Post-quantum cryptography adoption faces build and maintenance challenges
Understanding Post-Quantum Cryptography Adoption: Practices, Challenges, and Evolution in Open-Source Software
Software EngineeringCryptography and Security
Summary
Protecting digital information from future quantum computers requires new types of encryption called post-quantum cryptography (PQC). This paper looks at how open-source software projects add and maintain PQC support. The authors found that most efforts focus on keeping existing support working, with many technical problems coming from build and packaging issues. They also observed that after official standards were finalized in 2024, projects mostly used new algorithm names but kept older ones too, and the rate of new implementations did not sharply increase.
What this means in practice
- •For software developers: Plan PQC migration strategies that emphasize ongoing maintenance and robust build integration based on common technical challenges found in open-source projects.
- •For software project managers: Prioritize testing and tracking both current and legacy PQC algorithm names to ensure smooth evolution of cryptographic support in projects.
Authors
Souhardya Saha Dip, Moshood A. Fakorede, Krishna Upadhyay, Umar Farooq
Abstract
Post-quantum cryptography (PQC) standards establish algorithms for quantum-safe systems, but empirical evidence about how software projects implement and maintain PQC support remains limited. We investigate this implementation and maintenance work by mining 114,361 commits and 5,713 issues across 179 open-source repositories. We use human annotation and validated LLM classification to identify PQC algorithms in commits, classify their adoption status and deployment mode, and identify technical challenges in issue discussions. The commit classification for PQC algorithms reveals that 90% of commits concern maintenance of existing support. From the issue discussions, we construct an 11-category taxonomy of recurring technical challenges. Build, packaging, and dependency failures, along with functional defects, account for approximately half of categorized issues. To examine how PQC support evolves, we use time-series analysis and first implementations of individual algorithms within repositories around NIST standardization milestones. After the 2024 finalization, standardized algorithm names appeared in more than 80% of the PQC development changes analyzed, although earlier names such as Kyber continued to appear. Development activity increased over the observation period. Our milestone analysis, however, did not find a significant increase in first implementations. Migration plans should therefore account for sustained maintenance, prioritize build reliability and integration testing, and track both standardized and predecessor algorithm names. We make the dataset, taxonomy, annotations, and analysis pipeline publicly available.