When classical encryption fails: A non-invasive post-quantum security layer for medical image transfers

Quantum computing threatens the long-term security of widely deployed public-key cryptography used to protect medical image transfer. The Digital Imaging and Communications in Medicine (DICOM) standard is the dominant format and protocol suite for medical imaging workflows and is commonly transported over HTTPS. Conventional DICOM-over-HTTPS deployments rely on classical cryptographic primitives that are not resistant to quantum adversaries. This work evaluates the feasibility of integrating post-quantum cryptography (PQC) into existing DICOM transfer infrastructures without modifying DICOM applications or their cryptographic libraries. We present an empirical case study of xPIPE and RSNA MIRC-CTP as a widely deployed DICOM-over-HTTPS toolchain used in hospital environments. We propose a non-invasive proxy-based design that requires no modifications to the xPIPE client, the MIRC-CTP server, or their cryptographic libraries. The design encapsulates TLS-protected DICOM traffic within an additional PQC-secured tunnel, preserving the existing TLS channel while adding a quantum-resistant outer layer. We implement a proof of concept that preserves the existing Java TLS stack ( javax.net.ssl ) used by MIRC-CTP for the inner channel and adds a PQC-secured outer tunnel based on stunnel. We further compare alternative PQC integration strategies and discuss their security and operational trade-offs. Our results show that current PQC deployments impose an computational overhead and introduce integration constraints in heterogeneous environments. Nevertheless, the proposed approach enables incremental migration by maintaining compatibility with existing systems while providing an additional post-quantum security layer. • Non-invasive PQC Integration for Legacy Systems. • Quantum-Resistant Tunnel Layer Using OpenSSL and Stunnel. • Preservation of Regulatory Compliance. • PQC Migration Path Without System Disruption.