Deploying Quantum-Resilient TLS for HTTPS: An Implementation Framework for ML-KEM and ML-DSA in Web and Mobile Applications
Supervisor Name
Jehad Hamamreh
Supervisor Email
jehad.hamamreh@najah.edu
University
An-Najah National University
Research field
Artificial Intelligence
Bio
Dr. Hamamreh is currently working as a faculty member at the Computer Science and Cyber Security Department of the IT and AI Faculty. He has also been with Antalya Bilim University serving as A. Professor and Director of Wislabi.com at the Faculty of Engineering, Department of Electrical and Computer Engineering (ECE), where he later became the ECE department head of Postgraduate Studies 2023-2024. Before that, he was affiliated with the School of Engineering and Science at Istanbul Medipol University, CoSINC Lab (which was strongly connected with WCSP lab at USF university in the USA), where he conducted novel research on smart systems, wireless networks and its security, based on which he earned his PhD with excellence and named a top graduate of the year. Prior to that, he worked with Texas A&M University as a researcher in the ECE department. He is an experienced academician with more than twelve years of research, teaching, advisership, and leadership experience. Dr. Hamamreh has contributed to his research portfolio by securing funds from the government and industry for several R&D projects, where he acted as a PI, Consultant, and Senior Researcher. He also presented his research at various leading conferences around the globe and served as an editor for many international scientific journals, referee for several funding agencies, jury on multiple thesis defenses, and technical committee member for many conferences. He has supervised and mentored more than 20 international Master’s and PhD students on their theses and published multiple research articles with them. Dr. Hamamreh is also an inventor of more than 15 Patents, mostly known as the inventor of Cross-Layer Keyless Perfect Secrecy, Number Modulation, and Power Modulation in OFDM and MIMO systems, as well as Advanced NOMA. He is an author of more than 80 peer-reviewed scientific papers along with 3 main books and 7 book chapters in 5 different books. He received the top researcher award of ABU three times: 2018, 2021, and 2022; attended in the list of top 10000 researchers prepared by the international ranking organization AD Scientific Index and in 2024 he was named a Top Scholar by ScholarGPS. He has an h-index of 24 with more than 2500 citations. Dr. Hamamreh has taught various courses at both the undergraduate and graduate levels, including Wireless Networks, Wireless Security, Physical Layer Security, Advanced Open Radio Systems (5G/6G), IoT Systems and Applications, Python AI for wireless digital communications, and Modern Computer Networks. Hamamreh's WISLABi: https://www.wislabi.com/ Hamamreh's Google Scholar: https://scholar.google.com.tr/citations?hl=en&user=pEgDDPIAAAAJ Hamamreh's ResearcherGate: https://www.researchgate.net/profile/Jehad-Hamamreh Hamamreh's ResearcherStore: https://researcherstore.com/profile/advanced-telecom/ Hamamreh's Youtube channel: https://www.youtube.com/@Wislabi
Description
HTTPS-based services in websites and mobile apps rely on TLS to protect confidentiality and authenticity. This protection rests on RSA and ECC, both of which are vulnerable to quantum computers running Shor's algorithm. The threat is not merely future decryption: "Harvest Now, Decrypt Later" adversaries can record encrypted traffic today and decrypt it once a cryptographically relevant quantum computer becomes available. NIST finalized the first post-quantum standards in August 2024: ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) for digital signatures . These are the intended replacements for RSA and ECDHE in TLS. However, a critical gap exists between standardization and deployment. As of 2026, post-quantum key exchange has achieved meaningful adoption through hybrid groups like X25519MLKEM768, enabled by default in Chrome and Firefox . Cloudflare reports that a majority of its TLS traffic now uses post-quantum key agreement . Yet this solves only half the problem. The authentication side—the certificates and signatures that prove a server's identity—remains almost entirely classical. A server using X25519MLKEM768 still presents an ECDSA or RSA certificate that a quantum computer could forge . Migration of signatures to ML-DSA is far harder because ML-DSA public keys (1,312 bytes for ML-DSA-44) and signatures (2,420 bytes) are an order of magnitude larger than ECDSA equivalents, and a typical handshake carrying multiple signatures could exceed 10 kilobytes, causing connection failures on constrained networks . Let's Encrypt has stated that directly replacing certificates with ML-DSA is not viable at web scale and is pursuing Merkle Tree Certificates as an alternative . This project addresses the practical implementation gap. It will not attempt to invent new cryptographic algorithms or redesign the Web PKI. Instead, it will produce a deployment-oriented engineering framework that answers a concrete question for organizations running HTTPS services: Given the current state of standards, libraries, and infrastructure, what is the most practical path to quantum-resilient TLS across both key exchange and authentication, and what are the measurable costs and risks at each stage? The project will focus on hybrid key exchange deployment, incremental ML-DSA certificate strategies, and the performance trade-offs in real-world web and mobile environments.