Cryptographic DoS Amplification in Hybrid Post-Quantum Deployments: Adversarial Algorithm Substitution and Its Countermeasures
Hybrid post-quantum TLS deployments pair classical and post-quantum signature algorithms to resist future quantum adversaries. However, to the best of our knowledge, no active IETF TLS, PQUIP, or LAMPS working-group draft treats CPU-cost adversarial algorithm substitution as a first-class availability threat. We define the Cryptographic Amplification Factor (CAF), a metric for the per-resource cost asymmetry that an adversary induces by forcing a TLS 1.3 server onto a high-cost signature algorithm (SLH-DSA) instead of a low-cost one (ECDSA or ML-DSA). We characterise four adversary classes—insider misconfiguration, supply-chain compromise, remote TLS peer, and protocol man-in-the-middle—demonstrate working proof-of-concept exploits on representative testbeds, and evaluate three defensive primitives under realistic deployment conditions. On the liboqs 0.14.0 reference implementation, CAFrcpu reaches 12,255× on Apple M-series ARM64 and 14,272× on AWS Graviton3 (3904–14,272× across five microarchitectures). Under a representative two-worker hardware security module (HSM) calibration (λ=13.5 TPS), substitution drives the modelled queue utilisation ρ past the stability boundary (1.44×10−4→1.787), a model-independent saturation; on the testbed, we observe server-CPU saturation, accept-queue exhaustion, and dropped connections. Two enforcement defences and a Parallel Signing Architecture provably bound ρ≤α<1 by admission control, regardless of attack rate. The exposed surface is concentrated today in high-assurance and financial-sector deployments and widens as FIPS 206 finalises.