PQ-VAULT: A Post-Quantum Cybersecurity Layer for Vein Biometric Authentication with Cancelable BioHash and Multi-Layer Bloom Filters

Vein recognition exceeds 99% classification accuracy, yet the layer that transmits the feature vector, protects the stored template and manages the session is rarely specified. PQ-VAULT is a security layer above an arbitrary feature extractor. It combines a SIGMA-I key exchange over X25519 with Ed25519 identities and an optional ML-KEM-768 hybrid; a parametric authenticated encryption channel instantiated with Ascon-AEAD128, or with Trivium for minimum-area deployments; a cancelable BioHash stabilized by a Reed–Solomon fuzzy commitment; and a four-layer Bloom filter utilized only as a negative pre-filter, every positive confirmed against an exact set before it authorizes. Five theorems bound the guarantees, and both handshake variants are machine-verified in ProVerif. Hybridization protects key establishment only; entity authentication rests on Ed25519 and is not post-quantum. Against the legacy DH-2048 design in the same run the layer completes in 1.65±0.43 ms versus 92.40±5.63 ms. On released InceptionResNet-V2 vein features, acceptance collapses to 26.7–44.8% at 23.3–44.8% false acceptance; on a provenance-controlled encoder it reaches 66.1±5.7% at 4.8±2.2% over twenty tokens on unseen identities, against 95.4±1.3% closed-set.