Design and Evaluation of CRYSTALS-Kyber-Based Encryption Protocols for Securing Satellite-to-Ground Communications in U.S. Space Infrastructures

 Corresponding author: Omolola A. Akinola Copyright © 2025 Author(s) retain the copyright of this article. This article is published under the terms of the Creative Commons Attribution License 4.0. Design and Evaluation of CRYSTALS-Kyber-Based Encryption Protocols for Securing Satellite-to-Ground Communications in U.S. Space Infrastructures. Omolola A. Akinola 1, *, Samuel Amoateng 2, Arafat Akata 3 and Jesudunsin O. Olaobaju 4 1 Department of Information Technology, University of Cumberlands, Kentucky, USA. 2 Department of Informatics, Fort Hays State University, Hays, Kansas, USA. 3 Department of Computer Science, Innopolis University, Russia. 4 NHS Derby and Derbyshire ICB, United Kingdom. World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 Publication history: Received on 02 April 2025; revised on 10 May 2025; accepted on 12 May 2025 Article DOI: https://doi.org/10.30574/wjarr.2025.26.2.1926 Abstract This paper presents a U.S.-focused design and evaluation of CRYSTALS-Kyber-based encryption protocols tailored for secure satellite-to-ground communications. With the emerging threat posed by quantum computing to traditional public-key cryptography, the integration of post-quantum encryption schemes such as Kyber has become critical for safeguarding space-based assets. The study evaluates the Kyber protocol in simulated orbital conditions, measuring handshake efficiency, encrypted throughput, packet retransmission resilience, CPU and memory consumption, session recovery latency, and scalability. Kyber demonstrated superior performance in reconnection speed, loss recovery, and session scalability compared to RSA and ECC baselines, while maintaining acceptable computational loads for deployment on both ground stations and small satellite platforms. The protocol’s resilience to variable latency and degraded signal environments confirms its suitability for low-Earth orbit (LEO) communication profiles. Results support phased deployment in U.S. aerospace networks, beginning with mission-critical command links. This work contributes new empirical insights into the readiness of post-quantum cryptography for real-world space applications. Keywords: Post-Quantum Cryptography; CRYSTALS-Kyber; Satellite Communications; Quantum-Resistant Encryption; LEO Systems; Session Resilience; Scalability; U.S. Cybersecurity 1. Introduction The growing dependence on space-based communications has positioned satellite systems as critical assets in the U.S. national security and civilian communication infrastructure. These systems enable a wide spectrum of operations— from military coordination and emergency response to GPS, weather forecasting, and transcontinental broadband access. As such, their security posture is of strategic national interest. Traditional cryptographic schemes, predominantly RSA and Elliptic Curve Cryptography (ECC), underpin the confidentiality and integrity of satellite-toground communication links. However, with the steady advancement of quantum computing, these classical algorithms are nearing obsolescence. Quantum algorithms such as Shor’s pose an existential threat to public-key cryptography by enabling the efficient factorization of large integers and discrete logarithms, rendering current encryption methods vulnerable once large-scale quantum systems become operational [1]. In response to this looming threat, the National Institute of Standards and Technology (NIST) has spearheaded the development of post-quantum cryptographic (PQC) standards, culminating in the selection of lattice-based algorithms such as CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures [2]. These algorithms offer resistance against known quantum attacks while preserving acceptable performance profiles, making them viable World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 2871 candidates for space-limited platforms where computational efficiency and key size constraints are paramount. Unlike traditional cryptographic standards that assume predictable bandwidth and latency environments, satellite-to-ground communication channels are characterized by high signal attenuation, irregular delays, and susceptibility to interception across a vast attack surface. Therefore, implementing quantum-resistant encryption in this domain must not only ensure cryptographic strength but also accommodate physical and operational limitations inherent to satellite communication systems. Previous research has primarily focused on integrating post-quantum algorithms into terrestrial networks, cloud systems, and Internet of Things (IoT) ecosystems. However, little attention has been directed at adapting these solutions for orbital communication infrastructures, particularly those governed by U.S. national defense, civil aviation, and public safety agencies. This gap is concerning given the uniquely exposed nature of satellite systems, which cannot be physically patched or retrofitted once deployed. The U.S. Department of Defense and NASA have both emphasized the importance of quantum-secure communication pathways, yet a comprehensive evaluation of CRYSTALS-Kyber in realworld satellite-ground interaction scenarios remains largely absent in open literature [3]. This study addresses that gap by designing, implementing, and evaluating a CRYSTALS-Kyber-based encryption protocol tailored for U.S. satellite-to-ground communication systems. The proposed scheme is tested under simulated orbital and terrestrial parameters, evaluating its performance in terms of latency, throughput, key negotiation time, cryptographic overhead, and resilience under packet loss. The goal is to produce empirical insights that can inform protocol-level integration into future space communication architectures and contribute to national efforts in postquantum readiness. 2. Literature Review The evolution of post-quantum cryptography has been primarily driven by the need to replace classical encryption schemes vulnerable to quantum attacks. The NIST Post-Quantum Cryptography Standardization Project, launched in 2016, has played a central role in identifying viable algorithms, culminating in the selection of CRYSTALS-Kyber as the leading candidate for key encapsulation mechanisms [1]. Several studies have assessed Kyber's performance across standard networking protocols, including TLS and IPsec, within cloud and enterprise infrastructure environments [2][3]. These investigations highlight its favorable trade-off between security, key size, and computational overhead, making it a strong candidate for constrained systems such as embedded devices. Research by Hülsing et al. [4] and Bindel et al. [5] examined the deployment of lattice-based encryption on embedded IoT devices, indicating that CRYSTALS-Kyber is feasible for platforms with limited processing capabilities and memory. However, these findings have primarily been confined to ground-based networks, and few works address the challenges unique to space-based communications, such as latency variance, burst errors, Doppler effects, and atmospheric disruption. Given the intrinsic delay sensitivity and telemetry constraints of satellite uplinks and downlinks, postquantum schemes must be carefully adapted before practical integration into orbital systems. In the context of space security, most recent work has concentrated on physical-layer encryption or secure command channels using symmetric cryptography, due in part to the deterministic nature and low computational burden of symmetric ciphers [6]. While these approaches are effective under current threat models, they do not provide forward secrecy or resistance to quantum-enabled passive decryption, which is increasingly a concern given the “harvest now, decrypt later” strategy attributed to advanced persistent threats (APTs) [7]. Only a limited number of studies have explored public-key cryptography within satellite networks. For example, Wang et al. [8] proposed a hybrid quantum-safe key agreement protocol using pre-distributed credentials combined with Kyber encapsulation in CubeSat constellations. Their findings emphasized the need for lightweight handshake protocols and efficient retransmission mechanisms in orbital systems. Similarly, Lee and Bae [9] modeled end-to-end key negotiation latency under elliptical orbit dynamics, noting significant variability that impacts cryptographic handshakes. However, neither study focused specifically on protocol-level performance evaluation under real-world satellite-ground communication constraints in a U.S. deployment context. While cryptographic libraries such as Open Quantum Safe (OQS) have facilitated experimentation with post-quantum primitives, few end-to-end implementations exist for satellite telemetry or ground station integration. Moreover, the lack of consistent simulation environments or standardized benchmarks for evaluating PQC in space-based systems further complicates direct comparison across studies. As a result, the literature lacks a comprehensive, system-level assessment of CRYSTALS-Kyber’s viability for satellite-to-ground communication in operational scenarios, especially under the conditions mandated by U.S. aerospace and national security protocols. World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 2872 This study aims to fill that gap by conducting a detailed design and evaluation of Kyber-based encryption protocols tailored to the U.S. satellite communication ecosystem. The findings are expected to complement prior cryptographic performance analyses while extending them into an underexplored but highly critical application domain. 3. Protocol Design and Simulation Setup To evaluate the feasibility and performance of CRYSTALS-Kyber in satellite-to-ground communication scenarios, a modular encryption protocol was designed and simulated within a U.S.-based orbital telemetry context. The protocol integrates Kyber key encapsulation into a lightweight, session-based encryption suite, suitable for real-time downlink telemetry, command-and-control signals, and satellite-to-ground payload transmissions. The implementation focused on adaptability to variable latency conditions, transmission errors due to atmospheric interference, and limited processing capabilities on satellite hardware. The encryption scheme is based on a modified version of the TLS 1.3 handshake, replacing traditional Diffie-Hellman key exchange with CRYSTALS-Kyber Level 3 security mode. Session keys derived from this encapsulation were used to initialize symmetric ciphers for the remainder of the communication stream. To accommodate the unique constraints of orbital communication, the handshake was compressed into a minimal packet exchange requiring only a one-way encapsulation and key confirmation, significantly reducing initial connection latency. A checksum-based pre-validation mechanism was also introduced to minimize unnecessary full-handshake retransmissions in high-packet-loss conditions. The simulation environment replicated a U.S. satellite-ground communication architecture, consisting of a low Earth orbit (LEO) satellite node operating at 500 km altitude, communicating with a fixed terrestrial ground station via a Kuband link. The ground station stack was modeled using an emulated Linux-based environment augmented with Open Quantum Safe libraries and Kyber encapsulation modules. Communication latency was varied dynamically between 30 ms and 180 ms to reflect realistic orbital conditions, and signal degradation models based on ITU-R P.676-12 recommendations were applied to simulate atmospheric loss during different elevation angles. For protocol evaluation, three core scenarios were examined: (1) secure telemetry downlink, (2) uplink command authentication, and (3) two-way encrypted data relay for satellite-as-a-node use cases. Each scenario was benchmarked across five performance metrics: key encapsulation time, handshake completion time, payload encryption throughput, packet retransmission rate under induced loss, and CPU/memory footprint on both satellite and ground endpoints. Testing was conducted using a combination of NS-3 (for network simulation), GNU Radio (for signal path modeling), and Python-based telemetry scripts to extract protocol metrics. Simulations were run over 100 communication cycles for each scenario to ensure statistical reliability, and 95% confidence intervals were computed for each measurement. The protocol’s performance was compared to a legacy RSA-2048 handshake system and a hybrid scheme using ECC for initial key negotiation followed by AES for payload encryption. The results from this simulation are used to determine CRYSTALS-Kyber’s applicability in space-limited environments, particularly with respect to communication reliability, resource efficiency, and quantum resilience. Special attention was given to identifying deployment trade-offs for U.S. satellite operators tasked with achieving compliance with future post-quantum cryptographic mandates. 4. Performance Evaluation To assess the viability of CRYSTALS-Kyber for orbital use, protocol performance was evaluated across six metrics and three baseline cryptographic setups. These configurations were selected to represent current and emerging satellite encryption standards: RSA-2048 with AES payload encryption (used in legacy secure space systems), ECC-AES hybrid (common in performance-constrained networks), and the proposed Kyber Level 3 integration using NIST's postquantum specifications. All encryption variants were implemented using the Open Quantum Safe library and evaluated under satellite-specific link delays and error models. Table 1 summarizes the cryptographic and protocol characteristics of each configuration used throughout the evaluation. World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 2873 Table 1 Protocol Configurations and Cryptographic Parameters Configuration Key Exchange Payload Cipher Key Size (bytes) PQ Safe RSA-AES Baseline RSA-2048 AES-256 256 No ECC-AES Hybrid ECDH-P256 AES-256 160 No Kyber L3 (Proposed) CRYSTALS-Kyber-768 AES-256 1,088 Yes The RSA and ECC configurations use widely deployed classical key exchange schemes. In contrast, Kyber offers quantum resistance with slightly larger key sizes but a more predictable encapsulation cost. All configurations used AES-256 as the symmetric payload cipher to isolate key negotiation as the principal performance variable. The “PQ Safe” column indicates which configurations provide protection against quantum cryptanalysis, underscoring the significance of Kyber’s inclusion in the testbed. With this baseline established, we proceed to evaluate handshake times, throughput, retransmission behavior, and resource usage across simulated satellite-ground scenarios. 4.1. Handshake Completion Time Under Orbital Latency The efficiency of CRYSTALS-Kyber in securing satellite-to-ground sessions was first evaluated by measuring key encapsulation time and handshake completion under varying orbital latency conditions. These metrics are critical in satellite networks where communication windows are short and processing budgets are limited. Three handshake configurations were tested: a legacy RSA-2048 handshake, an ECC-AES hybrid baseline, and the proposed Kyber Level 3 integration using a modified TLS handshake. As shown in Table 2, Kyber outperformed RSA by a wide margin and closely matched ECC performance under lowlatency conditions. However, as link delay increased to simulate low-elevation passes or intermittent obstruction, the Kyber-based handshake maintained significantly better timing stability. This consistency is attributed to its fixed-size ciphertexts and minimized round trips. Table 2 Average Handshake Completion Time (ms) Across Latency Tiers Protocol 30–60 ms Latency 60–120 ms Latency 120–180 ms Latency RSA-2048 410.5 684.2 854.9 ECC-AES Hybrid 298.7 421.6 517.3 Kyber L3 (Proposed) 312.9 361.2 467.5 These results demonstrate Kyber’s robustness under adverse link conditions. In high-latency windows, Kyber completed handshakes nearly 45% faster than RSA, ensuring timely initialization for telemetry and control sessions. The hybrid ECC scheme remained slightly ahead at lower latencies, but its performance degraded more rapidly under increasing round-trip times. Figure 1 visualizes these latency-to-handshake time trends, emphasizing Kyber’s favorable slope under worsening channel conditions. World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 2874 Figure 1 Average Handshake Completion Time Under Varying Latency (ms) The results confirm that Kyber’s handshake architecture is well-suited to orbital contexts, where reliability and speed must coexist despite atmospheric or trajectory-based link fluctuations. 4.2. Encrypted Throughput and Processing Efficiency Following handshake evaluation, the second performance metric analyzed was encrypted data throughput during continuous downlink and uplink operations. Throughput reflects the protocol’s suitability for handling streaming telemetry, sensor payloads, or encrypted command traffic. Testing was conducted across ideal and degraded link conditions for all three protocol configurations. As shown in Table 3, the ECC-AES baseline achieved the highest average throughput under ideal channel conditions. However, the proposed Kyber protocol showed superior resilience under link degradation, maintaining higher throughput than both classical baselines when subject to packet loss and delay variance. Table 3 Encrypted Throughput (Mbps) Under Ideal and Degraded Links Configuration Ideal Link Degraded Link (3% Loss) RSA-AES Baseline 8.1 6.4 ECC-AES Hybrid 9.7 7.2 Kyber L3 Proposed 9.1 7.8 These results underscore Kyber's robustness in unpredictable orbital link environments. Despite a minor throughput disadvantage under perfect conditions, Kyber surpassed both alternatives when packet integrity was intermittently compromised. Its fixed-length key encapsulation and reduced handshake frequency helped maintain flow continuity and reduce retransmission buffering delays. Figure 2 illustrates these trends visually, showing protocol throughput across both link conditions. The gap between ideal and degraded performance was narrowest in the Kyber setup, supporting its viability for mission-critical data handling. World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 2875 Figure 2 Encrypted Data Throughput Under Ideal and Degraded Links The Kyber protocol’s consistent throughput, even under degraded link quality, indicates its practical adaptability to real-time orbital operations where signal fidelity is variable and bandwidth must be fully leveraged during narrow communication windows. 4.3. Loss Resilience and Retransmission Behavior Satellite communication links are prone to intermittent degradation due to Doppler shifts, signal scattering, and atmospheric disruptions. To evaluate protocol resilience under these conditions, each configuration was tested across three simulated packet loss scenarios (1%, 3%, and 5%). The number of retransmissions and total payload recovery rates were measured across 100 transmission sessions. As detailed in Table 4, the Kyber-based implementation consistently required fewer retransmissions across all loss levels compared to RSA-AES and ECC-AES, while achieving the highest data recovery percentage. These results reflect Kyber’s efficient session caching and loss-tolerant handshake design. Table 4 Retransmissions and Recovery Under Packet Loss Conditions Loss Rate RSA Retransmits ECC Retransmits Kyber Retransmits Kyber Recovery (%) 1% 34 28 23 97.2 3% 78 61 50 94.1 5% 123 98 82 90.6 Kyber’s performance gap widened with increasing loss, highlighting its efficiency in hostile radio environments. In addition to lower retransmission demand, the protocol achieved successful payload delivery in over 90% of cases even under 5% loss—conditions often experienced in low-elevation satellite passes or rain-faded Ka-band links. Figure 3 plots the total retransmissions per configuration at each loss rate. The consistent advantage observed in Kyber’s behavior aligns with its fixed-size ciphertexts and simplified negotiation overhead, reducing the need for costly session restarts. World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 2876 Figure 3 Total Retransmissions Across Increasing Packet Loss Conditions These findings confirm that CRYSTALS-Kyber provides enhanced delivery efficiency in environments with fluctuating link quality, reducing protocol chatter and preserving real-time performance in orbital channels with tight timing and energy budgets. 4.4. Platform Resource Usage Resource consumption is a key concern when deploying cryptographic protocols on space-limited satellite platforms. This evaluation measured CPU utilization and memory footprint during session initiation and sustained encryption for each of the three protocol configurations. Tests were conducted on simulated ground station hardware and on-board satellite processors representative of small satellite payloads (ARM Cortex-A53 class). Table 5 reports the average CPU load (as a percentage) and peak memory usage (in MB) on both ground and satellite systems during handshake and payload encryption operations. Table 5 Average Resource Utilization During Cryptographic Operation Platform Configuration CPU (%) Memory (MB) Ground Node RSA-AES Baseline 21.7 71.3 ECC-AES Hybrid 19.4 68.9 Kyber L3 Proposed 24.3 73.5 Satellite Node RSA-AES Baseline 42.1 62.7 ECC-AES Hybrid 36.8 59.1 Kyber L3 Proposed 38.2 64.3 While Kyber incurred a slightly higher CPU load than ECC on both endpoints, its memory demands were comparable, and performance remained within acceptable bounds for all test cases. On-board CPU usage for Kyber peaked at 38.2%, which is manageable on modern small satellite hardware, especially during dedicated encryption bursts rather than continuous streaming. Figure 4 visualizes CPU usage across the configurations and platforms, highlighting Kyber’s efficiency relative to RSA while remaining competitive with ECC. World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 2877 Figure 4 CPU Utilization Across Ground and Satellite Endpoints The chart reveals Kyber’s favorable performance for satellite deployment: while slightly more demanding than ECC, it offers stronger cryptographic assurance and operates well within contemporary power and processing envelopes. The small additional overhead is an acceptable tradeoff in exchange for post-quantum security. 4.5. Session Resumption and Reconnection Efficiency Satellite communication links are inherently intermittent due to orbital occlusion, antenna misalignment, or signal degradation. Efficient session resumption after a temporary outage is essential to minimize reconnection time and prevent repeated full handshakes, which consume both bandwidth and processing resources. This evaluation measured the average time required to resume a secure session following a brief link loss across all three protocol configurations. Figure 5 Average Session Resumption Time After Link Interruption (ms) The Kyber protocol included a lightweight session caching mechanism, enabling reauthentication without full key encapsulation, while RSA-AES and ECC-AES required complete renegotiation on reconnect. Sessions were disrupted mid-transfer, and reconnection performance was measured over 50 link restoration events per configuration. World Journal of Advanced Research and Reviews, 2025, 26(02), 2870-2882 2878 Figure 5 presents the average session resumption time. Kyber outperformed both baselines by a significant margin, reducing reconnection time by more than 40% compared to RSA-AES and by 27% compared to ECC-AES. The reduced reconnection time in Kyber-enhanced protocols reflects the advantages of its encapsulated key recovery scheme, which enables secure continuity without full cryptographic renegotiation. This capability is critical for maintaining communication integrity during brief, frequent disruptions typical of low Earth orbit (LEO) passes or mobile ground platforms. The findings suggest that Kyber-based encryption not only provides forward security but also enhances usability by reducing friction during reconnection cycles—an operational necessity for autonomous satellite relays and space-toground control systems. 4.6. End-to-End Delay Variability To evaluate user-perceived latency during live satellite passes, the total round-trip delay was measured for encrypted command-and-response cycles using each protocol configuration. This test simulates operational scenarios such as ground-initiated data queries or control instructions sent to orbital assets, followed by acknowledgment responses. Measurements captured handshake time, payload encryption, transmission delay, and processing time across the uplink and downlink paths. The test environment introduced realistic latency fluctuation due to orbital motion and link attenuation, with roundtrip latencies spanning 150 ms to 320 ms. For each configuration, delay distributions were recorded over 100 interaction cycles. Figure 6 displays the distribution of round-trip encryption delays in boxplot format. The Kyber protocol demonstrated tighter variance and a slightly lower median than both RSA and ECC, with fewer high-latency outliers. This performance is attributed to its more consistent session handling and lower risk of retransmission-triggered renegotiations. Figure 6 Encrypted End-to-End Delay Distribution Over 100 Interactions These results reinforce Kyber’s viability in time-sensitive applications such as satellite health telemetry, maneuver control, or time-windowed data exchange. Its reduced delay volatility improves predictability for systems that require synchronized action between ground and space nodes, which is increasingly important in autonomous orbital networks. 4.7. Protocol Scalability and Load Behavior To assess how well each protocol scales under concurrent session load, the system was tested with an increasing number of simultaneous encryption sessions. This scenario models use cases such as multi-ground station uplinks to a satellite constellation or satellite acting as a relay hub across multiple downlinks. For each configuration, session