← 研踪 PaperTrailarXiv:2610.38054 · v1
Understanding Post-Quantum Cryptography Adoption: Practices, Challenges, and Evolution in Open-Source Software
首次提交 2026-10-28 07:10
版本更新 2026-10-28 07:10
雷达观测 2026-10-30 10:23
摘要
Post-quantum cryptography (PQC) standards establish algorithms for quantum-safe systems, but empirical evidence about how software projects implement and maintain PQC support remains limited. We investigate this implementation and maintenance work by mining 114,361 commits and 5,713 issues across 179 open-source repositories. We use human annotation and validated LLM classification to identify PQC algorithms in commits, classify their adoption status and deployment mode, and identify technical challenges in issue discussions. The commit classification for PQC algorithms reveals that 90% of commits concern maintenance of existing support. From the issue discussions, we construct an 11-category taxonomy of recurring technical challenges. Build, packaging, and dependency failures, along with functional defects, account for approximately half of categorized issues. To examine how PQC support evolves, we use time-series analysis and first implementations of individual algorithms within repositories around NIST standardization milestones. After the 2024 finalization, standardized algorithm names appeared in more than 80% of the PQC development changes analyzed, although earlier names such as Kyber continued to appear. Development activity increased over the observation period. Our milestone analysis, however, did not find a significant increase in first implementations. Migration plans should therefore account for sustained maintenance, prioritize build reliability and integration testing, and track both standardized and predecessor algorithm names. We make the dataset, taxonomy, annotations, and analysis pipeline publicly available.
作者备注：12 pages, 5 figures, 6 tables
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-10-28 07:10 · 最新观测版本
Understanding Post-Quantum Cryptography Adoption: Practices, Challenges, and Evolution in Open-Source Software
Post-quantum cryptography (PQC) standards establish algorithms for quantum-safe systems, but empirical evidence about how software projects implement and maintain PQC support remains limited. We investigate this implementation and maintenance work by mining 114,361 commits and 5,713 issues across 179 open-source repositories. We use human annotation and validated LLM classification to identify PQC algorithms in commits, classify their adoption status and deployment mode, and identify technical challenges in issue discussions. The commit classification for PQC algorithms reveals that 90% of commits concern maintenance of existing support. From the issue discussions, we construct an 11-category taxonomy of recurring technical challenges. Build, packaging, and dependency failures, along with functional defects, account for approximately half of categorized issues. To examine how PQC support evolves, we use time-series analysis and first implementations of individual algorithms within repositories around NIST standardization milestones. After the 2024 finalization, standardized algorithm names appeared in more than 80% of the PQC development changes analyzed, although earlier names such as Kyber continued to appear. Development activity increased over the observation period. Our milestone analysis, however, did not find a significant increase in first implementations. Migration plans should therefore account for sustained maintenance, prioritize build reliability and integration testing, and track both standardized and predecessor algorithm names. We make the dataset, taxonomy, annotations, and analysis pipeline publicly available.
查看此版本解读 →查看此版本原文 ↗