Xi Lin

Quantum computing creates new security risks for legacy satellite communication systems, especially for Telemetry, Tracking, and Control (TT&C) links. Hash-Based Signature (HBS) schemes are seen as the safest option for Post-Quantum Cryptography (PQC) migrations, as they only depend on the collision resistance of hash functions without involving complex security assumptions. But in practice, applying current HBS standards in engineering is tough due to the trade-off between signature size and computational overhead. We solve this problem by proposing CP-WOTS+, an optimization scheme based on checkpoint pre-computation. By introducing a checkpoint mechanism to the signer, we achieved a compact signature of 1088 bytes under the w = 256 parameter set, while reducing the generation time from 7.15 to 0.45 ms (a $$15.9 \times$$ 15.9 × speedup). Building on this primitive, we designed the CP-XMSS-GS group signature scheme for multi-party satellite control. This scheme implements a centralized authorization model that offloads complexity to the ground: the satellite remains strictly stateless (storing only a 64-byte group public key) and just handles verification. Complex member management and traceability are handled by the ground administrator. Experimental results demonstrate that our scheme maintains a small signature size of 1764 bytes and ensures anonymity and traceability, and it requires zero on-orbit updates when members change. Our work provides a highly secure, lightweight post-quantum solution for resource-constrained satellite-ground links.

Following the completion of the NIST post-quantum cryptography standardization, Kyber has been adopted as a key encapsulation mechanism (KEM) for quantum-resistant communication. Although lattice-based KEMs provide strong security and efficiency, most existing designs restrict the cyclotomic ring dimension to powers of two, which limits parameter flexibility for heterogeneous and resource-constrained Internet of Things (IoT) devices. In this paper, we propose Fyber, a post-quantum KEM based on the Module Learning With Errors (M-LWE) problem over a module ring defined by the cyclotomic polynomial $f\left(x\right)=x^n-x^{n/2}+1$, where n is a product of powers of 2 and 3. This construction enables mixed-radix parameter selection and allows finer-grained trade-offs between security and efficiency. To further improve performance on constrained platforms, we introduce an efficient non-Gaussian sampling method. The proposed KEM supports flexible security-level stratification for IoT applications, achieving reduced public key and ciphertext sizes for selected parameter sets at the cost of moderately increased computational overhead compared to Kyber, and fills intermediate security gaps between existing standardized parameter sets.