A Key Agreement Protocol Based on a Post-Quantum Identity-Matching Scheme

Key agreement in open networks must not only resist quantum computing threats but also establish keys and authenticate counterparties without explicitly revealing identities. Existing solutions often rely on additional certificates or explicit signature-based authentication or require multiple rounds of interaction and complex state management, thereby imposing burdens on deployment and scalability. To address this, we propose a key agreement protocol based on a post-quantum identity-matching scheme, which unifies identity binding, implicit authentication, and session key establishment into a single key agreement process. Specifically, the initiator generates a ciphertext based on the peer’s identity and embeds session-related information within it, enabling the recipient to verify the peer’s identity and confirm the consistency of the key while decrypting and recovering the shared material. Additionally, bidirectional confirmation messages are used to eliminate negotiation deviations such as the sharing of unknown keys. Furthermore, a version control mechanism is introduced as a synchronization tag for key evolution, allowing the session key to be naturally updated within a predetermined time window. Concurrently, a revocation list maintained by a blockchain is established, enabling distributed verification and auditing of revocation status. This supports key update and revocation management without increasing the number of negotiation rounds. Performance evaluations and security analyses indicate that the protocol incurs a single-end computational overhead of less than 100 μs and a communication overhead of approximately 17.1 KB, trading moderate performance overhead for strong security semantics.