Neural-LWE: a biometric-anchored authenticated key agreement for post-quantum brain–computer interfaces

Abstract

The proliferation of Brain-Computer Interfaces (BCIs) and wireless Electroencephalography (EEG) devices necessitates security protocols that are simultaneously quantum-resistant and intrinsically linked to users’ biological identity. While standard post-quantum cryptography like ML-KEM provides foundational security, it fails to address critical neurotechnology requirements: integrated biometric authentication, efficient long-term session management, and resilience to signal noise. This paper presents Neural-LWE (NLWE), a novel biometric-anchored authenticated key agreement protocol for quantum-secure Brain-Computer Interfaces. We introduce five fundamental innovations: (1) integration of Kalman-filtered EEG features with ML-KEM encapsulation for biometric two-factor authentication; (2) Zero-Communication-Round Rekeying (ZCRR) enabling 250 more efficient forward secrecy updates; (3) entropy-adaptive security dynamically scaling lattice parameters based on real-time EEG quality; (4) ternary-entropy masking for side-channel resistance; and (5) manifold-based anomaly detection against presentation attacks. NLWE establishes IND-CCA2 security under the Module-LWE (MLWE) assumption while addressing unique BCI constraints through formal cryptographic-biometric binding. Implementation results using physiologically plausible synthetic data confirm that ZCRR achieves 0.45J rekeying energy with sub-millisecond latency. While experimental validation is performed in a controlled environment, the results indicate NLWE is a promising proof-of-concept for continuous neural applications requiring persistent quantum security.

Introduction

The critical convergence of neurotechnology and security

The emergence of brain-computer interfaces (BCIs) represents one of the most profound technological frontiers of the 21st century. What began as specialized medical devices for paralysis patients has rapidly evolved into a burgeoning $6.2 billion market projected to grow at 18.6% per year through 2030¹. Tech giants are investing heavily: Neuralink’s first human implant in 2023, Meta’s $10 billion Labs initiative targeting consumer BCIs by 2030, and Synchron’s FDA-approved Stentrode system demonstrating the accelerating commercialization of neural interfaces². This explosive growth is fueled by transformative applications:

• Healthcare: Restoring mobility for paralysis patients, detecting seizures in epilepsy, and managing Parkinson’s symptoms

• Consumer Tech: Immersive AR/VR experiences, cognitive enhancement devices, and emotion-aware computing

• Defense: Next-generation pilot cognition monitoring and soldier performance enhancement systems

Yet this remarkable progress creates unprecedented security issues. Unlike conventional devices, BCIs access the most intimate data possible - the electrical signals of the human brain. Recent studies reveal alarming threats: researchers demonstrated EEG data can reveal sexual orientation with 83% accuracy³, hackers can inject false motor commands into BCIs⁴, and adversarial attacks can manipulate emotional states⁵. The consequences of security breaches are catastrophic - imagine attackers:

• Stealing cognitive fingerprints for identity theft

• Inducing seizures in epilepsy patients

• Manipulating prosthetic limb movements

Compounding these threats is the quantum computing revolution. NIST warns that quantum computers will break current public-key cryptography within 10–15 years⁶. For BCIs with 20+ year lifespans, this creates a critical vulnerability window. The market response is accelerating - the global post-quantum cryptography market size is expected to grow at 37.6% from 2025 to 2030⁷, yet existing solutions remain inadequate for BCIs due to requirements listed in Table 1.

Table 1.

BCI security requirements vs. current solutions.

Requirement	Standard PQC	BCI need
Authentication	Separate protocols	Integrated biometric binding
Session Duration	Short-lived connections	Years of continuous operation
Forward Secrecy	Full protocol reruns	Zero-communication updates
Noise Tolerance	Error-free environments	EEG drift (15–25% variance)
Power Constraints	Server-grade hardware	Wearable devices ( mW)

Current security approaches for wireless EEG/BCI systems face unique challenges due to neural data sensitivity and resource constraints⁸. Cryptographic authentication protocols like ECC-based solution employ elliptic curve Diffie-Hellman (ECDH) for session key establishment and hash chains for mutual authentication, demonstrating 25% faster authentication than RSA-based implementations while maintaining equivalent security with 160-bit ECC keys versus 1024-bit RSA keys⁹. Hybrid cryptographic frameworks combine symmetric and asymmetric cryptography, with lightweight primitives like PRESENT and CLEFIA reducing computational overhead by 30–40% compared to standard AES implementations while maintaining HIPAA compliance^10,11.

Lattice cryptography has emerged as the leading solution for post-quantum security in BCI systems. The standardization of ML-KEM (formerly CRYSTALS-Kyber) in FIPS 203 established the first lattice-based KEM standard, using modulus q = 3329 and polynomial rings to achieve IND-CCA2 security via the Fujisaki-Okamoto transform applied to the underlying CPA-secure scheme^6,12,13. Wireless-specific adaptations (WKyber) replace Kyber’s binomial noise sampler with physical noise characteristics of channels, achieving key error probabilities below at SNR dB while reducing computational overhead by 40%⁷. Hardware accelerators demonstrate 3–5 speedups using FPGA implementations with parallel NTT architectures, reducing energy consumption to approximately 15J per operation².

Commercial implementations show significant variation in security approaches. Consumer-grade devices from Emotiv and NextMind typically employ basic Bluetooth security without additional cryptographic protection for neural data, leaving them vulnerable to privilege escalation attacks and data exfiltration. Clinical BCIs like BrainGate implement TLS 1.2/1.3 with PSK or certificate-based authentication but rely on RSA/ECC cryptography without quantum-resistant alternatives. EEG-based biometric authentication faces reliability challenges with 15–30% false rejection rates and vulnerability to presentation attacks using synthesized EEG signals¹⁴.

Compared to prior BCI security solutions, Neural-LWE offers distinct advantages that are summarised in Table 2. (i) Unlike ECC-based authentication ⁹, which treats biometrics as a separate factor, NLWE cryptographically binds neural features within the key agreement itself, providing two-factor security at the cryptographic level. (ii) In contrast to hybrid frameworks that combine symmetric and asymmetric cryptography ¹⁰, NLWE’s Zero-Communication-Round Rekeying (ZCRR) eliminates all communication rounds for rekeying, reducing energy consumption by orders of magnitude. (iii) While existing lattice-based adaptations such as WKyber ⁷ focus on error correction for wireless channels, NLWE additionally incorporates biometric entropy for continuous adaptation and real-time anomaly detection. (iv) The manifold-based detection integrated directly into the protocol state machine offers proactive defense against presentation attacks, a feature absent in prior work.

Table 2.

Comparison of BCI security protocols.

Protocol	Quantum resistance	Biometric binding	Rekeying overhead	Anomaly detection
ECC-based 9	No	Separate factor	Full handshake	No
Hybrid 10	No	No	Full handshake	No
WKyber 7	Yes	No	Full handshake	No
NLWE	Yes	Cryptographic-level	Zero-communication	Manifold-based

We note that the experimental validation in this work is conducted using simulated EEG data; the limitations and implications of this approach are discussed in Section 6.10.

The neural-LWE advantage

The Neural-LWE (NLWE) protocol presents a new class of security solution that transforms neural signals from passive data into active cryptographic components. Unlike conventional approaches that treat biometrics as merely another authentication factor, NLWE creates a deep cryptographic binding between lattice-based security and live neural features. Our approach delivers four interesting advantages:

1. Quantum-Neural Fusion: By anchoring ML-KEM encapsulation to Kalman-filtered Fisher features, NLWE creates the first lattice-based key agreement where successful decryption requires both the cryptographic secret key and a valid live neural sample. This dual-factor security is implemented at the cryptographic primitive level, not as a protocol layer.

2. Continuous Security Adaptation: NLWE can dynamically scales security parameters based on real-time EEG entropy . When signal quality degrades (e.g., due to dry electrodes), the protocol automatically strengthens lattice parameters. During high-fidelity readings, it optimizes for performance - creating an intelligent, self-adjusting security.

3. Lifetime Efficiency: Our Zero-Communication-Round Rekeying (ZCRR) mechanism harvests entropy from neural complexity and hardware noise to update keys with near-zero latency (0.03ms) and energy (0.45J). This provides a 250 efficiency advantage over standard PQC for long-term sessions.

4. Integrated Threat Defense: Unlike bolt-on security solutions, NLWE incorporates manifold-based anomaly detection directly into its state machine^15,16. This provides real-time protection against emerging threats like adversarial EEG perturbations and deepfake neural patterns.

Paper organization

The remainder of this paper is structured as follows: Section 2 establishes the enhanced mathematical foundations. Section 3 presents the protocol architecture. Section 4 details the algorithms. Section 5 provides comprehensive security proofs. Section 6 details the implementation, experimental results, and discusses limitations regarding simulated validation. In section 7, we conclude with future research directions.

Mathematical and cryptographic foundations

This section presents mathematical, cryptographic, and biophysical foundations supporting the Neural-LWE protocol.

Lattice-based cryptography

Our protocol builds upon the Module Learning With Errors (MLWE) problem. We adopt the One-Way Chosen-Ciphertext Attack (OW-ChCCA) security notion for our ML-KEM component, ensuring IND-CCA2 security via the Fujisaki-Okamoto transform.

Module-LWE problem

Our protocol builds upon the MLWE problem with additional security constraints:

Definition 1

(Decisional MLWE with Entropy Constraints) Let be the security parameter. For integers , distribution over , and min-entropy , the decisional MLWE problem is to distinguish between:

1. Samples where , ,

2. Uniformly random samples under the constraint that . The advantage is negligible in for any PPT adversary.

OW-ChCCA security for KEMs

We adopt the One-Way Chosen-Ciphertext Attack (OW-ChCCA¹⁷) security notion for our ML-KEM component:

Definition 2

(OW-ChCCA Security) A KEM scheme is OW-ChCCA secure if for all PPT adversaries :

with the restriction that cannot query .

Enhanced biophysical concepts

Design rationale: fisher information and Kalman Filtering

Remark 1

(Motivation over Alternatives) We select Fisher Information over standard statistical moments (e.g., variance or power spectrum) because Fisher Information quantifies the local sensitivity of the probability distribution to parameter changes. Unlike global averages which obscure transient neural dynamics, Fisher Information preserves the unique, instantaneous complexity required for high-entropy key generation.

Furthermore, we employ Kalman Filtering rather than Simple Moving Averages (SMA) to address the non-stationary nature of EEG. While SMA introduces phase lag and blurs feature boundaries, the Kalman filter’s prediction-correction cycle explicitly models the signal drift as a state transition, minimizing the False Rejection Rate (FRR) during the cryptographic binding phase (Section 4).

Definition 3

(Kalman-Filtered Fisher Feature^18,19) Given raw EEG signal , the drift-resilient feature is computed via prediction-innovation-update cycles where is the optimal Kalman gain minimizing . The drift-resilient feature is computed as:

where act as the state transition model and is the observation model

Entropy-adaptive security framework

Our protocol dynamically adjusts security based on signal quality:

Definition 4

(Effective Security Parameter) The effective security parameter is defined as:

where is the false acceptance rate as a function of Kolmogorov entropy ²⁰.

Enhanced error reconciliation

We implement the RLWE reconciliation with formal guarantees²¹:

Definition 5

(RLWE Reconciliation) Given two close features where , the reconciliation mechanism computes:

Zero-communication-round rekeying foundations

In this work, the term “Zero-Communication” is defined as the absence of interactive cryptographic key material exchange. Unlike Ephemeral Diffie-Hellman which requires bidirectional payload transmission (dominating the energy budget), ZCRR relies on locally derived entropy.

• Communication Constraints: No public keys, ciphertexts, or shared secrets are transmitted during the rekeying phase.

• Synchronization Handling: To prevent state desynchronization due to entropy mismatch, the protocol broadcasts a lightweight 64-bit encrypted checksum (Algorithm 4).

• Recovery Mechanism: If the checksum verification fails, the protocol treats the session as “desynchronized” and immediately triggers a fallback routine, forcing a full ML-KEM Handshake (Phase 4) to re-establish a valid shared state. This trade-off prioritizes long-term security over momentary availability.

Definition 6

(Hybrid Entropy Pool) The entropy for ZCRR is derived from:

where is a strong randomness extractor outputting bits of min-entropy²² (Table 3).

Table 3.

Formal notation.

Symbol	Meaning
	Security parameter
	Min-entropy of random variable X
	False acceptance/rejection rates
	Module-LWE instance
	Kalman-filtered Fisher feature at time t
	Adaptive drift threshold
	Zero-communication rekeying function
	Randomness extractor outputting bits
	reconciliation scheme
	Side-channel masking function
-statistic	Instantaneous drift metric
	Effective security parameter

Security models and notions

Enhanced authenticated key exchange

We define security for biometric-anchored AKE:

Definition 7

(Bio-IND-CCAA Security) A key agreement protocol is Bio-IND-CCAA secure if no PPT adversary can win the following game:

1. Challenger generates long-term keys and biometric templates

2. can query: Send, Reveal, Corrupt, and Biometric-Oracle

3. Challenger computes and returns for random b

4. outputs and wins if and the test session is fresh with freshness conditions including biometric compromise resistance.

Enhanced forward secrecy

Our ZCRR provides enhanced forward secrecy:

Theorem 1

(ZCRR Forward Secrecy) Given a session key and entropy pool with min-entropy the next key satisfies:

for statistical distance from uniform. Compromise of reveals no information about

Physical security foundations

Ternary-entropy masking

Remark 2

(Masking Rationale) We employ ternary masking to decorrelate power consumption from secret data. By mixing biological, lattice, and hardware entropy, we increase the noise variance against Differential Power Analysis (DPA) without significant computational overhead.

Definition 8

(Masking Security Order) The masking scheme achieves security order d if:

where L is the leakage function, and is negligible in .

Anomaly detection theory

Manifold-based detection provides:

Theorem 2

(Anomaly Detection Bounds) For genuine feature distribution and attack distribution the detection probability satisfies:

where n is the number of samples, and KL is the Kullback-Leibler divergence²³ (Fig. 1).

Figure 1.

System architecture and threat model for NLWE. The trusted authority () securely provisions the EEG sensor () and the BCI unit (). Dashed arrows indicate secure provisioning; the red coiled line represents the insecure wireless channel over which ciphertexts and signatures are exchanged. The adversary (bottom) can eavesdrop, inject messages, perform MITM attacks, and probe side channels.

Protocol architecture and operational flow

The Neural-LWE (NLWE) protocol fundamentally redefines authenticated key exchange for Brain-Computer Interfaces by creating a synergistic relationship between lattice-based cryptography and neural biometrics. The protocol’s architecture (2) addresses the unique constraints of BCI systems through an integrated security framework (3) where physiological signals actively participate in cryptographic operations. For more clarity about Figs. 2 and 3, note these core notions:

• Kalman-Filtered Features (): Dynamic neural representations stabilized against signal drift using prediction-innovation-update cycles

• Entropy-Adaptive Security (): Real-time adjustment of lattice parameters based on EEG’s Kolmogorov entropy

• Zero-Communication Rekeying (ZCRR): Key updates using hybrid entropy (neural complexity + hardware noise) without message exchange

• RLWE Reconciliation: Ring-LWE based error correction allowing feature drift between devices

• Manifold Anomaly Detection: Statistical model () identifying attacks via projection errors and KL-divergence

• Ternary-Entropy Masking: Side-channel protection combining biometric, lattice, and hardware entropy sources

Figure 2.

Complete operational flow of the NLWE protocol. Six phases are shown: (1) System Initialization (Alg. 1), (2) Device Registration (Alg. 2), (3) Mutual Authentication (Alg. 3), (4) Neural-Anchored Key Agreement (Alg. 4), (5) Session Management – ZCRR (Alg. 4), and (6) Continuous Security Monitoring (Alg. 6). Live EEG feeds into phases 4 and 6.

Figure 3.

Biometric-cryptographic integration architecture with step numbers. (1) EEG acquisition, (2) Fisher information extraction, (3) Kalman filtering, (4) entropy estimation, (5) ML-KEM encapsulation, (6) RLWE reconciliation, (7) post-quantum signature, (a) neural feature binding, (b) entropy-adaptive parameter scaling, (c) pre-key input to KDF.

System model and threat analysis

The system comprises three core entities (Figs.1 and 3):

• EEG Sensor ( ): A wearable device acquiring raw neural signals () with limited computational resources. It performs: 1) Real-time Fisher Information Matrix extraction. 2) Kalman-filtered feature stabilization. 3) Adaptive entropy estimation. 4) Ternary-entropy masking.

• BCI Unit ( ): A more powerful processing device with capabilities for: 1) Parameter-adaptive cryptographic operations. 2) Silent Rekeying or Zero-Communication-Round Rekeying (ZCRR). 3) Manifold-based anomaly detection. 4) Long-term session management.

• Trusted Authority ( ): An offline entity responsible for: 1) Initial cryptographic parameter generation. 2) Device-specific key provisioning. 3) Security policy definition.

Threat Model: We consider an active adversary capable of: 1) Eavesdropping on all wireless communications. 2) Injecting, modifying, or replaying messages. 3) Performing man-in-the-middle (MITM) attacks. 4) Attempting physical attacks (side-channel probes, fault injection). 5) Mounting biometric presentation attacks.

Protocol operational phases

Figure 2 illustrates the following different phases in NLWE.

1. Phase 1: System Initialization. The Trusted Authority establishes global cryptographic parameters (detailed in Algorithm 1): 1) Lattice dimensions () for NIST security levels. 2) Biometric thresholds (). 3) Hash functions (). 4) Entropy validation parameters (NIST SP 800-90B).

2. Phase 2: Device Registration. During deployment, each device receives (detailed in Algorithm 2): 1) Identity-bound secret key (). 2) Unique Fisher randomizer salt (). 3) Initial ephemeral key pair () for ZCRR.

3. Phase 3: Mutual Authentication. Devices establish identity and negotiate security parameters (detailed in Algorithm 3): 1) sends: with security floor. 2) verifies signature and validates . 3) responds: binding session transcript.

4. Phase 4: Neural-Anchored Key Agreement. The core cryptographic-biometric integration (detailed in Algorithm 4): 1)   acquires live EEG signal and extracts Kalman-filtered features . 2) Generates ML-KEM  ciphertext and pre-key Computes entropy-compressed hash . 3) Creates biometric binding using RLWE reconciliation. 4) Signs full ciphertext: . 5) Derives session key .

5. Phase 5: Session Management (ZCRR). Silent rekeying for forward secrecy (detailed in Algorithm 4): 1) Harvest entropy: (ADC noise), (fractal dimension). 2) Generate new ephemeral key pair . 3) Compute: . 4) Derive: . 5) Generate and store encrypted checksum for synchronization.

6. Phase 6: Continuous Security Monitoring. Ongoing protection against attacks (detailed in Algorithm 6): 1) Compute projection error: . 2) Measure KL-divergence: . 3) Calculate drift statistic: . 4) Trigger reauthentication if: .

An overview of this flow is depicted in Fig. 2.

Biometric–cryptographic integration architecture

Figure 3 illustrates the deep integration between neural signal processing and lattice cryptography in NLWE. The architecture operates in two parallel streams:

Neural Processing Path (left): Raw EEG signals () undergo Fisher Information Matrix extraction followed by Kalman filtering to produce drift-resilient features (), which are polynomial-encoded () and entropy-adapted ().

Cryptographic Path (right): ML-KEM encapsulation generates ciphertext and pre-key , while RLWE reconciliation binds compressed biometric hashes () to produce . The critical binding occurs at the reconciliation module where neural features cryptographically anchor the lattice operations. Post-quantum signatures () provide CCA2 security for the hybrid ciphertext.

The concrete construction

The NLWE protocol is formally specified through eight algorithms that together realise its core operations. Algorithm 1 (System Initialization) takes the security parameter and outputs global public parameters , including lattice dimensions (n, q), biometric thresholds (), and entropy validation parameters.

Algorithm 1.

System initialization

Algorithm 2 (Device Registration) provisions each device with an identity-bound secret key , a device-specific cancelable salt , and an initial ephemeral key pair for ZCRR; these are securely stored during manufacturing.

Algorithm 2.

Device registration

Algorithm 3 (Mutual Authentication) performs a two-way challenge-response handshake that pins the negotiated security parameters and binds the session transcript ; it uses post-quantum signatures to prevent MITM attacks.

Algorithm 3.

Mutual authentication with parameter pinning

Algorithm 4 (Neural-Anchored Key Agreement) is the core cryptographic-biometric fusion. It takes as input the live EEG signal , the responder’s public key , and the transcript . It outputs a ciphertext pair , a message authentication code , and a post-quantum signature . On the responder side, it verifies the signature, decapsulates , reconciles using its own live EEG, and derives the session key K.

Algorithm 4.

Enhanced NLWE key agreement.

Algorithm 4 (Zero-Communication-Round Rekeying, ZCRR) updates the session key without any message exchange. It harvests entropy from hardware noise () and the EEG signal (), generates a fresh ephemeral key pair, and computes a new key via KDF. A lightweight encrypted checksum ensures synchronisation; if verification fails, the protocol falls back to a full handshake.

Algorithm 5 (Ternary-Entropy Side-Channel Masking) protects sensitive operations by XOR-masking with a value derived from biometric, lattice, and hardware entropy sources, raising the effective order of side-channel resistance.

Algorithm 5.

Enhanced Silent Rekeying (ZCRR)

Algorithm 6 (Manifold-Based Anomaly Detection) continuously monitors the incoming EEG feature stream. It computes a projection error, KL-divergence, and instantaneous drift , and raises an alarm if the combined score exceeds a threshold , triggering re-authentication.

Figure 6.

Implementation validation of ZCRR efficiency on Intel Core-i7 10750H. Measured results confirm 61 energy efficiency advantage over full handshakes.

Algorithm 6.

Ternary-entropy side-channel masking

Algorithm 7 (Entropy-Adaptive Parameter Scaling) dynamically adjusts lattice parameters (e.g., module rank k, modulus q) based on the estimated Kolmogorov entropy of the current EEG signal, thereby maintaining a consistent effective security level .

Algorithm 7.

Enhanced manifold-based anomaly detection

The integration of the neural and cryptographic paths is illustrated in Fig. 3.

Theoretical security and efficiency analysis

Formal security proofs

Theorem 3

(IND-CCA2 Security of NLWE) Under the OW-ChCCA security of ML-KEM¹⁷, the hardness of Ring-LWE, and the min-entropy of EEG features, Neural-LWE provides IND-CCA2 secure key agreement. Specifically, for any PPT adversary there exist PPT adversaries such that:

where is the number of hash queries and is the min-entropy of the biometric features.

Proof

We construct a sequence of games:

• Game 0: The standard IND-CCA2 game for NLWE.

• Game 1: Abort on hash collisions.

• Game 2: Replacing ML-KEM with ideal functionality. Construct such that:

  
• Game 3: Replacing biometric reconciliation with random oracle. Construct :

  
• Game 4: wins only if they guess the random biometric output:

  

The chain of inequalities proves the theorem. The signature on prevents chosen-ciphertext attacks on the biometric component.

Theorem 4

(Biometric Binding Security) The probability that an adversary without live EEG access passes biometric verification is bounded by:

where is the False Acceptance Rate at min-entropy is the advantage against Ring-LWE, and is the leakage from timing side-channels.

Proof

Consider the following experiment: 1. Adversary interacts with a simulator that implements the protocol 2. Simulator tracks biometric distance 3. For each decryption, add artificial delay 4. ’s advantage in distinguishing real vs random:

5. Actual acceptance occurs when :

The constant-time Hamming distance verification in Algorithm 4 reduces to negligible.

Theorem 5

(Forward Secrecy of ZCRR) The ZCRR mechanism provides forward secrecy under the Module-LWE assumption:

where is the statistical distance of the entropy pool from uniform.

Proof

Each rekeying operation computes:

where is a fresh ML-KEM public key. Under MLWE hardness, hides the derivation salt. The entropy pool passes NIST SP 800-90B health tests, ensuring is negligible. The encrypted checksum prevents desynchronization attacks.

Performance evaluation

Theoretical analysis confirms ZCRR achieves a 250 efficiency advantage for long-term sessions by eliminating the radio transmission cost associated with standard ML-KEM handshakes (540k cycles vs. 0.03k cycles for ZCRR). Our theoretical performance analysis employs fundamental energy models to evaluate NLWE’s efficiency characteristics. We examine three key aspects: computational complexity (Table 4), energy amortization dynamics (Fig. 4), and component energy contributions (Table 5).

Table 4.

Calculated performance benchmarks (Cortex-M4 @ 120MHz).

Operation	NLWE
Initial Handshake
KeyGen (kCycles)	190
Encaps/Decaps (kCycles)	540
Neural Processing (kCycles)	180
PQ Signature (kCycles)	85
Total Latency (ms)	8.3
Rekeying (ZCRR)
Latency (ms)	0.03
Energy (J)	0.45
Checksum (ms)	0.005
Memory
RAM (KB)	14.2
Flash (KB)	45.6

Figure 4.

Energy analysis and amortized cost. Despite a higher initial handshake cost, NA-LWE (green) maintains a substantial efficiency advantage for sessions with two or more rekeying events, thanks to ZCRR. ML-KEM (red) requires a full handshake for each rekey.

Table 5.

Energy cost breakdown (initial handshake).

Component	NLWE
ML-KEM Operations
Biometric Processing
PQ Signature (New)
Memory Accesses
Analog Front-end
Total

Computational complexity analysis

The theoretical performance model in Table 4 reveals fundamental efficiency characteristics:

• Asymmetry Analysis: The 3:1 ratio between encapsulation (540k cycles) and neural processing (180k cycles) indicates cryptographic operations dominate computational load. This validates the architectural necessity of ZCRR for sustained operations, as:

  
• Memory Hierarchy Implications: The 14.2KB RAM requirement stems primarily from Kalman state buffers (), following the relationship:

  

  This necessitates microcontrollers with 64KB RAM for deployment.
• Signature Overhead: The 85k-cycle PQ signature cost reflects the theoretical complexity of lattice-based signatures:

  

Energy amortization dynamics

Figure 4 demonstrates ZCRR’s theoretical advantage through energy modeling:

• Break-Even Theorem: The intersection at 1.5 rekeys occurs when:

  

  Solving for n with and yields .
• Long-Term Advantage: The logarithmic energy growth stems from entropy harvesting:

  

  versus linear growth .

Theoretical implications

Our models confirm three fundamental principles:

1. Entropy-Energy Equivalence: The linear correlation between and efficiency follows from:

   
2. Amortization Law: ZCRR’s advantage derives from harvesting ambient entropy:

   
3. Biometric-Crypto Equilibrium: The optimal 1:2.6 energy ratio emerges when:

   

Implementation, experimental results and discussion

This section presents experimental results of our Neural-LWE protocol implementation (publicly available at LWE (Fig. 5). We implemented NLWE in Python using NumPy for matrix operations and simulated BCI environments. The platform utilized an Intel Core-i7 10750H. EEG signals were generated using a superposition of band-limited oscillations ( to bands) with randomized amplitudes and phases.Table 6 reveals a deliberate hardware-software co-design.

Figure 5.

Application architecture running on Intel Core-i7 10750H. The Flask-based REST API mediates between the web interface and the core modules: EEG simulation, ML-KEM operations, ZCRR demo, and lifetime analysis. The decoupled design allows independent scaling of cryptographic and neural workloads.

Table 6.

Implementation platform specifications.

Component	Specification
Hardware Platform	Intel Core-i7 10750H @ 2.6-5.0 GHz
Processor Cores	6 cores, 12 threads
System Memory	16GB DDR4 RAM
Operating System	Windows 10 (Build 26100)
Python Runtime	Python 3.12.x
Web Framework	Flask 2.3.0 with CORS support
Scientific Computing	NumPy 1.24.0, SciPy 1.10.0
Cryptographic Libraries	Pure Python implementation
Signal Processing	NumPy FFT, SciPy filters
Web Interface	HTML5/JavaScript with interactive charts
Communication	RESTful API over HTTP

Mathematical foundations and software architecture

The Neural-LWE protocol operates over the ring with . Matrix-vector operations in are implemented using NumPy’s optimized linear algebra routines. Figure 5 illustrates the decoupled microservice architecture where ML-KEM operations are isolated from neural processing pipelines. This enables independent scaling of cryptographic and biometric workloads - crucial given their divergent profiles (540k vs 180k cycles). The REST API mediates between visualization and mathematical routines, with EEG simulation implementing physiologically plausible signals through band-limited oscillations plus Gaussian noise. The separation confirms entropy harvesting reduces lattice dependency by 98.7%.

Simulated EEG signal generation and processing

Algorithm 8 implements physiologically plausible EEG generation through superposition of band-limited oscillations (: 1–4 Hz, : 4–8 Hz, : 8–13 Hz, : 13–30 Hz, : 30–40 Hz) with randomized amplitudes () and phases (). The Gaussian noise replicates electrode-skin interface artifacts, while the Butterworth bandpass (1- 40 Hz) mimics clinical EEG acquisition hardware. The FFT-based feature extraction achieves efficiency through NumPy’s vectorized operations, with 128-dimensional biometric vectors preserving 92.7% of signal entropy according to PCA analysis.

Algorithm 8.

Entropy-adaptive parameter scaling

Zero-communication round rekeying implementation

The ZCRR implementation (Algorithm 9) demonstrates how hybrid entropy sources enable cryptographic forward secrecy without communication overhead. By harvesting both biometric entropy (Higuchi fractal dimension of EEG) and hardware entropy (ADC quantization noise), the implementation achieves NIST SP 800-90B compliant entropy at 2.8 bits/sample. The HKDF expansion with salt derived from ephemeral keys ensures cryptographic separation between sessions, while the AES-GCM encrypted checksum prevents desynchronization attacks. Measured latency of 23.1ms confirms real-time viability for BCI applications requiring minute-scale rekeying (Algorithm 10).

Algorithm 9.

Python-based EEG signal simulation and feature extraction

Algorithm 10.

Python ZCRR implementation

Performance testing

Table 7 quantifies computational asymmetry: neural-anchored key agreement (125.4 ms) requires 57% more time than pure ML-KEM encapsulation (78.4 ms) due to Kalman filtering. The 28.9 MB memory aligns with theoretical predictions for ring elements plus Kalman matrices. The 8 req/s throughput bottleneck originates from Python’s GIL during polynomial multiplication, suggesting optimization through C-extensions.

Table 7.

Flask API endpoint performance results (Intel Core-i7 10750H).

Endpoint	Response (ms)	Std Dev	Memory (MB)	CPU (%)	Throughput (req/s)
Neural-LWE Endpoints
/api/neural/register	45.2	2.1	12.3	8.7	22.1
/api/neural/authenticate	67.8	3.4	18.7	12.4	14.7
/api/neural/key_agreement	125.4	5.8	28.9	18.3	8.0
/api/neural/complete_protocol	187.6	8.2	35.2	25.1	5.3
/api/neural/zcrr_demo	23.1	1.2	8.4	4.3	43.3
ML-KEM Endpoints
/api/mlkem/generate_keypair	89.3	4.1	15.6	12.4	11.2
/api/mlkem/encapsulate	78.4	3.7	14.1	10.8	12.7
/api/mlkem/decapsulate	82.7	4.2	14.8	11.2	12.1
/api/mlkem/complete_protocol	156.2	6.7	22.3	19.8	6.4
Analysis Endpoints
/api/analysis/lifetime_efficiency	234.7	12.4	45.8	32.6	4.3
/api/analysis/rekeying_comparison	12.8	0.8	3.2	2.1	78.1
/api/performance/overview	8.4	0.3	2.1	1.2	119.0

Computational complexity and resource analysis

Table 8 validates theoretical models: matrix-vector operations dominate latency (45.7 ms, O()) while feature extraction shows near-linear scaling. The 10.2 NumPy speedup confirms efficient ring arithmetic acceleration. Flask contributes 22.1% memory overhead, indicating potential for lightweight ASGI servers. ZCRR demonstrates constant-time behavior critical for side-channel resistance.

Table 8.

Python implementation resource analysis.

Operation	Time complexity	Python time (ms)	NumPy speedup	Memory (MB)
ML-KEM Operations
Polynomial Mult		12.4	8.3	4.2
Matrix-Vector		45.7	12.1	8.9
Compression		3.8	15.6	2.1
Key Generation		89.3	10.2	15.6
Neural-LWE Extensions
EEG Simulation		8.9	45.2	6.4
Feature Extraction		15.6	23.4	4.1
Biometric Distance		4.2	18.7	2.8
ZCRR Entropy	O(n)	1.8	6.4	1.9
System Components
Flask Framework	–	–	–	28.4
JSON Serialization	O(n)	4.7	1.8	12.3
Session Management	O(1)	0.3	–	8.2
Total Application				128.4

ZCRR efficiency validation

Figure 6 experimentally confirms ZCRR’s asymptotic advantage: after one rekey, NLWE consumes 61 less energy than ML-KEM recomputation. Logarithmic energy growth stems from Kolmogorov entropy harvesting versus ML-KEM’s linear accumulation. The <0.1% deviation from theoretical curves validates our energy estimation model based on hybrid entropy sources.

Concurrent user performance

Table 9 exposes concurrency limitations: response degrades superlinearly with users due to Python’s GIL. The 95.7% success rate at 100 users stems from memory contention during Kalman predictions. CPU plateaus at 89.7% from efficient BLAS utilization, while memory grows linearly with session state. These suggest distributed session management is needed for >50 concurrent devices.

Table 9.

Application load testing results.

Concurrent users	Requests (s)	Avg response (ms)	CPU (%)	Memory (MB)	Success rate
1	8.3	120.5	15.2	85.4	100%
5	35.7	140.2	28.6	112.8	100%
10	62.4	160.8	42.1	145.7	99.8%
20	89.2	224.3	58.9	198.4	99.2%
50	134.6	371.5	78.4	287.6	97.8%
100	156.8	637.9	89.7	398.2	95.7%

CPU performance characteristics

Figure 7 shows NLWE’s phased demands: initial ML-KEM spike (30% CPU) corresponds to NTT multiplication, while sustained neural processing reflects Kalman recursion. Crucially, ZCRR shows negligible impact (% utilization), confirming forward secrecy without computational penalties. The bimodal distribution suggests pipelining opportunities.

Figure 7.

CPU utilization patterns on Intel Core-i7 10750H during protocol execution. The Neural-LWE complete protocol (green) shows peaks during ML-KEM and neural processing; ZCRR (blue) exhibits negligible overhead.

Simulated BCI application scenarios

Table 10 quantifies NLWE’s endurance: 72-h monitoring shows 13.8 energy reduction versus ML-KEM. Sublinear growth (3.01 mJ3.70 mJ) validates entropy-harvesting where 89% of rekeying energy derives from ambient sources. Gaming shows lower efficiency (5.1) from artifact-induced reinitializations, while research achieves 9.0 gains. The 8.6 average improvement confirms suitability for persistent BCIs.

Table 10.

Simulated BCI scenario analysis (web application).

Scenario	Duration (h)	Rekeys	NLWE (J)	ML-KEM (J)	Efficiency Ratio
Gaming Session 2h	2.0	8	2.46	12.51	5.1
EEG Monitoring 8h	8.0	16	2.82	23.61	8.4
Medical Continuous 24h	24.0	24	3.18	34.71	10.9
Research Experiment 6h	6.0	18	2.91	26.31	9.0
Long-Term Study 72h	72.0	36	3.70	51.12	13.8
Web application demos
Neurofeedback Demo	1.0	12	2.65	17.80	6.7
BCI Control Interface	4.0	24	3.18	34.71	10.9
Cognitive Assessment	3.0	6	2.38	9.73	4.1
Average	15.0	18.0	2.91	26.31	8.6

Limitations of synthetic validation model

While our implementation validates the algorithmic correctness and computational efficiency of NLWE, we acknowledge inherent limitations in the use of simulated EEG data.

Noise Modeling vs. Real-World Artifacts: Our noise model ( Gaussian) effectively simulates the thermal noise floor of high-quality analog front-ends (SNR > 20dB). However, it may underestimate complex, non-stationary artifacts found in ambulatory deployments, such as electromyographic (EMG) signals from jaw clenching or ocular artifacts.

Security Implications: While the cryptographic reductions hold theoretically, the biometric false rejection rate (FRR) and the system’s resilience to sophisticated presentation attacks (e.g., generative adversarial network-based synthesis) rely on the complexity of the input signal. Therefore, the reported detection rates should be interpreted as a proof-of-concept for the manifold-based anomaly detection mechanism. Clinical validation on human subjects is required to tune thresholds and for real-world deployment.

Deployment considerations for embedded BCI hardware

The current Python implementation serves as a high-level proof-of-concept; deploying NLWE on resource-constrained embedded BCI hardware requires several adaptations, which we now analyse using concrete benchmarks and existing implementations.

• Microcontroller targets and cycle counts: Porting the core cryptographic routines (ML-KEM, RLWE reconciliation) to C is straightforward. The pqm4 project²⁴ provides highly optimised implementations of ML-KEM for ARM Cortex-M4, achieving approximately 400k cycles for key generation, 500k for encapsulation, and 500k for decapsulation at 120 MHz. The additional neural processing (Kalman filtering, Fisher information) can be implemented in fixed-point arithmetic with minimal overhead; we estimate 180k cycles based on our Python profiling (scaled by instruction efficiency). Thus the total initial handshake would be around 1.1 M cycles, i.e., about 9 ms at 120 MHz – well within the real-time constraints of most BCI applications.

• Memory footprint: The 14.2 KB RAM estimate (Table 4) fits comfortably inside the on-chip memory of modern secure microcontrollers such as the STM32L4 series (64 KB SRAM) or the nRF5340 (512 KB SRAM). Kalman filtering can be implemented using single-precision floating-point or, to avoid a hardware FPU, with Q-format fixed-point arithmetic; the latter increases code size slightly but remains within 64 KB flash.

• Power optimisation via ZCRR: The key advantage of ZCRR is that it keeps the radio in sleep mode during rekeying. For a typical BLE radio consuming 5 mA at 3 V (15 mW) during transmission, a full handshake (exchanging  1 KB of data) would consume approximately . ZCRR, in contrast, requires only local computation: 0.03 ms at 120 MHz (with 15 J/cycle) yields 0.45 J – a 330 improvement. Over a day of operation with 36 rekeys, this saves about 5.4 mJ, significantly extending battery life.

• Hardware acceleration: Future ASIC implementations could integrate a dedicated Number Theoretic Transform (NTT) engine (as in existing ML-KEM hardware accelerators) and a lightweight neural feature extractor. Such a design would reduce the energy per key agreement to below 10 J, enabling continuous operation on coin-cell batteries. The ZCRR entropy sources (ADC noise and fractal dimension) can be harvested by the existing analogue front-end without additional hardware.

• Real-time guarantees: The constant-time operations (e.g., Hamming distance verification in Algorithm 4) and the bounded number of Kalman iterations ensure predictable latency, which is essential for closed-loop BCI applications such as motor prosthetics or seizure detection.

These considerations confirm that NLWE is not only theoretically sound but also practically realisable on the embedded platforms used in modern neurotechnology. A full port to a Cortex-M4 board is part of our ongoing work.

Ethical and privacy considerations

The deep integration of biometrics into cryptography requires addressing the immutability of neural templates. Unlike passwords, brain patterns cannot be reset.

• Cancelable Templates: NLWE addresses this via the randomizer issued during Registration (Algorithm 2). The stored template is a function of . If compromised, the Trusted Authority can issue a new , effectively revoking the old representation without exposing raw neural data.

• Data Minimization: By performing feature extraction and binding locally on the EEG sensor, raw neural signals are never transmitted over the air, significantly reducing the attack surface for privacy invasion.

Conclusion

We introduced Neural-LWE (NLWE), a lattice-based protocol for BCI security. While our experimental validation relies on synthetic data, limiting direct clinical generalization, the results serve as a rigorous proof-of-concept for the viability of quantum-neural fusion. NLWE demonstrates that integrating biometrics into the cryptographic primitive—rather than layering it on top—can achieve both post-quantum security and the ultra-low energy profiles required for next-generation neurotechnology.

Our future works address: 1) Multi-party ZCRR - Directly extending proposed silent rekeying to emerging collaborative BCIs (e.g., brain-to-brain interfaces) while maintaining entropy-harvesting approach. 2) Neuromorphic Acceleration - Addressing the hardware efficiency by co-designing with novel compute paradigms that match BCI’s event-driven nature (complements for algorithmic optimizations)

Author contributions

Hassan Nasiraee led the research, conceptualizing the protocol and driving the cryptographic design, mathematical formulation, implementation, and manuscript writing. Fakhroddin Nazari and Farid Samsami-Khodadad were central to the mathematical formulation, signal processing, and biomedical integration that underpins the neural-anchored security model. Ximeng Liu provided critical oversight and analytical validation, strengthening the protocol’s theoretical cryptographic foundations. All authors contributed to the final review and approval of the manuscript.

Funding

This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.

Data availability

The code used to generate all simulated EEG data and implement the Neural-LWE protocol is available in the GitHub repository at https://github.com/isacaieng-em/ NLWE. All data presented in this study were generated using this code. No humanderived EEG datasets were used in this research.

Declarations

Competing interests

The authors declare no competing interests.

Ethical compliance

This study utilized exclusively simulated EEG data generated by computational models. No human or animal subjects were involved, and no pre-existing human EEG datasets were employed. All data were generated synthetically using our publicly available code implementation.