Skip to content
NewA calmer, faster ZeroHour
Researchinfo

Study finds most open-source PQC commits are maintenance

Original title: Understanding Post-Quantum Cryptography Adoption: Practices, Challenges, and Evolution in Open-Source Software

arXiv cs.CRby Souhardya Saha Dip ()1 min read1
Read at arxiv.org
Part of a story covered by 2 sourcesStudy finds most open-source PQC commits maintain existing supportMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Across 179 repositories, 90% of PQC commits maintain existing support, and build failures dominate the issue taxonomy.

Researchers mined 114,361 commits and 5,713 issues in 179 open-source repositories to see how projects add and keep post-quantum cryptography. Human annotation and validated LLM classification show that 90% of PQC-algorithm commits maintain existing support. An 11-category issue taxonomy finds build, packaging, and dependency failures plus functional defects make up about half of categorized issues. After the 2024 NIST finalization, standardized names appeared in more than 80% of analyzed PQC development changes, though names such as Kyber persisted, and first implementations did not rise significantly around standardization milestones. The dataset, taxonomy, annotations, and pipeline are public.

Unconfirmed: Commit and issue labels rely on human annotation plus validated LLM classification.

Key facts
  • The corpus is 114,361 commits and 5,713 issues in 179 repositories.
  • Build, packaging, dependency failures and functional defects are about half of categorized issues.
  • After 2024 finalization, standardized names appear in more than 80% of analyzed PQC changes.
  • First implementations did not increase significantly around NIST milestones.
Security assessment · AI, from the article
What to do
  1. 1.Plan for sustained PQC maintenance, not only first adoption.
  2. 2.Prioritize build reliability and integration testing.
  3. 3.Track both standardized names and predecessors such as Kyber.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
post-quantumpqcopen-sourcenistcryptography
Organizations
NIST

From the original article

1 min read at arxiv.org

Post-quantum cryptography (PQC) standards establish algorithms for quantum-safe systems, but empirical evidence about how software projects implement and maintain PQC support remains limited. We investigate this implementation and maintenance work by mining 114,361 commits and 5,713 issues across 179 open-source repositories.

arXiv cs.CR

By Souhardya Saha Dip · arxiv.org

Read the full article at arXiv cs.CR

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.