SIGINFO Ornisec Enedis Enedis This document proposes a lightweight, quantum-resistant protocol for mutual authentication and secret key establishment based on a shared secret over a network. While the existing EAP-PSK protocol provides mutual authentication and key establishment, it faces significant limitations due to evolving security standards. EAP-PSK-256 addresses these vulnerabilities through the following rationales: * Quantum resistance: Legacy EAP-PSK uses the symmetric algorithm AES-128, which is theoretically vulnerable to Grover's cryptographic attack. This document specifies a new EAP protocol that uses quantum-resistant symmetric algorithms. * Regulatory Alignment: EAP-PSK-256 replaces the key generation mechanism used in EAP-PSK with a standardized key derivation mechanism from NIST SP800-108. * Enhanced Entropy: Unlike EAP-PSK, which relied solely on Peer randomness (RAND_P) for session keys derivation, EAP-PSK-256 strengthens these keys by mixing entropy from both the Peer and the Server (RAND_S). This ensures that both parties contribute to the cryptographic randomness of the session.