An authenticated reversible image encryption architecture with post-quantum session establishment

An authenticated reversible image-encryption architecture is presented for secure image storage and transmission with post-quantum session establishment. The cipher output remains a valid image object and is reconstructed exactly after successful verification. The design protects the image digest and uses it to regenerate the permutation, mask, substitution, and diffusion state at the receiver. The Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) establishes fresh session secrets. A hash-based message authentication code using Secure Hash Algorithm 3 verifies package integrity, while the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) authenticates the sender. All required checks are completed before inverse image processing. Formal reductions establish in-transit integrity, sender authentication, and confidentiality for fresh sessions. Experiments give zero reconstruction error, a structural similarity score of 1.0, entropy of 7.9993 bits, a pixel-change rate of 99.61%, and an average intensity change of 33.46%. All 188 applicable component streams in the National Institute of Standards and Technology (NIST) Special Publication 800-22 randomness evaluation satisfied the stated criteria across 64 sessions. A compiled single-core C implementation encrypts 512 ×512 images in 13.8 ms without sender signatures and 15.3 ms with sender authentication, while exact reconstruction is retained through 4096 ×4096 images.