies on multi-edge processing architecture
[17]	PQ ring-signature authentication	✓	✓		✓	×	✓	×	✓	✓		M–H	Additional ring-signature communication overhead
[18]	SIS-based authentication	✓	✓	✓		×		×	✓	✓		M	Limited transcript-bound session derivation
UPQ-PAKE (ours)	ML-KEM + ML-DSA + dynamic pseudonyms	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	M	Slightly increased transcript computation overhead

✓ full support; partial; × not supported. QR: quantum resistance; MA: mutual authentication; SK: session-key establishment; DU: dynamic unlinkability; TB: transcript binding; FS: forward secrecy; DE: dual ephemeral entropy; RR: replay resistance; MR: MITM resistance; FA: formal security analysis; Ovh.: communication overhead (L/M/H).

First, many of the available PQ vehicular authentication schemes rely on static pseudonymous structures that allow deterministic session correlation attacks. If the same pseudonym is reused across various sessions as mentioned in Equation (3), then an adversary can associate different sessions with the same vehicle trivially. So, existing schemes only provide pseudonymity, but no strong unlinkability is achieved.

Secondly, most of the available PQ-authentication schemes use unilateral ephemeral key exchange and derive session keys using Equation (4), where one party contributes ephemeral entropy only. Such constructions offer limited contribution towards forward secrecy and weak resistance against key compromise attacks.

Thirdly, numerous techniques fail to bind all transcript parameters cryptographically in a single authenticated session derivation. Without complete binding, Equation (5) becomes

$$\beta \ne H\left({\mathrm{epk}}_v\parallel {\mathrm{epk}}_R\parallel \mathrm{ct}\parallel n_v\parallel n_R\right).$$

(6)

This means the protocol is still vulnerable to transcript manipulation and MITM attacks under specific adversarial scenarios.

Fourth, most of the PQ-authentication techniques induce substantial communication overhead due to large signature and ciphertext sizes. This overhead may become problematic in extensive dynamic vehicular setups.

Keeping in view the above-mentioned limitations, this paper proposes UPQ-PAKE, a unified post-quantum pseudonymous authentication and key establishment protocol for secure vehicular communications. It achieves strong privacy, transcript integrity, enhanced forward secrecy, and PQ-resilient authenticated session establishment, and maintains efficiency for real-time vehicular networks.

3. System Model and Design Goals

3.1. Preliminaries on ML-KEM and ML-DSA

ML-KEM: ML-KEM is an NIST-standardized post-quantum key-encapsulation technique defined in FIPS 203 [6]. It consists of three main algorithms: $\mathrm{KeyGen}$, $\mathrm{Encap}$, and $\mathrm{Decap}$. The $\mathrm{KeyGen}$ algorithm generates an encapsulation key and a corresponding decapsulation key. If the the encapsulation key is given, $\mathrm{Encap}$ generates a ciphertext and a shared secret, while $\mathrm{Decap}$ uses the corresponding decapsulation key and ciphertext for recovering the shared secret. In the proposed UPQ-PAKE protocol, ML-KEM is used for post-quantum secure session-key establishment between the vehicle and RSU.

ML-DSA: is an NIST-standardized post-quantum digital signature scheme defined in FIPS 204 [7]. It consists of three main algorithms: $\mathrm{KeyGen}$, $\mathrm{Sign}$, and $\mathrm{Verify}$. The $\mathrm{KeyGen}$ algorithm outputs a signing key and its corresponding verification key, $\mathrm{Sign}$ generates a digital signature over a message using signing key, and $\mathrm{Verify}$ checks the validity of signature using the corresponding verification key. In the proposed protocol. ML-DSA is used to ensure post-quantum mutual authentication and integrity of the authenticated protocol transcripts.

3.2. System Model

Vehicular networks support both V2I and V2V communication. However, in this work, the proposed protocol is specifically instantiated and evaluated for a V2I communication scenario, where authentication and session-key establishment are performed among a vehicle and an RSU as provided in Figure 2. Direct V2V authentication is outside the scope of this work and is considered a potential extension of the proposed protocol. TA is assumed to be fully trustworthy and secure computationally, responsible for the initialization of the system, generating cryptographic primitives, the registration of vehicles, and the issuance of credentials. Algorithm 1 provides detailed systematic implementation steps of the proposed protocol. During initialization, TA generates global public parameters and PQ-signature keys as

$$({\mathrm{pk}}_{\mathrm{TA}},{\mathrm{sk}}_{\mathrm{TA}})\leftarrow \mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{KeyGen}\left(\right),$$

(7)

where ${\mathrm{pk}}_{\mathrm{TA}}$ denotes the TA public verification key, and ${\mathrm{sk}}_{\mathrm{TA}}$ denotes the corresponding secret signing key. TA maintains secure registration records and updates the authentication policies and validity parameters of certificates periodically.

Figure 2. System architecture of the proposed UPQ-PAKE protocol involving the Trusted Authority (TA), Roadside Units (RSUs), and Vehicles (Vs). Refer to Table A1 for the detailed mathematical steps.

Each vehicle $V_i$ is equipped with on-board unit (OBU) capable of performing PQ-cryptographic operations. Vehicles communicate dynamically with neighboring vehicles and RSUs while moving within the network. Every vehicle possesses a unique real identity ${\mathrm{ID}}_v$, attributes set ${\mathrm{Attr}}_v$, pseudonymous credential and PQ-authentication keys. For preserving the real identity (privacy preserving), the identity of the vehicle is transformed into a hidden commitment as

$${\mathrm{C}}_v=H\left({\mathrm{ID}}_v\parallel {\mathrm{Attr}}_v\parallel {\sigma }_v\right),$$

(8)

where ${\sigma }_v\in {\{0,1\}}^{\lambda }$ denotes randomly generated secret entropy.

RSUs act as semi-trusted entities deployed along the transportation routes for facilitating secure vehicular communications and authentication. Every RSU possesses the computational capability required for executing ML-KEM operations and ML-DSA signature generation and verification. RSU is responsible for authenticating vehicles to establish secure session keys and distributing traffic-related data.

Unlike traditional vehicular systems that rely mainly on long-term identities, the proposed system uses dynamic session-specific pseudonyms. Every vehicle generates a temporary session-specific pseudonym:

$${\mathrm{PID}}_v^{\left(j\right)}=H\left({\mathrm{PID}}_v\parallel {\eta }_j\right),$$

(9)

where ${\eta }_j\in {\{0,1\}}^{\lambda }$ denotes fresh session randomness. This approach prevents deterministic correlation and strengthens the unlinkability across various authentication sessions.

The communication model assumes that all vehicles must communicate in open communication channels susceptible to replay, interception, manipulation and modification by the adversaries. Therefore, all the authentication and session establishment actions must be cryptographically protected through PQ primitives.

The proposed protocol follows a multistage authentication and secure session establishment workflow involving system initialization, credential issuance, mutual authentication and transcript-bound session key derivation. During registration, TA issues authenticated pseudonymous certificates to vehicles. During authentication, RSU and vehicles exchange authenticated transcript-bound messages and establish shared PQ-session secrets using dual ephemeral ML-KEM operation. The final session key is derived as

$$K_{\mathrm{sess}}=\mathrm{HKDF}\left(s{s}_{R\to V}\parallel s{s}_{V\to R}\parallel H(Aut{h}_V)\parallel \beta \right)$$

(10)

where $s{s}_{R\to V}$ and $s{s}_{V\to R}$ are the two independently established directional ML-KEM shared secrets, $H\left(Aut{h}_V\right)$ binds the authenticated vehicle with the session-key derivation, and $\beta$ denotes the complete canonical transcript binder.

Algorithm 1 PQ-resilient pseudonymous authentication and key establishment

Require: Vehicle identity $I{D}_V$, vehicle attributes $Att{r}_V$, TA key pair $(p{k}_{TA},s{k}_{TA})$, RSU signing key pair $(p{k}_R,s{k}_R)$, and security parameter $\lambda$

Ensure: Short-lived pseudonym credential ${\mathrm{PCert}}_V^{\left(j\right)}$ and session key $Ke{y}_{\mathrm{sess}}$        Phase 1: Vehicle Registration and Pseudonym Provisioning   1: ${\sigma }_V\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$   2: $C_V\leftarrow H(I{D}_V\parallel Att{r}_V\parallel {\sigma }_V)$   3: $(p{k}_V,s{k}_V)\leftarrow \mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{KeyGen}\left(\right)$   4: $r_V\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$   5: $PI{D}_V\leftarrow H(C_V\parallel p{k}_V\parallel r_V)$   6: TA stores the protected registration record ${\mathcal{R}}_V\leftarrow (I{D}_V,C_V,PI{D}_V,p{k}_V,\mathrm{Validity},\mathrm{Status})$   7: ${\eta }_j\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$   8: $PI{D}_V^{\left(j\right)}\leftarrow H(PI{D}_V\parallel {\eta }_j)$   9: ${\sigma }_{TA}^{\left(j\right)}\leftarrow \mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}\left(s{k}_{TA},H(PI{D}_V^{\left(j\right)}\parallel p{k}_V\parallel {\mathrm{Validity}}_j)\right)$ 10: ${\mathrm{PCert}}_V^{\left(j\right)}\leftarrow \left(PI{D}_V^{\left(j\right)},p{k}_V,{\mathrm{Validity}}_j,{\sigma }_{TA}^{\left(j\right)}\right)$ 11: TA securely provisions a pool of short-lived pseudonym credentials ${\mathrm{PCert}}_V^{\left(j\right)}$ to the vehicle        Phase 2: Vehicle Authentication Request 12: Vehicle selects a fresh unused ${\mathrm{PCert}}_V^{\left(j\right)}$ 13: $(ep{k}_V,es{k}_V)\leftarrow \mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{KeyGen}\left(\right)$ 14: $n_V\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$ 15: $t_V\leftarrow \mathrm{Timestamp}\left(\right)$ 16: $Aut{h}_V\leftarrow (PI{D}_V^{\left(j\right)},ep{k}_V,n_V,t_V)$ 17: ${\sigma }_V^{\mathrm{auth}}\leftarrow \mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}\left(s{k}_V,H(Aut{h}_V\parallel {\mathrm{PCert}}_V^{\left(j\right)})\right)$ 18: Vehicle sends $⟨{\mathrm{PCert}}_V^{\left(j\right)},Aut{h}_V,{\sigma }_V^{\mathrm{auth}}⟩$ to the RSU        Phase 3: RSU Verification and Response 19: RSU verifies ${\sigma }_{TA}^{\left(j\right)}$ using $p{k}_{TA}$ 20: RSU checks the validity and revocation status of ${\mathrm{PCert}}_V^{\left(j\right)}$ 21: RSU verifies that the $PI{D}_V^{\left(j\right)}$ in $Aut{h}_V$ matches the one authenticated by ${\mathrm{PCert}}_V^{\left(j\right)}$ 22: RSU obtains $p{k}_V$ from the valid pseudonym credential and verifies ${\sigma }_V^{\mathrm{auth}}$ 23: RSU verifies the freshness of $n_V$ and $t_V$ 24: $(ep{k}_R,es{k}_R)\leftarrow \mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{KeyGen}\left(\right)$ 25: $(c{t}_{R\to V},s{s}_{R\to V})\leftarrow \mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{Encap}\left(ep{k}_V\right)$ 26: $n_R\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$ 27: $t_R\leftarrow \mathrm{Timestamp}\left(\right)$ 28: ${\beta }_R\leftarrow H\left(PI{D}_V^{\left(j\right)}\parallel ep{k}_V\parallel ep{k}_R\parallel c{t}_{R\to V}\parallel n_V\parallel n_R\parallel t_V\parallel t_R\right)$ 29: ${\sigma }_R\leftarrow \mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}(s{k}_R,{\beta }_R)$ 30: RSU sends $⟨ep{k}_R,c{t}_{R\to V},n_R,t_R,{\sigma }_R⟩$ to the vehicle        Phase 4: Vehicle Verification and KEM Contribution 31: Vehicle verifies the freshness of $n_R$ and $t_R$ 32: Vehicle verifies ${\sigma }_R$ using $p{k}_R$ 33: $s{s}_{R\to V}^V\leftarrow \mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{Decap}(es{k}_V,c{t}_{R\to V})$ 34: $(c{t}_{V\to R},s{s}_{V\to R}^V)\leftarrow \mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{Encap}\left(ep{k}_R\right)$ 35: $\beta \leftarrow H({\beta }_R\parallel c{t}_{V\to R})$ 36: ${\sigma }_V^{\mathrm{fin}}\leftarrow \mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}(s{k}_V,\beta )$ 37: Vehicle sends $⟨c{t}_{V\to R},{\sigma }_V^{\mathrm{fin}}⟩$ to the RSU        Phase 5: RSU Verification and Session-Key Derivation 38: RSU verifies ${\sigma }_V^{\mathrm{fin}}$ using $p{k}_V$ 39: $s{s}_{V\to R}^R\leftarrow \mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{Decap}(es{k}_R,c{t}_{V\to R})$ 40: Vehicle derives $$Ke{y}_{\mathrm{sess}}^V\leftarrow \mathrm{HKDF}\left(s{s}_{R\to V}^V\parallel s{s}_{V\to R}^V\parallel H(Aut{h}_V)\parallel \beta \right)$$ 41: RSU derives $$Ke{y}_{\mathrm{sess}}^R\leftarrow \mathrm{HKDF}\left(s{s}_{R\to V}\parallel s{s}_{V\to R}^R\parallel H(Aut{h}_V)\parallel \beta \right)$$ 42: By ML-KEM correctness, $s{s}_{R\to V}^V=s{s}_{R\to V}$ and $s{s}_{V\to R}^R=s{s}_{V\to R}^V$ 43: Therefore, $Ke{y}_{\mathrm{sess}}^V=Ke{y}_{\mathrm{sess}}^R=Ke{y}_{\mathrm{sess}}$        Phase 6: Secure Erasure and Credential Update 44: Vehicle securely erases $es{k}_V$ and its local copies of $s{s}_{R\to V}^V$ and $s{s}_{V\to R}^V$ 45: RSU securely erases $es{k}_R$ and its local copies of $s{s}_{R\to V}$ and $s{s}_{V\to R}^R$ 46: Vehicle marks ${\mathrm{PCert}}_V^{\left(j\right)}$ as used and does not reuse it in subsequent authentication sessions 47: return $\left({\mathrm{PCert}}_V^{\left(j\right)},Ke{y}_{\mathrm{sess}}\right)$

3.3. Communication Model

Vehicular networks generally support both V2I and V2V communication. In this work, the proposed protocol is specifically the authentication and key establishment protocol and is instantiated and evaluated for the V2I communication scenario between a vehicle and an RSU. Vehicles exchange authenticated safety messages with RSUs and neighboring vehicles periodically through Dedicated Short-Range Communication (DSRC), 5G enabled vehicular communication or future 6G intelligent transportation models.

The communication environment has the following requirements: (i) high node mobility, (ii) short communication sessions, (iii) dynamic topology changes, (iv) frequent authentication requests, and (v) strict latency requirements.

Due to these requirements, the authentication protocols must provide fast establishment of session while ensuring security and privacy. The proposed protocol assumes that vehicles may enter and leave the coverage zone of RSUs dynamically. As a result, the authentication process must support seamless session establishment without requiring repeated long-term credential exposure.

Adversarial Model

The proposed system considers a quantum polynomial-time (QPT) adversarial model where the adversary $\mathcal{A}$ possesses complete control over public communication channels. The following are the Dolev–Yao adversarial assumptions, so the adversary can: (i) eavesdrop on communication, (ii) replay previous protocol transcripts, (iii) modify transmitted messages, (iv) launch impersonation attacks, (v) inject fabricated authentication messages, (vi) attempt session correlation and tracking, and (vii) perform transcript manipulation attacks.

Formally, the adversary can access the following oracles:

Send Oracle (${\mathit{O}}_{\mathrm{execute}}$): Allows passive observation of honest protocol executions.

Reveal Oracle (${\mathit{O}}_{\mathrm{reveal}}$): Reveals established session keys of non-test sessions.

Corrupt Oracle (${\mathit{O}}_{\mathrm{corrupt}}$): Reveals the long-term secret keys of compromised entities.

Test Oracle (OTest): The adversary may issue this query once to a fresh completed session. The challenger then selects a random bit b. So if b = 1, the oracle returns the original established session key; otherwise, it returns a uniformly random string of same length. The adversary generates a guess $b^{\prime }$, and its AKE advantage can be defined according to its capability to distinguish the real key from a random value. A session is considered fresh only if its session key has not been revealed and the corresponding relevant ephemeral secrets have not been exposed before completion of the tested session.

The adversary is assumed to be capable of performing quantum attacks against traditional PKI assumptions. Therefore, ECC and RSA-based schemes are considered insecure under the proposed threat model. However, the adversary cannot break the following efficiently: (i) IND-CCA security of ML-KEM, (ii) EUF-CMA security of ML-DSA, (iii) pseudorandomness of HKDF, and (iv) collision resistance of hash functions.

3.4. Pseudonym Lifecycle and Conditional Traceability

During registration, TA verifies real identity $I{D}_V$ and maintains a protected registration mapping:

$${\mathcal{R}}_V=(I{D}_V,C_V,PI{D}_V,p{k}_V,\mathrm{Validity},\mathrm{Status}).$$

(11)

For every authentication session, the vehicle derives a session-specific pseudonym using fresh randomness ${\eta }_j$ as mentioned in Equation (9). Credential revocation is performed against the base credentials issued by the TA and associated public key instead of every transient session pseudonym. The TA distributes the authenticated revocation status to RSU. When administratively or legally authorized accountability is required, the TA can then resolve the authenticated base credentials to its protected registration record. Hence, conditional traceability is available to the TA, while peer vehicles and external observers cannot directly resolve the real identities of vehicles from its session-specific pseudonym.

3.5. Architectural and Deployment Assumptions

The following architectural and deployment assumptions are made for the proposed protocol. First, RSU and vehicles obtain authenticated time from a trusted synchronization source or RSU-assisted time synchronization. The received timestamp t is only considered fresh if

$$|t_{\mathrm{recv}}-t_{\mathrm{msg}}|\le \Delta ,$$

(12)

where $\Delta$ represents deployment-specific clock-skew tolerance. Nonce validation is used, as it does not rely on timestamp synchronization. Second, the TA is the major trusted body that distributes or anchors its public verification keys $p{k}_{TA}$ securely during system provisioning. RSU and vehicle public authentication keys are bound to the TA-assisted credentials, ensuring communicating entities verify their authenticity before accepting messages. Third, credential revocation is managed by the TA through authenticated revocation approach. THe TA distributes signed certificates revocation list (CRLs) periodically or similar authenticated credential-status information periodically to RSU. RSU then checks the revocation status and validity of the presented pseudonym credential before completing authentication. Fourth, the TA maintains protected mapping between registered real identities and corresponding base credentials and pseudonym record. This mapping never gets exposed during V2I and V2V authentication and can only be accessed for authorized credential management, identity-resolution and revocation. Finally, communication among the TA and RSU is assumed to occur over an integrity-protected and authenticated control channel. This channel is used for the credential provisioning, policy updates, trust-anchor distribution and dissemination of the revocation status. Compromise of the TA is outside of the scope of the threat model, as the TA constitutes the root of trust for the proposed system.

In addition to a QPT adversary, the security model also considers concurrent protocol sessions, attempts to exploit compromised network entities, and compromise of the RSU or vehicle long-term credentials. An adversary may observe, replay, modify, or inject messages across multiple sessions and may also try to compromise individual RSUs or vehicles. The compromise of session-specific ephemeral secrets is separately treated in forward secrecy.

3.6. Design Goals

The proposed protocol is designed to satisfy the following functional and security objectives:

(i)

Quantum Resilience: The proposed protocol remains secure against quantum polynomial-time adversaries by incorporating the NIST-standardized post-quantum cryptographic primitives ML-KEM and ML-DSA.

(ii)

Mutual Authentication: The proposed protocol must ensure bidirectional authentication among RSUs and vehicles through authenticated transcript verification:

$$\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Verify}\left(p{k}_V,\beta ,{\sigma }_V\right)=1,$$

(13)

$$\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Verify}\left(p{k}_R,\beta ,{\sigma }_R\right)=1.$$

(14)

(iii)

Dynamic Unlinkability: The proposed protocol must prevent session correlation attacks through dynamic pseudonym generation using Equation (9), ensuring

$$Pr\left[PI{D}_V^i=PI{D}_V^j\right]\le {\epsilon }_{\mathrm{coll}}\left(\lambda \right),i\ne j.$$

(15)

(iv)

Forward Secrecy: The proposed protocol must protect previous session keys even if the long-term authentication keys are compromised. Therefore, session key derivation uses dual ephemeral entropy using Equation (10).

(v)

Replay Resilience: The proposed protocol incorporates nonce and timestamp freshness validation:

$$\left|t_{\mathrm{now}}-t_V\right|\le \Delta ,$$

(16)

to prevent the replay authentication messages.

(vi)

Transcript Integrity: All authentication and key exchange parameters are bound cryptographically through

$$\beta =H\left(PI{D}_V^j\parallel ep{k}_V\parallel ep{k}_R\parallel c{t}_{R\to V}\parallel c{t}_{V\to R}\parallel n_V\parallel n_R\parallel t_V\parallel t_R\right),$$

(17)

thereby preventing transcript manipulation MITM attacks.

(vii)

Lightweight Communication: The proposed protocol must ensure low computational and communication overhead as required for highly dynamic vehicle communication networks with strict latency constraints.

4. Proposed UPQ-PAKE Protocol

The following equations define the UPQ-PAKE protocol operations formally using the notation and cryptographic primitives introduced previously.

4.1. Protocol Overview

The proposed protocol provides secure communication for IoV networks employing dynamic pseudonymous identity generation, transcript-bound mutual authentication and dual-ephemeral key establishment in a unified authentication framework. Unlike traditional authentication protocols, the proposed protocol uses ML-KEM and ML-DSA for session key establishment and PQ-mutual authentication. It consists of four major phases:

(i)

System Initialization Phase;

(ii)

Vehicle Registration Phase;

(iii)

Mutual Authentication Phase;

(iv)

Session Key Establishment Phase.

The major notations and symbols used in the proposed protocol are mentioned in Table 2.

Table 2. Notation summary.

Notation	Description
$TA$	Trusted Authority
$p{k}_{TA},s{k}_{TA}$	Public verification key and private signing key
$V_i$	Vehicle i
$I{D}_V$	Vehicle identity
$Att{r}_V$	Vehicle attributes
$PI{D}_V$	Vehicle pseudonymous identity
$PI{D}_V^j$	Dynamic session pseudonym
$p{k}_V,s{k}_V$	Vehicle public/private key pair
$p{k}_R,s{k}_R$	RSU public/private key pair
$ep{k}_V,es{k}_V$	Vehicle ephemeral ML-KEM key pair
$ep{k}_R,es{k}_R$	RSU ephemeral ML-KEM key pair
$s{s}_{R\to V},s{s}_{V\to R}$	Directional ML-KEM shared secrets
$c{t}_{R\to V},c{t}_{V\to R}$	Directional ML-KEM ciphertexts
$n_V,n_R$	Nonces
$t_V,t_R$	Timestamps
$H(·)$	Secure hash function
$\mathrm{HKDF}(·)$	Key derivation function
$\beta$	Transcript binder
$\lambda$	Security parameter
$\mathit{RegRec}$	Registration record
$r_V$	Registration randomness
$PI{D}_V$	Resulting static pseudonymous identity of the vehicle
$PI{D}_V^{\left(i\right)}$, $PI{D}_V^{\left(j\right)}$	pseudonymous identity of the same vehicle used in communication sessions i and j, respectively
$C_V$	Vehicle identity commitment
$r_V$	Vehicle registration randomness
${\eta }_j$	Fresh randomness for session-specific pseudonym generation
$\mathrm{Validity}$	Credential validity information
${\mathrm{Validity}}_j$	Validity period of the session-specific pseudonym credential
$\mathrm{Policy}$	Credential policy information
$\mathrm{Status}$	Credential status information
$R_V$	Protected vehicle registration record
$\mathrm{RegRec}$	Vehicle registration record
$PCer{t}_V^{\left(j\right)}$	Session-specific pseudonym credential

4.2. System Initialization Phase

During initialization, TA generates a global public/private key pair and initializes the PQ-cryptographic environment. TA generates the ML-DSA signing key pair using Equation (7). It also defines the security parameter $\lambda$, the secure hash function $H(·)$, the key derivation function $\mathrm{HKDF}(·)$, and the certificate validation policies. The resulting public system parameters are published as

$$P=\left\{p{k}_{TA},H(·),\mathrm{HKDF}(·),\lambda \right\}.$$

(18)

The corresponding private signing key, $s{k}_{TA}$, is securely protected within TA.

4.3. Vehicle Registration Phase

Before participating in communication, every vehicle must get registered with TA.

The vehicle first selects the random registration entropy:

$${\sigma }_V\in {\{0,1\}}^{\lambda }.$$

(19)

The vehicle identity commitment is generated using Equation (8). The vehicle then generates its long-term PQ-signature keys such as

$$(p{k}_V,s{k}_V)=\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{KeyGen}\left(\right).$$

(20)

For preserving anonymity, the vehicle constructs a pseudonymous identity as

$$PI{D}_V=H\left(C_V\parallel p{k}_V\parallel r_V\right),$$

(21)

where $r_V\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$ denotes fresh pseudonym randomness. The TA maintains the following protected registration record for accountability and revocation:

$${\mathcal{R}}_V=(I{D}_V,C_V,PI{D}_V,p{k}_V,\mathrm{Validity},\mathrm{Status}).$$

(22)

The registration record is then constructed as

$$RegRec=\left(PI{D}_V,p{k}_V,C_V,Validity,Policy\right).$$

(23)

TA signs the RegRec using ML-DSA as

$${\sigma }_{TA}=\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}\left(s{k}_{TA},RegRec\right).$$

(24)

The authenticated pseudonymous certificate becomes

$$Cer{t}_V=\left({\sigma }_{TA},RegRec\right).$$

(25)

Finally, the vehicle stores

$$Stor{e}_V=\left(I{D}_V,Att{r}_V,{\sigma }_V,p{k}_V,s{k}_V,PI{D}_V,Cer{t}_V\right).$$

(26)

To avoid exposing persistent base pseudonym during authentication, TA pre-issues a pool of short-lived pseudonym credentials for every registered vehicle. Every credential binds a session pseudonym to the authenticated verification key of vehicle without disclosing the base pseudonym $PI{D}_V$ and real identity $I{D}_V$.

$$PCer{t}_V^{\left(j\right)}=\left(PI{D}_V^{\left(j\right)},p{k}_V,{\mathrm{Validity}}_j,{\sigma }_{TA}^{\left(j\right)}\right).$$

(27)

$${\sigma }_{TA}^{\left(j\right)}=\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}\left(s{k}_{TA},H(PI{D}_V^{\left(j\right)}\parallel p{k}_V\parallel {\mathrm{Validity}}_j)\right).$$

(28)

4.4. Mutual Authentication Phase

When a vehicle enters the communication range of an RSU, the authentication phase starts.

The vehicle verifies the integrity of its certificate first:

$$\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Verify}\left(p{k}_{TA},{\sigma }_{TA},\mathrm{RegRec}\right)=1$$

(29)

The vehicle generates its ephemeral ML-KEM key pair:

$$(ep{k}_V,es{k}_V)=\mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{KeyGen}\left(\right).$$

(30)

Similarly, RSU generates its own ephemeral KEM key pair:

$$(ep{k}_R,es{k}_R)=\mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{KeyGen}\left(\right).$$

(31)

The ephemeral ML-KEM key pair in Equations (30) and (31) get generated independently for every authentication session through a cryptographically secure pseudorandom number generator (CSPRNG). These ephemeral keys are not reused across various authentication session.

To strengthen unlinkability, the vehicle transforms its pseudonym using fresh session entropy dynamically using

$${\eta }_j\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }.$$

(32)

The dynamic session pseudonym gets computed using Equation (9). This construction ensures that pseudonyms are different across sessions as

$$PI{D}_V^i\ne PI{D}_V^j,\forall i\ne j.$$

(33)

Thus, deterministic session correlation is preserved.

The vehicle then generates authentication freshness parameters:

$$n_V\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda },$$

(34)

$$t_V=\mathrm{Timestamp}\left(\right).$$

(35)

The authentication request becomes

$$Aut{h}_V=\left(PI{D}_V^j,ep{k}_V,n_V,t_V\right).$$

(36)

The vehicle then computes the authentication signature:

$${\sigma }_V^{auth}=\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}\left(s{k}_V,H(Aut{h}_V\parallel PCer{t}_V^{\left(j\right)})\right).$$

(37)

The vehicle transmits the message: $⟨{\mathrm{PCert}}_V^{\left(j\right)},Aut{h}_V,{\sigma }_V^{auth}⟩$ to the RSU.

4.5. RSU Verification and Session Establishment

When the authentication request is received by RSU, it validates: (i) TA signature contained in $PCer{t}_V^{\left(j\right)}$, (ii) checks credential validity/revocation, (iii) $PI{D}_V^{\left(j\right)}$ in $Aut{h}_V$ matches the one authenticated by ${\mathrm{PCert}}_V^{\left(j\right)}$, and (iv) obtains $p{k}_V$ from valid pseudonym credential and verifies ${\sigma }_V^{auth}$.

The RSU verifies the TA signature first:

$$\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Verify}\left(p{k}_{TA},RegRec,{\sigma }_{TA}\right)=1.$$

(38)

It then verifies the vehicle’s authentication signature:

$$\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Verify}\left(p{k}_V,H(Aut{h}_V\parallel Cer{t}_V),{\sigma }_V\right)=1.$$

(39)

Freshness validation is performed using Equation (16). The RSU then establishes the dual ephemeral session secrets. The first shared secret is

$$(c{t}_{R\to V},s{s}_{R\to V}^R)\leftarrow \mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{Encap}\left(ep{k}_V\right)$$

(40)

The RSU generates fresh nonce and timestamps:

$$\begin{array}{c}\hfill n_R\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda },\end{array}$$

(41)

$$\begin{array}{c}\hfill t_R\leftarrow \mathrm{Timestamp}\left(\right).\end{array}$$

(42)

4.6. Transcript Binding Phase

To resist transcript manipulation and MITM attacks, all the critical session parameters are bound to transcript binder cryptographically using Equation (17).

RSU signs the transcript binder:

$$\begin{array}{c}\hfill {\sigma }_R=\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}\left(s{k}_R,\beta \right).\end{array}$$

(43)

The RSU transmits the message $⟨ep{k}_R,c{t}_{R\to V},n_R,t_R,{\sigma }_R⟩$ to the vehicle.

4.7. Session Key Derivation Phase

The vehicle verifies the signature of RSU first:

$$\begin{array}{c}\hfill \mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Verify}\left(p{k}_R,\beta ,{\sigma }_R\right)=1.\end{array}$$

(44)

Once the RSU response is verified, the vehicle decapsulates the RSU generated ciphertext through its own ephemeral secret key:

$$s{s}_{R\to V}^V=\mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{Decap}\left(es{k}_V,c{t}_{R\to V}\right)$$

(45)

The vehicle also then decapsulates the second shared secret using the ephemeral public key of RSU

$$(c{t}_{V\to R},s{s}_{V\to R}^V)\leftarrow \mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{Encap}\left(ep{k}_R\right)$$

(46)

The vehicle then sends $c{t}_{V\to R}$ back to RSU, authenticated by the final transcript signature

$${\sigma }_V^{\mathrm{fin}}=\mathrm{ML}\text{-}\mathrm{DSA}.\mathrm{Sign}\left(s{k}_V,\beta \right)$$

(47)

$$V\to R:⟨c{t}_{V\to R},{\sigma }_V^{\mathrm{fin}}⟩$$

(48)

RSU verifies the signature and performs:

$$s{s}_{V\to R}^R=\mathrm{ML}\text{-}\mathrm{KEM}.\mathrm{Decap}\left(es{k}_R,c{t}_{V\to R}\right)$$

(49)

The final authenticated session key is derived:

$$K_{\mathrm{sess}}=\mathrm{HKDF}\left(s{s}_{R\to V}\parallel s{s}_{V\to R}\parallel H(Aut{h}_V)\parallel \beta \right)$$

(50)

The session depends on dual ephemeral entropy, transcript integrity and authenticated session context.

After successful derivation and confirmation of the session keys in Equation (50), the ephemeral secret keys and the intermediate shared secrets are erased securely once they are no longer required. This limits the exposure of completed sessions in the event of subsequent long-term key compromise.

4.8. Correctness Analysis

Correctness needs both the communicating entities to derive the identical shared secrets and same session key. By ML-KEM correctness,

$$s{s}_{R\to V}^R=s{s}_{R\to V}^V$$

(51)

RSU encapsulates with $ep{k}_V$ and the vehicle decapsulates the corresponding ciphertext using $es{k}_V$. Similarly,

$$s{s}_{V\to R}^V=s{s}_{V\to R}^R$$

(52)

Since the vehicle encapsulates with $ep{k}_R$ and RSU decapsulates using $es{k}_R$. Therefore,

$$K_{\mathrm{sess}}^V=K_{\mathrm{sess}}^R$$

(53)

Thereby, authenticated session agreement is ensured.

5. Security Analysis

5.1. Security Assumptions

Definition 1

(IND-CCA Security of ML-KEM). Let $\mathcal{A}$ be a quantum polynomial-time (QPT) adversary interacting with an ML-KEM challenger. The ML-KEM primitive is said to be IND-CCA secure if

$${\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{KEM}}^{\mathrm{IND}\text{-}\mathrm{CCA}}\left(\mathcal{A}\right)=\left|Pr\left[b^{\prime }=b\right]-{\displaystyle \frac{1}{2}}\right|\le \mathrm{negl}\left(\lambda \right),$$

(54)

where $b\in \{0,1\}$ is the random challenge bit selected by the challenger, $b^{\prime }$ is the adversary’s guess, and $\mathrm{negl}\left(\lambda \right)$ denotes a negligible function in the security parameter λ.

Definition 2

(EUF-CMA Security of ML-DSA). The ML-DSA signature scheme is existentially unforgeable under adaptive chosen-message attacks if

$${\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right)\le \mathrm{negl}\left(\lambda \right),$$

(55)

for every quantum polynomial-time (QPT) adversary $\mathcal{A}$, where $\mathrm{negl}\left(\lambda \right)$ denotes a negligible function in the security parameter λ.

Definition 3

(Random Oracle Assumption). The hash function:

$$H:{\{0,1\}}^{*}\to {\{0,1\}}^{\lambda },$$

(56)

is modeled as a random oracle.

5.2. Formal Security Definitions

Definition 4

(Authenticated Key Exchange Security). The proposed protocol satisfies AKE security if no adversary $\mathcal{A}$ can distinguish a real session key from a uniformly random key of the same length through a Test oracle with non-negligible advantage. Let $b\in \{0,1\}$ be the challenge bit selected by the Test oracle and $b^{\prime }$ be the adversary’s guess. The AKE advantage is defined as

$${Adv}_{\mathrm{AKE}}^{\mathrm{UPQ}\text{-}\mathrm{PAKE}}\left(\mathcal{A}\right)=\left|Pr[b^{\prime }=b]-{\displaystyle \frac{1}{2}}\right|\le negl\left(\lambda \right)$$

(57)

Partnering: Two completed protocol sessions are considered partnered if they get executed by the intended vehicle and RSU peers, also have matching session identifiers derived from the authenticated protocol transcript, and accept the same session key.

Definition 5

(Forward Secrecy). The protocol achieves forward secrecy if the long-term secret keys compromise does not reveal the previously established session keys.

Definition 6

(Dynamic Unlinkability). The proposed protocol achieves unlinkability if an adversary does not determine whether two sessions belong to the same vehicle.

Let λ be the security parameter, and the proposed protocol uses three cryptographic primitives: a collision-resistant hash function $H(·)$, post-quantum signature scheme ML-DSA and a post-quantum key encapsulation ML-KEM. Security of the proposed protocol is analyzed with the assumption that ML-DSA is unforgeable under the chosen message attack and ML-KEM is indistinguishable under the chosen ciphertext attacks, while HKDF behaves as a pseudorandom key derivation function.

The client generates a random value such as

$$r_V\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda },$$

(58)

and computes hidden identity commitment as mentioned in Equation (8), where real identities $I{D}_V$ and $Att{r}_V$ are hidden using secret randomness ${\sigma }_V$. So an adversary who finds $C_V$ cannot recover $I{D}_V$ unless it can invert the hash function or guess ${\sigma }_V$. The possibility of this recovery is bound by

$$Pr\left[\mathcal{A}\left(C_V\right)=I{D}_V\right]\le {\epsilon }_{\mathrm{pre}}\left(\lambda \right),$$

(59)

${\epsilon }_{\mathrm{pre}}\left(\lambda \right)$ is negligible.

The client then generates a post-quantum signature key pair using Equation (20). The pseudonymous identity is computed using Equation (21), where $r\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$, and it is ensured that the pseudonym is bound to hidden commitment $C_V$ and the public key $p{k}_V$, while random value r prevents deterministic pseudonym generation. Hence, even if the same vehicle gets registered again, a new r will result in different $PI{D}_V$. Registration record is defined in Equation (23) and the TA signs this record using Equation (24). The certificate is issued through Equation (25). The verifier will accept this certificate only if Equation (29) holds.

Therefore, an adversary cannot create a valid certificate unless it forges the TA signature. So formally,

$$Pr\left[\mathcal{A}\mathit{forges}a\mathit{valid}Cer{t}_V\right]\le {\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right).$$

(60)

During authentication, clients generate an ephemeral KEM key pair using Equation (30) and generates a fresh nonce as $n_V\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$ and timestamp as $t_V\leftarrow \mathrm{Timestamp}\left(\right)$. So the authentication message is generated using Equation (36). The client signs the authentication transcript using Equation (37). The verifier validates the client using Equation (39). If an adversary impersonates the client successfully without knowing $s{k}_V$, then the adversary is successful in forging a valid ML-DSA signature. Hence,

$$Pr\left[{\mathrm{Impersonate}}_V\right]\le {\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right).$$

(61)

The verifier also checks the freshness by validating Equation (16) and ensuring that

$$n_V\notin N_{\mathrm{used}},$$

(62)

where ${\mathcal{N}}_{\mathrm{used}}$ is the replay cache. Equations (16) and (62) prevent replay attacks. A replayed message will have an expired timestamp or previously used nonce. Therefore,

$$Pr\left[{\mathrm{Replay}}_{\mathrm{success}}\right]\le Pr\left[n_V\notin {\mathcal{N}}_{\mathrm{used}}\right]+Pr[|t_{\mathrm{now}}-t_V|\le \Delta ]+{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right).$$

(63)

If nonce storage is implemented correctly, then the first term becomes negligible. After successful validation, the verifier encapsulates a shared secret using Equation (40). The verifier generates its own timestamp and nonce $n_R\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$ and timestamp as $t_R\leftarrow \mathrm{Timestamp}\left(\right)$. The transcript binder gets computed using Equation (17). If an adversary modifies any value in Equation (17), the transcript binder gets changed. Therefore, the tampering of transcript is detected when the verifier signs using Equation (43). The client verifies the response of the verifier using Equation (14), which provides the verifier’s authentication. So, if an adversary tries to impersonate any verifier, it must forge ${\sigma }_R$. Thus,

$$Pr\left[{\mathrm{Impersonate}}_R\right]\le {\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right).$$

(64)

The client will decapsulate the cipher using Equation (45). By KEM correctness,

$$Pr\left[(s{s}_{R\to V}^E=s{s}_{R\to V}^D)\wedge (s{s}_{V\to R}^E=s{s}_{V\to R}^D)\right]\ge 1-{\epsilon }_{\mathrm{correct}}\left(\lambda \right),$$

(65)

where ${\epsilon }_{\mathrm{correct}}\left(\lambda \right)$ denotes a negligible function in the security parameter λ.

The final session key is derived using Equation (50). It shows that the session key is dependent on both the authentication transcript β and post-quantum shared secret $ss$. So even if an adversary can observe all the public messages, it still cannot compute $Ke{y}_{\mathrm{sess}}$ without recovering $ss$.

5.3. Authenticated Key Exchange Security

Game ${\mathit{G}}_{\mathbf{0}}$. $G_0$ represents the real execution of the proposed protocol:

$$Pr\left[G_0\right]=Pr\left[\mathcal{A} \mathrm{wins}\right].$$

(66)

Game ${\mathit{G}}_{\mathbf{1}}$. Replace the random oracle outputs with uniform random values:

$$\left|Pr\left[G_1\right]-Pr\left[G_0\right]\right|\le {\displaystyle \frac{q_H^2}{2^{\lambda }}},$$

(67)

where $q_H$ represents the number of hash queries.

Game ${\mathit{G}}_{\mathbf{2}}$. Replace ML-KEM shared secrets $s{s}_{R\to V},s{s}_{V\to R}$ with uniform random strings, then

$$\left|Pr\left[G_2\right]-Pr\left[G_1\right]\right|\le 2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{KEM}}^{\mathrm{IND}\text{-}\mathrm{CCA}}\left(\mathcal{B}\right).$$

(68)

Game ${\mathit{G}}_{\mathbf{3}}$. Replace HDKF output with a random session key:

$$\left|Pr\left[G_3\right]-Pr\left[G_2\right]\right|\le {\epsilon }_{\mathrm{HKDF}}.$$

(69)

Combining all games,

$${\mathrm{Adv}}_{\mathrm{AKE}}^{\mathrm{UPQ}\text{-}\mathrm{PAKE}}\left(\mathcal{A}\right)\le {\displaystyle \frac{q_H^2}{2^{\lambda }}}+2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{KEM}}^{\mathrm{IND}\text{-}\mathrm{CCA}}\left(\mathcal{B}\right)+{\epsilon }_{\mathrm{HKDF}}.$$

(70)

5.4. Mutual Authentication Theorem

The proposed protocol provides mutual authentication among the verifier and the vehicle. For vehicular authentication, the verifier accepts using Equation (39). Therefore, if an adversary tries to impersonate a vehicle, it must produce a valid signature without knowing $s{k}_V$. Hence,

$$Pr\left[\mathcal{A}\mathrm{impersonates}V\right]\le {\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right).$$

(71)

For authentication of the verifier, the client accepts. Hence,

$$Pr\left[\mathcal{A}\mathrm{impersonates}R\right]\le 2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right).$$

(72)

The total probability of authentication failure is bound by

$$Pr\left[{\mathrm{MutualAuth}}_{\mathrm{failure}}\right]\le 2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right).$$

(73)

5.5. Dynamic Unlinkability Analysis Theorem

The proposed protocol achieves dynamic unlinkability under the random oracle model.

During every authentication session j, the vehicle generates a fresh session-specific pseudonym as mentioned in Equation (9), where ${\eta }_j$ is uniformly selected session entropy. Assume an adversary attempts to determine whether two observed sessions belong to the same vehicle. The adversary observes Equation (15), which means the adversary cannot correlate authentication sessions with non-negligible probability. Hence, the protocol achieves dynamic unlinkability and prevents the long-term tracking of vehicles.

5.6. Replay Attack Resistance Theorem

The proposed protocol resists replay attacks under the uniqueness of nonce and freshness of timestamp. The verifier accepts a vehicle message using Equations (16) and (62). So a replayed message needs to satisfy both the uniqueness of the nonce and the freshness of the timestamp. Since $n_V$ is selected randomly from ${\{0,1\}}^{\lambda }$, the probability of guessing the fresh nonce is

$$Pr\left[{\mathrm{NonceCollision}}_V\right]\le {\displaystyle \frac{q^2}{2^{\lambda +1}}},$$

(74)

where q is the total number of protocol sessions. Thus,

$$Pr[{\mathrm{Replay}}_{\mathrm{success}}]\le Pr[n_V\notin {\mathcal{N}}_{\mathrm{used}}]·Pr[|t_{\mathrm{now}}-t_V|\le \Delta ]$$

(75)

For a previously accepted transcript, the nonce is contained in ${\mathcal{N}}_{\mathrm{used}}$, so the replay is rejected even if the timestamp lies within the freshness window. The EUF-CMA security of ML-DSA is relevant only if an adversary modifies the replayed transcript and tries to attempt to generate a valid signature for the modified message.

5.7. Man-in-the-Middle Attack Resistance Theorem

The proposed protocol is resilient to man-in-the-middle attacks because authentication and key-establishment parameters are bound to a single canonical transcript binder $\beta$ cryptographically. Specifically, $\beta$ contains a session-specific pseudonym, both ephemeral public keys, both directional ML-KEM ciphertexts, nonces, and timestamps. Hence, any modification to these values generates a different transcript binder. So if an adversary tries to modify any value, then the altered binder becomes

$${\beta }^{\prime }=H\left(PI{D}_V^{\left(j\right)\prime }\parallel ep{k}_V^{\prime }\parallel ep{k}_R^{\prime }\parallel c{t}_{R\to V}^{\prime }\parallel c{t}_{V\to R}^{\prime }\parallel n_V^{\prime }\parallel n_R^{\prime }\parallel t_V^{\prime }\parallel t_R^{\prime }\right)$$

(76)

For an attack to remain undetected, the adversary must satisfy

$${\beta }^{\prime }=\beta .$$

(77)

This implies a collision hash unless the transcript is unchanged. Therefore,

$$Pr\left[\mathcal{A}\mathrm{produces}{\beta }^{\prime }=\beta \right]\le {\epsilon }_{\mathrm{coll}}\left(\lambda \right).$$

(78)

Moreover, the attacker must also forge the signature of the verifier. Hence,

$$Pr\left[{\mathrm{MITM}}_{\mathrm{success}}\right]\le {\epsilon }_{\mathrm{coll}}\left(\lambda \right)+{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left(\mathcal{A}\right).$$

(79)

5.8. Forward Secrecy Analysis Theorem

Assuming that ML-KEM is IND-CCA secure and HKDF is the pseudorandom key derivative function, the proposed protocol provides forward secrecy. For any quantum polynomial-time adversary $\mathcal{A}$, the forward secrecy advantage is bound to

$${\mathrm{Adv}}_{\mathrm{FS}}^{\mathrm{UPQ}\text{-}\mathrm{PAKE}}\left(\mathcal{A}\right)\le 2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{KEM}}^{\mathrm{IND}\text{-}\mathrm{CCA}}\left(\mathcal{B}\right)+{\epsilon }_{\mathrm{HKDF}}\left(\lambda \right),$$

(80)

where $\mathcal{B}$ is an efficient reduction algorithm and ${\epsilon }_{\mathrm{HKDF}}\left(\lambda \right)$ is negligible.

5.9. Session Key Indistinguishability Theorem

The proposed protocol achieves the indistinguishability of the session key only if ML-KEM is IND-CCA secure, ML-DSA is EUF-CMA secure, HKDF is pseudorandom and H is collision resistant.

For any quantum polynomial-time (QPT) adversary $\mathcal{A}$,

$${\mathrm{Adv}}_{\mathrm{PQ}\text{-}\mathrm{Auth}}^{\mathrm{AKE}}\left(\mathcal{A}\right)\le {\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{KEM}}^{\mathrm{IND}\text{-}\mathrm{CCA}}\left({\mathcal{B}}_1\right)+2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left({\mathcal{B}}_2\right)+{\epsilon }_{\mathrm{coll}}\left(\lambda \right)+{\epsilon }_{\mathrm{HKDF}}\left(\lambda \right).$$

(81)

The protocol follows a hybrid argument, where in real game $G_0$, the adversary sees the real protocol execution. In game $G_1$, the game gets aborted if an adversary forges either the verifier’s signature ${\sigma }_R$ or the client’s signature ${\sigma }_V$. The difference between both games is bound by

$$\left|Pr\left[G_0\right]-Pr\left[G_1\right]\right|\le 2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left({\mathcal{B}}_2\right).$$

(82)

In game $G_2$, the real KEM shared secret ss gets replaced by uniform random value u. So, any adversary detecting this replacement can be used to break the IND-CCA security of ML-KEM as Equation (68).

To improve reproducibility, all performance experiments were executed using the hardware and software configuration reported in Table 3. The simulation duration, cryptographic parameter sets, number of vehicles, mobility range, number of RSUs, and communication settings were kept identical across repeated experiments. The same parameter configuration was used for all schemes included in the comparative evaluation.

Table 3. Experimental setup and simulation parameters.

Parameter	Configuration
Processor	Intel Core i7-12700 (12th Generation)
CPU Base/Maximum Turbo Clock	2.10 GHz/4.90 GHz
RAM	16 GB DDR4
Operating System	Ubuntu 22.04 LTS
Python Version	Python 3.10.12
C++ Compiler	GCC 11.4.0
Cryptographic Library	liboqs 0.14.0
Hash Function	SHA3-256
Security Level	NIST Security Level 3
ML-KEM Parameter Set	ML-KEM-768
ML-DSA Parameter Set	ML-DSA-65
Simulator	OMNeT++ 6.1
Mobility Simulator	SUMO 1.20.0
Network Type	Vehicle-to-Infrastructure (V2I)
Communication Standard	IEEE 802.11p/5G NR-V2X
Simulation Area	1000 m × 1000 m
Number of Vehicles	50–500
Number of RSUs	5–20
Vehicle Speed	20–200 km/h
Message Size	Based on ML-KEM-768 and ML-DSA-65
Key Derivation Function	HKDF-SHA3
Simulation Duration	300–600 s
Independent Simulation Runs	20

Each experimental configuration was executed independently 20 times. For each reported performance metric, the arithmetic mean and standard deviation were computed across 20 independent runs. Accordingly, the results are reported as mean ± standard deviation to characterize run-to-run variability.

In game $G_3$, the session key

$$K_{\mathrm{sess}}=\mathrm{HKDF}\left(u_{R\to V}\parallel u_{V\to R}\parallel H(Aut{h}_V)\parallel \beta \right)$$

(83)

In the corresponding hybrid games, the two directional ML-KEM shared secrets $s{s}_{R\to V}$ and $s{s}_{V\to R}$ are replaced by the independent uniformly random values $u_{R\to V}$ and $u_{V\to R}$, respectively.

In $G_3$, the adversary receives a random key independent of its view. Hence, combining hybrid gaps as

$$Pr[b^{\prime }=b]={\displaystyle \frac{1}{2}}.$$

(84)

5.10. Computational Complexity

Assume adversary runs t, hash queries qH, and session queries qs, then

$${\mathrm{Adv}}_{\mathrm{Total}}\left(\mathcal{A}\right)\le {\displaystyle \frac{q^2}{2^{\lambda +1}}}+2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{KEM}}^{\mathrm{IND}\text{-}\mathrm{CCA}}\left({\mathcal{B}}_1\right)+2{\mathrm{Adv}}_{\mathrm{ML}\text{-}\mathrm{DSA}}^{\mathrm{EUF}\text{-}\mathrm{CMA}}\left({\mathcal{B}}_2\right)+{\epsilon }_{\mathrm{HKDF}}\left(\lambda \right).$$

(85)

5.11. Identity Privacy

Scope of Unlinkability and Metadata Privacy

The dynamic pseudonym approach of UPQ-PAKE ensures cryptographic unlinkability by restricting external observers from correlating authentication sessions directly through persistent pseudonymous identifier. However, this property does not ensure complete protection against physical-layer or cross-layer vehicle tracking. An adversary may try to attempt correlating different sessions through auxiliary metadata such as mobility trajectory, vehicle location, speed, network-layer identifier, message timings or radio-frequency fingerprints. This information is external to the cryptographic transcript presented in the security model. Hence, the unlinkability claim of UPQ-PAKE is limited to cryptographic identifiers and authentication transcripts and does not claim resistance against physical-layer or metadata-based tracking attacks. Addressing these cross-layer correlation attacks need a complementary privacy approach and is considered out of the scope of the present work.

During authentication, neither real identity $I{D}_V$ nor persistent base pseudonym $PI{D}_V$ gets transmitted over an open channel. Rather, the vehicle uses a session-specific pseudonym $PI{D}_V^{\left(j\right)}$ and TA-authorized short-lived pseudonym credential $PCer{t}_V^{\left(j\right)}$. As a result, external observers cannot correlate the authentication session directly through persistent identifier provided in the authentication credential. The mapping between pseudonym credential and registered vehicle is maintained by the TA only for the authorized accountability and revocation. So, an adversary trying to recover $I{D}_V$ from $PI{D}_V$ must invert both hashes or guess the hidden randomness of ${\rho }_V$ and $r_V$. Therefore,

$$Pr\left[\mathcal{A}\left(PI{D}_V\right)=I{D}_V\right]\le {\epsilon }_{\mathrm{pre}}\left(\lambda \right)+2^{-\lambda }.$$

(86)

Thus, the proposed protocol provides pseudonymous identity privacy.

5.12. DoS and Availability Considerations

For improving resilience against Denial-of-service (DoS) and resource exhaustion attacks, RSU performs inexpensive checks such as timestamp, message-format, credential-status and nonce validation before executing expensive ML-DSA verification and ML-KEM operations. Practical deployment may require rate limiting and bounded request queues for restricting excessive authentication requests. All these techniques mitigate computational flooding; however, complete DoS prevention is out of scope of the proposed protocol.

6. Performance Evaluation

6.1. Experimental Setup and Implementation Environment

For evaluating the practical feasibility of the proposed protocol, it has been implemented using standardized PQ cryptographic primitives based on NIST-PQ standardization framework. The implementation uses ML-KEM (former CRYSTALS-Kyber) for PQ key encapsulation and ML-DSA (former CRYSTALS-Dilithium) for PQ-digital signatures. The implementation environment is given in Table 3. All experiments were conducted on a workstation equipped with an Intel^® Core^TM i7-12700 12th-generation processor, operating at a base clock frequency of 2.10 GHz and a maximum turbo frequency of 4.90 GHz. The system was equipped with 16 GB DDR4 RAM. No GPU acceleration was used for reported cryptographic and simulation measurements.

The evaluated schemes are compared under consistent security assumptions, message count considerations, cryptographic parameter levels, and protocol design, and communication conditions are considered while interpreting the reported communication and computational overhead for a fair comparison. Hence, the comparison is intended to only provide a relatable assessment instead of an absolute performance ranking across heterogeneous deployment settings. The cryptographic operation costs and sizes of parameters used in the evaluation are based on the adopted ML-KEM and ML-DSA parameter settings and the benchmark environment described in this section.

6.2. Computational Overhead Analysis

The computational cost of the proposed protocol is analyzed based on the execution cost of individual PQ cryptographic operations. Table 4 represents the symbols used for the operations. The computation overhead is divided into (a) vehicle-side overhead, and (b) RSU-side overhead.

Table 4. Computational cost notation.

Operation	Symbol
ML-DSA Signature Generation	$T_{\mathrm{Sign}}$
ML-DSA Signature Verification	$T_{\mathrm{Verify}}$
ML-KEM Encapsulation	$T_{\mathrm{Encap}}$
ML-KEM Decapsulation	$T_{\mathrm{Decap}}$
Hash Function Evaluation	$T_H$
HKDF Derivation	$T_{\mathrm{HKDF}}$

(a) Vehicle-Side Computational Overhead

During authentication and session establishment, the vehicle performs: (i) two ML-DSA signature generation, (ii) one ML-DSA signature verification, (iii) one ML-KEM key generation, (iv) one ML-KEM encapsulation, (v) one ML-KEM decapsulation, (vi) multiple hash function evaluations, and (vii) one HKDF derivation.

The total computational overhead at vehicle-side is

$$C_{\mathrm{Vehicle}}=2T_{\mathrm{Sign}}+T_{\mathrm{Verify}}+T_{\mathrm{Encap}}+T_{\mathrm{Decap}}+5T_H+T_{\mathrm{HKDF}}$$

(87)

(b) RSU-Side Computational Overhead

RSU performs: (i) two ML-DSA signature verification operations, (ii) one ML-DSA signature generation, (iii) one ML-KEM signature generation, (iv) one ML-KEM encapsulation operation, (v) one ML-KEM decapsulation, (vi) transcript generation, (vii) multiple hash function evaluations and (viii) one HKDF derivation.

The computational overhead at RSU-side is

$$C_{\mathrm{RSU}}=2T_{\mathrm{Verify}}+T_{\mathrm{Sign}}+T_{\mathrm{Encap}}+T_{\mathrm{Decap}}+6T_H+T_{\mathrm{HKDF}}$$

(88)

Table 5 shows the computational cost comparison.

Table 5. Comparison of computational overhead.

Reference	Vehicle Overhead	RSU Overhead
[2]	$T_{\mathrm{Sign}}+T_{\mathrm{Verify}}+T_{\mathrm{Encap}}$	$2T_{\mathrm{Verify}}+T_{\mathrm{Encap}}$
[12]	$T_{\mathrm{Sign}}+T_{\mathrm{Encap}}+4T_H$	$T_{\mathrm{Verify}}+2T_{\mathrm{Encap}}$
Proposed UPQ-PAKE	$2T_{\mathrm{Sign}}+T_{\mathrm{Verify}}+T_{\mathrm{Encap}}+T_{\mathrm{Decap}}+5T_H+T_{\mathrm{HKDF}}$	$2T_{\mathrm{Verify}}+T_{\mathrm{Sign}}+T_{\mathrm{Encap}}+T_{\mathrm{Decap}}+6T_H+T_{\mathrm{HKDF}}$

The proposed scheme however introduces additional computational cost as compared with conventional ECC-based authentication due to PQ cryptographic operations. However, the measured authentication latency stays within the evaluated operational range. The additional cost is a security–performance trade-off that is raised due to quantum-resilient mutual authentication, dual key establishment and transcript binding.

Although the proposed protocol introduces a slightly higher transcript processing cost, it achieves stronger forward secrecy, dynamic unlinkability and transcript integrity compared with the available scheme. Figure 3 shows the computational overhead comparison. As mentioned in Table 6, both the vehicle and RSU perform one ML-KEM encapsulation and one ML-KEM decapsulation during session establishment. RSU performs verification of the vehicle’s authentication and also final transcript signatures while TA handles the registration and offline operations.

Figure 3. Comparison of computational overhead between the proposed UPQ-PAKE scheme and existing authentication schemes under the adopted benchmark settings.

Table 6. Practical computational requirements of UPQ-PAKE entities.

Entity	Expensive PQ Operations per Session	Deployment Implication
Vehicle	2 ML-DSA Sign + 1 Verify + 1 Encap + 1 Decap
RSU	2 ML-DSA Verify + 1 Sign + 1 Encap + 1 Decap
TA	Primarily registration/offline operations	Not on the critical V2X authentication path

6.3. Communication Overhead Analysis

Communication cost shows important performance metrics due to latency and bandwidth constraints. For the byte-level communication analysis, every nonce $n_V$ and $n_R$ is represented as a 256-bit random value (32 bytes), consistent with SHA3-256 security parameter. Timestamps $t_V$ and $t_R$, and the credential validity field $Validit{y}_j$, are encoded as 64-bit unsigned integer values (8 bytes each). These fixed-width encodings are used consistently in the communication-overhead calculation.

The proposed protocol transmits the following:

(i)

Vehicle certificate ($Cer{t}_V$);

(ii)

Authentication message ($Aut{h}_V$);

(iii)

ML-DSA signatures;

(iv)

ML-KEM ciphertexts;

(v)

Nonces and timestamps.

The total communication cost is computed as

$$\mathrm{Comm}=\left|{\mathrm{PCert}}_V^{\left(j\right)}\right|+\left|Aut{h}_V\right|+\left|{\sigma }_V^{\mathrm{auth}}\right|+\left|{\sigma }_R\right|+\left|{\sigma }_V^{\mathrm{fin}}\right|+\left|c{t}_{R\to V}\right|+\left|c{t}_{V\to R}\right|+\left|ep{k}_R\right|.$$

(89)

Using the ML-KEM-768 and ML-DSA-65 parameter sizes as presented in Table 7.

Table 7. Byte-level communication overhead of the UPQ-PAKE authentication exchange.

Transmitted Component	Occurrences	Bytes
$PCer{t}_V^{\left(j\right)}$	1	5301
$Aut{h}_V$	1	1256
${\sigma }_V^{\mathrm{auth}}$	1	3309
$ep{k}_R$	1	1184
$c{t}_{R\to V}$	1	1088
$n_R$	1	32
$t_R$	1	8
${\sigma }_R$	1	3309
$c{t}_{V\to R}$	1	1088
${\sigma }_V^{\mathrm{fin}}$	1	3309
Total	–	19,884

The total communication cost is approximately

$$\begin{array}{cc}\hfill C_{\mathrm{Comm}}=& |PCer{t}_V^{\left(j\right)}|+|Aut{h}_V|+|{\sigma }_V^{\mathrm{auth}}|+|ep{k}_R|\hfill \\ \hfill & +|c{t}_{R\to V}|+|n_R|+|t_R|+|{\sigma }_R|\hfill \\ \hfill & +|c{t}_{V\to R}|+|{\sigma }_V^{\mathrm{fin}}|.\hfill \end{array}$$

(90)

$$\begin{array}{cc}\hfill |PCer{t}_V^{\left(j\right)}|& =|PI{D}_V^{\left(j\right)}|+|p{k}_V|+|Validit{y}_j|+|{\sigma }_{TA}^{\left(j\right)}|\hfill \\ \hfill & =32+1952+8+3309\hfill \\ \hfill & =5301\mathrm{bytes}.\hfill \end{array}$$

(91)

$$\begin{array}{cc}\hfill |Aut{h}_V|& =|PI{D}_V^{\left(j\right)}|+|ep{k}_V|+|n_V|+|t_V|\hfill \\ \hfill & =32+1184+32+8\hfill \\ \hfill & =1256\mathrm{bytes}.\hfill \end{array}$$

(92)

The resulting communication overhead of 19,884 bytes (≈19.88 kB) shows an aggregate protocol-level cryptographic payload of the complete UPQ-PAKE authentication exchange instead of a single-frame transmission. Depending on the underlying C-V2X, DSRC, or 5G NR-V2X transport and the effective MTU, the authentication exchange may require fragmentation across multiple lower-layer transmissions. As a result, practical latency may include serialization, retransmission, transmission, contention and fragmentation costs in addition to the cryptographic computation.

That remains practical for modern vehicular communication frameworks. Figure 4 represents communication overhead comparison.

Figure 4. Comparison of communication overhead between the proposed UPQ-PAKE scheme and existing authentication schemes under the adopted benchmark settings.

6.4. Authentication Delay Analysis

Authentication delay is another critical factor in highly dense communication environments where rapid authentication is required.

Total authentication delay is

$$D_{\mathrm{Auth}}=D_{\mathrm{Comp}}+D_{\mathrm{Trans}}.$$

(93)

where $D_{\mathrm{Comp}}$ represents computational delay and $D_{\mathrm{trans}}$ shows transmission delay.

Computational Delay:

$$D_{\mathrm{Comp}}=3T_{\mathrm{Sign}}+3T_{\mathrm{Verify}}+2T_{\mathrm{Encap}}+T_{\mathrm{Decap}}+11T_H.$$

(94)

Due to lightweight transcript construction and efficient lattice-based operations, the proposed protocol maintains practical authentication latency highly suitable for the real-time vehicular communications. Figure 5 represents the authentication delay comparison.

Figure 5. Comparison of authentication delay between the proposed UPQ-PAKE scheme and existing authentication schemes under the adopted benchmark settings.

A comparatively higher authentication delay of the proposed protocol is an expected security–performance trade-off resulting from the use of ML-DSA signatures, bidirectional ML-KEM operations, freshness verification and transcript binding. Therefore, the objective of the proposed protocol is not to minimize authentication latency relative to the traditional schemes but to maintain the delay within operationally acceptable range while providing post-quantum security, dynamic unlinkability and forward secrecy. For deployment-oriented interpretation, the authentication delay should be evaluated against the explicitly defined application-level latency requirement, and the 19.88 kB authentication payload should be assessed against the effective bandwidth available for underlying V2X link. Accordingly, the reported results show the protocol-level feasibility under the adopted benchmark settings instead of a claim of minimum authentication delay.

6.5. Scalability Analysis

Vehicular networks observe continuously changing node density and authentication requests. Hence, the scalability is essential. Let $N_V$ be the active vehicles and $N_R$ be the RSUs. So, the authentication complexity grows linearly:

$$C_{\mathrm{Total}}=O\left(N_V\right)$$

(95)

Because every authentication session is established independently, no blockchain consensus is required and no heavy pairing operations are involved. Hence, the proposed protocol stays scalable under heavy vehicular densities. Figure 6 shows the scalability analysis.

Figure 6. Authentication delay versus the number of vehicles under the adopted benchmark settings.

The replay and MITM resistance of the proposed protocol is evaluated analytically. For replay attacks, an adversary succeeds only if the freshness techniques are bypassed, with nonce-collision probability bounded by the security parameter and number of protocol sessions. For MITM attacks, successful transcript manipulation needs either producing a collision in the transcript-binding hash or forging a valid ML-DSA signature. As a result, the MITM success probability is limited to the collision-resistance advantage of the hash function and the EUF-CMA advantage against ML-DSA.

The present evaluation is intended for protocol and cryptographic-level feasibility instead of providing a complete field deployment benchmark. It does not completely reproduce vehicular wireless effects including fading, high-speed mobility, interference, handovers, packet loss, congestion, or hardware-specific OBU constraints. Hence, the reported results must be interpreted within the stated simulation and benchmark assumptions. Since the authentication session of every vehicle is processed independently, the overall authentication workload increases linearly with the number of concurrent vehicle requests approximately. Therefore, scalability in dense vehicular environments depends on the processing capacity of the serving RSU and the total number of simultaneous authentication requests. Additional RSUs can however distribute the authentication workload across different coverage regions, supporting larger vehicular populations without changing the core protocol.

7. Conclusions

This paper presents UPQ-PAKE: a unified post-quantum-resilient anonymous authentication and key establishment protocol for ITS. The proposed scheme is designed to address the growing privacy and security concerns in next-generation vehicular communications under both conventional and quantum adversarial models. Unlike traditional authentication schemes that remain vulnerable to quantum-enabled cryptoanalysis, the proposed scheme integrates ML-DSA- and ML-KEM-based PQ primitives for providing secure mutual authentication, transcript-bound session establishment, dynamic pseudonym generation and forward secrecy. It eliminates various critical weaknesses being observed in conventional vehicular authentication schemes such as static binding, insufficient forward secrecy, weak/no transcript binding and vulnerability to MITM and replay attacks. By integrating dual ephemeral ML-KEM encapsulation, nonce-based freshness validation, dynamic session-bound pseudonyms, and transcript integrity verification using parameter $\beta$, the proposed protocol strengthens the authentication robustness significantly while preserving unlinkability and user privacy. The formal security analysis shows that the proposed protocol achieves authenticated key-exchange security, mutual authentication, resistance against MITM and replay attacks, and dynamic unlinkability under quantum polynomial-time adversarial model. The simulation-based performance evaluation confirms that the proposed scheme maintains practical computational overhead, authentication latency, communication efficiency suitable for highly dynamic vehicular communication setups. Although the use of PQ-cryptographic primitives introduces slightly larger ciphertexts and signature sizes compared with the conventional ECC-based schemes, the protocol achieves stronger long-term security guarantees substantially while maintaining scalability under increasing vehicular density and communication sessions.