Network PQC Attack Resistance Evaluator and Outgoing Traffic Logger

Program Design Purpose: Post-quantum cryptography (PQC), often referred to as quantum-proof, quantum-safe, or quantum-resistant, focuses on the development of cryptographic algorithms, primarily public-key algorithms, designed to withstand potential cryptanalytic attacks by quantum computers. The purpose of our Network PQC Attack Resistance Evaluator program is to create a dynamic monitoring and evaluation tool. This tool aims to check and test the resistance level / resilience of communication between two points, such as two servers, against Quantum Crypto Attacks. By utilizing this tool, users can gauge the effectiveness of cryptographic measures in real-time, ensuring robust security in the face of emerging quantum threats.

# Created:     2022/01/16
# Version:     v_0.1.0
# Copyright:   Copyright (c) 2022 LiuYuancheng
# License:     GNU GENERAL PUBLIC LICENSE version3

Introduction

Post-quantum cryptographic algorithms are designed with the primary goal of securing systems against potential threats posed by quantum computers. These advanced computing machines have the capability to compromise widely utilized cryptographic schemes, including RSA and ECC. The objective of this project is to develop a sophisticated probe/scanner program. This program will analyze network packets exchanged between two points or all the packets coming in one host, providing a quantitative confidence level regarding their resistance to Quantum Crypto Attacks. The aim is to offer a robust and dynamic assessment tool that empowers users to gauge the security posture of their communication channels in the era of quantum computing advancements.

Given the inherent difficulty in simulating quantum crypto attacks with our current hardware, our focus is on parsing network packets from either the host/destination side or within the network midpoints. This approach enables the analysis of network communication protocols to determine their quantum safety. The methodology involves comparing identified protocols against our customizable comprehensive database of quantum-safe standards, specifically utilizing the NSA_Suite_B_Cryptography's Quantum Resistant Suite. For instance:

• If a packet employs the OpenSSH 2.3.1(SSH2) protocol with aes128-ctr encryption, we conclude that it lacks resistance against Quantum Crypto Attacks.

• If the packet employs the WireGuard protocol, leveraging Curve25519 for key exchange, ChaCha20 for symmetric encryption, Poly1305 for message authentication codes, SipHash for hashtable keys, and BLAKE2s for the cryptographic hash function, we express an 80% confidence level in its resistance against Quantum Crypto Attacks. This systematic evaluation ensures a nuanced understanding of the quantum resilience of various communication protocols, offering valuable insights into the security landscape.

Network PQC Attack Resistance Evaluator Main UI View

To enhance user experience, our tool includes a user-friendly interface that simplifies the process. Users can effortlessly select the monitor source, allowing them to then assess the P2P quantum attack resistance score along with detailed packet category information. Below is a glimpse of the Network PQC Attack Resistance Evaluator's user interface, providing a clear and intuitive platform for users to navigate and retrieve crucial information..

Version: 0.2.1

The compatible input network data source can be pcap from Wireshark / t-shark, tcp dump or sniffed packet generate by Ettercap's mirroring function.

Http(s) Request Logger

This module is used to log all the outgoing http(s) request send out from a Ubuntu machine to collect data to analyze whether there is any malicious activities generated from the host. The data will be record in the Logsfodler. This project includes 5 module as shown below. All the module need to be run under sudo permission.

Program Design

Program Modules Design Detail

The Network PQC Attack Resistance Evaluator program contents three main parts:

• Network traffic packet collection / sniffing module.

• Protocol encryption algorithm quantum attack resistance evaluation module .

• User action heading and result visualization UI module.

The three module will running in three parallel thread and managed by the program main data manager, the detailed work flow is shown below :

Version: 0.2.1

Network traffic packet collection / sniffing module

The Network Traffic Packet Collection/Sniffing module is designed to efficiently capture and load all communication packets from either a cap file or directly from the network interface. This module performs a meticulous filtering and categorization of packets based on user-defined settings. Subsequently, it normalizes the packet information, encompassing diverse layer details and message encryption algorithms. The processed information is then seamlessly transmitted to the Evaluation Module for in-depth analysis. This streamlined process ensures a comprehensive and organized approach to packet handling and sets the stage for thorough evaluation and assessment.

Protocol encryption algorithm quantum attack resistance evaluation module

The system is equipped to retrieve a quantum attack resistance score map/dictionary from the database. During each communication session between two peers, the Evaluation Module systematically analyze different layers of the network protocol ( layers above the IP layer). Subsequently, it generates a distinctive mark representing the resistance ability against Quantum Crypto Attacks for that specific communication instance.

The attack resistance evaluation results will be also archived in the database for future research applications. To ensure the relevance of our analysis, we commit to continuously updating the attack resistance score map/dictionary throughout our ongoing research. Additionally, users have the flexibility to customize their own resistance score maps, tailoring the evaluation process to meet their specific needs.

User action handling and result visualization UI module.

We also provide the UI/Dashboard to take the use source section then show all the communication between A and B in a list , the categorized all the packets by protocol types and highlight the result we calculated to give the user a conclusion. The design of the User interface display is shown below :

Version: 0.2.1

Network Packet Evaluation Process

Analyzing protocol intricacies begins with parsing details from the TCP/UDP layer. By meticulously matching the primitives employed by the protocol, we then derive a confidence level indicative of its resistance against Quantum Crypto Attacks. The imperative task of updating our database continually underpins our commitment to staying abreast of evolving research. As an illustrative example, the data parsed from the packet encompasses the following details:

For example we paring these data from the packet:

Example-1:

When we only check the data layer message encryption use ssh as shown below :

We identify the communication has very low resistance ability for quantum crypto attack. Then give it low mark.

Example-2:

When we only check the TCP layer encryption use wg(wireguard) as shown below :

We identify the communication may have resistance ability for quantum crypto attack. Then we checked the message layer encryption use TLC-v1.2:

we will increase the mark to higher.

Below is the detail work flow of the Data Parsing process :

Protocol Quantum Attack Resistance Score Calculation

We calculate a protocol's quantum safe score based on the NSA_Suite_B_Cryptography ‘s Quantum resistant suite[https://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography] For example the WireGuard protocol :

So we give WG[QS-Score] = 6.6667

The current resistance score for each network layers protocol we use is shown below, user can also do the adjustment based on their requirement:

{
    "Transport layer": {
        "DCCP": 0.0,
        "SCTP": 0.0,
        "UDP": 0.0,
        "UDP-Lite": 0.0,
        "TCP": 0.0,
        "PortReference": 0.0,
        "RTP": 0.0,
        "RTCP": 0.0
    },
    "Session layer": {
        "NetBIOS": 1.0,
        "NetDump": 1.0,
        "ONC-RPC": 1.0,
        "DCE-RPC": 1.0,
        "HTTP": 1.0,
        "SMTP": 1.0
    },
    "Presentation layer": {
        "MIME": 1.0
    },
    "Application layer": {
        "ANCP": 2.0,
        "BOOTP": 2.0,
        "DHCP": 2.0,
        "DNS": 2.0,
        "FTP": 2.0,
        "IMAP": 2.0,
        "iWARP-DDP": 2.0,
        "iWARP-MPA": 2.0,
        "iWARP-RDMAP": 2.0,
        "NTP": 2.0,
        "PANA": 2.0,
        "POP": 2.0,
        "RADIUS": 2.0,
        "RLogin": 2.0,
        "RSH": 2.0,
        "SSH": 4.0,
        "SSHv1": 3.0,
        "SSHv2": 5.0,
        "SNMP": 2.0,
        "Telnet": 2.0,
        "TFTP": 2.0,
        "SASP": 3.0,
        "TLS": 4.0,
        "TLSv1": 5.0,
        "TLSv1.1": 5.0,
        "TLSv1.2": 6.0,
        "TLSv1.3": 7.0,
        "WG": 8.0
    }
}

Higher score means have higher possible resistance ability for quantum crypto attack.

Program Setup

Development Environment : python 3.7.4

Additional Lib/Software Need

1. wxPython : https://docs.wxpython.org/index.html

   Install: pip install wxPython

2. pyShark / tshark : https://github.com/KimiNewt/pyshark

   Install: pip install pyshark

Hardware Needed : None

Program Files List

httpRequestLogger.py

One local HTTP/HTTPS Traffic Monitor using pyshark (tshark) : Captures outbound HTTP/HTTPS traffic from a network interface logs all the requests to log files. It will only capture the success sent out request. The function included:

• HTTP (port 80) traffic is fully decoded: method, host, URI, headers.

• HTTPS (port 443) traffic shows IP/port metadata only (TLS is encrypted).

• For full HTTPS decryption you would need the server's private key or use SSLKEYLOGFILE with a supporting application (see --keylog option).

Requirements Lib:

sudo apt install tshark
sudo pip3 install pyshark --break-system-packages

Run the program:

sudo python3 httpRequestLogger.py 

httpRecorder.py

HTTP/HTTPS/DNS outgoing Request Monitor for Ubuntu Records ALL outbound HTTP/HTTPS requests, including those to non-existent domains. The program workflow is shown below :

• Sniffs raw packets on port 80 (HTTP) and 443 (HTTPS/TLS)

• Extracts HTTP Host headers + method + path for clear-text HTTP

• Extracts TLS SNI from ClientHello for HTTPS (no decryption needed)

• Captures DNS queries (port 53) to record intent before TCP connects

• Logs TCP SYN packets as a fallback for connections with no readable payload

• Writes to both stdout and a rotating log file

Requirements Lib:

sudo apt install tshark
sudo apt-get install python3-pip libpcap-dev tcpdump
sudo pip3 install scapy --break-system-packages

Run the program:

sudo python httpRecorder.py

Other Modules :

• Log.py : This module is used to log the program execution information.(info, warning, debug, error)

• RequestTest.py: Send a simple request from another none admin user to see whether the request can be logged by the httpRequestLogger.py

• log4jtest.py : Send a simple log4j request from another none admin user to see whether the request can be logged by the httpRecorder.py

Program Usage

Program Execution

python uiRun.py

Load packets data from file

1. In the UI, select Load Data from the menu bar and select Load From File:

1. Select the file and press open button, after file loaded press the parse data button

Load packet from network interface

1. Run the program under admin permission. In the UI, select Load Data from the menu bar and select Load From network interface:

1. Select the network interface you want to sniff.

2. set how long you want to sniff (interface: WI-Fi:30 <- this number means sniff packets in 30 sec ), please void set the number too big. As I didn't use the file iterator to cache the packet data into a tmp file, so all the sniffed packet data will be saved in your computer memory. If you are watching a video and use the sniff function, there may be a memory error after running the sniff for a shot while.

Traffic Logger Execution example:

When you 1st time run it you will see this:

2026-02-23 16:30:45,398 INFO     Start the local http(s) request logger module.
2026-02-23 16:30:45,609 INFO     Available interfaces:
1. enp0s31f6
2. any
3. lo (Loopback)
4. bluetooth-monitor
5. nflog
6. nfqueue
7. dbus-system
8. dbus-session
9. ciscodump (Cisco remote capture)
10. dpauxmon (DisplayPort AUX channel monitor capture)
11. randpkt (Random packet generator)
12. sdjournal (systemd Journal Export)
13. sshdump (SSH remote capture)
14. udpdump (UDP Listener remote capture)
15. wifidump (Wi-Fi remote capture)
2026-02-23 16:30:45,610 INFO     [x] No network interface configured, try to use the 1st one as default.
2026-02-23 16:30:45,612 INFO     Start to capture the http(s) request on interface: enp0s31f6
2026-02-23 16:30:52,612 INFO

This is because we has not set the NIC we want to record, so it will list all the NIC of the machine and default select the 1st one, you can change the NIC by modify the parameter gCurrentNIC with the name current we use to link to the firewall as shown below:

The execution example log is show below running the program as admin and capture the outgoing data from another user:

Program Setup and Usage

To check the source code, detail setup and usage , please refer to project link:

https://github.com/LiuYuancheng/Network_PQC_Attack_Resistance_Evaluator

Outgoing Http(s) request logger module: https://github.com/LiuYuancheng/Network_PQC_Attack_Resistance_Evaluator/tree/main/localHttpLogger/src

license type :

GNU GENERAL PUBLIC LICENSE version3

If you got any problem during usage or find any bug, please raise a issue or send me a message.

Thanks for spending time to check the article detail, if you have any question and suggestion or find any program bug, please feel free to message me. Many thanks if you can give some comments and share any of the improvement advice so we can make our work better ~