Post quantum cryptography integration in software faces lifecycle gaps
SoK: Post-Quantum Cryptography (PQC) Integration in Software Development: Approaches, Gaps, and Future Directions
Software EngineeringCryptography and Security
Summary
Quantum computers could break current encryption, so new kinds of math-based protections called post-quantum cryptography (PQC) are being standardized. The authors review how software developers are trying to add PQC to existing programs and find that while technical progress exists, the effort is not well connected across all stages of software development. They also find the evidence mostly shows it works technically but not how ready it is for real-world use. Their work points out missing pieces and what needs to be studied next to securely add PQC into software.
What this means in practice
- •For software development teams: Use the identified gaps to improve secure integration planning of post-quantum cryptography across all software development stages.
- •For cybersecurity operation teams: Align deployment practices with empirical evidence to better prepare software for quantum-resistant security transitions.
A survey. It maps existing work.
Authors
Shakya R. D. N., Craig Costello, Nalin A. G. Arachchilage
Abstract
Standardised post-quantum cryptography (PQC) is critical for protecting software systems against future quantum threats, but standardised algorithms alone do not provide a pathway for their secure integration into software. This paper presents a Systematisation of Knowledge (SoK) of PQC integration in software development, synthesising existing approaches across implementation, migration, and developer education. We analyse these approaches against NIST PQC standards and PQC migration guidance, software development lifecycle coverage, cybersecurity practices, deployment maturity, and testing and evaluation evidence. Our analysis shows that existing work establishes important technical and organisational foundations but provides disconnected support across the software development lifecycle, with limited coordination between preparation, implementation, migration, deployment, maintenance, and developer practices. Evaluation evidence also remains concentrated in controlled or early-stage settings, providing stronger evidence of technical feasibility than operational readiness. We identify cross-cutting gaps and research directions for developing lifecycle-oriented, empirically validated approaches that connect technical, developer, and organisational requirements for secure PQC integration.