Document Open Access Logo

PQC-Readiness of Open-Source Software: An Empirical Study

Author Lukas Mehl

PDF

File

Thumbnail PDF
PDF
LIPIcs.ESEM.2026.53.pdf
  • Filesize: 0.61 MB
  • 14 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Security and privacy → Cryptography
  • Software and its engineering → Software creation and management
  • General and reference → Empirical studies
Keywords
  • post-quantum cryptography
  • static analysis
  • empirical study
  • open-source software
  • cryptographic primitives

Metrics

Abstract

Migrating open-source systems to post-quantum cryptography requires knowing where classical public-key primitives still appear in code, yet much empirical work has targeted dependency graphs or misuse of APIs rather than primitive-level, multi-language usage at scale. This paper describes a static analyzer that scans Python, Java, and Go repositories using syntax-aware parsing, classifies cryptographic calls and imports as post-quantum-vulnerable, quantum-safe, or PQC-ready, and aggregates findings for ecosystem-level measurement.
Applied to a stratified sample of about fourteen and a half thousand GitHub repositories, vulnerable primitives are found to be widespread at the level of explicit calls and imports, with strongly language-dependent rates shaped in part by how transport and certificate stacks are treated in static analysis. Evidence of PQC-ready APIs is exceedingly rare by comparison, underscoring a stark adoption gap relative to migration goals. Methodological limitations are stated so the baseline can be interpreted, reproduced, and extended.

Cite As Get BibTex

Lukas Mehl. PQC-Readiness of Open-Source Software: An Empirical Study. In 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 394, pp. 53:1-53:14, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ESEM.2026.53

Author Details

Lukas Mehl
  • Washburn University, Topeka, KS, USA

Acknowledgements

The author thanks Joseph Kendall-Morwick for comments on an earlier draft of this manuscript.

Supplementary Materials

References

  1. Bouncy Castle. Big news from nist: Post-quantum cryptography in bouncy castle. https://www.bouncycastle.org/resources/big-news-from-nist/, 2024. NIST PQC support in Bouncy Castle Java (Kyber, Dilithium, SPHINCS+).
  2. BSI. Migration to post-quantum cryptography. https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/Migration_to_Post_Quantum_Cryptography.pdf, 2021. German Federal Office for Information Security; English version; recommends hybrid schemes and early transition.
  3. Cloudflare. Circl: Cryptographic library (go). https://github.com/cloudflare/circl; https://pkg.go.dev/github.com/cloudflare/circl. RSA, ECDSA, P-256 etc.; Kyber, Dilithium, ML-DSA, SLH-DSA.
  4. Nicolas E. Gold and Jens Krinke. Ethics in the mining of software repositories. Empirical Software Engineering, 27(17), 2022. URL: https://doi.org/10.1007/s10664-021-10057-7.
  5. Google. Tink roadmap: Post-quantum cryptography. https://developers.google.com/tink/roadmap, 2025. ML-DSA and SLH-DSA supported in C++ and Go; Java in progress; Kyber/ML-KEM under development.
  6. Eirini Kalliamvakou, Georgios Gousios, Kelly Blincoe, Leif Singer, Daniel M. German, and Daniela Damian. The promises and perils of mining GitHub. In Proceedings of the 11th Working Conference on Mining Software Repositories, MSR 2014. ACM, 2014. URL: https://doi.org/10.1145/2597073.2597074.
  7. Stefan Krüger, Johannes Späth, Karim Ali, Eric Bodden, and Mira Mezini. Crysl: An extensible approach to validating the correct usage of cryptographic apis. In ECOOP, volume 109 of LIPIcs, pages 10:1-10:27, 2018. URL: https://doi.org/10.4230/LIPIcs.ECOOP.2018.10.
  8. NIST. FIPS 203: Module-lattice-based key-encapsulation mechanism standard. https://csrc.nist.gov/pubs/fips/203/final, 2024. ML-KEM. Finalized 13 August 2024.
  9. NIST. FIPS 204: Module-lattice-based digital signature standard. https://csrc.nist.gov/pubs/fips/204/final, 2024. ML-DSA. Finalized 13 August 2024.
  10. NIST. FIPS 205: Stateless hash-based digital signature standard. https://csrc.nist.gov/pubs/fips/205/final, 2024. SLH-DSA. Finalized 13 August 2024.
  11. Open Quantum Safe. liboqs: C library for post-quantum cryptography. https://github.com/open-quantum-safe/liboqs; https://openquantumsafe.org/liboqs/. Kyber, Dilithium, SPHINCS+; PQC-only.
  12. Open Quantum Safe. liboqs-go: Go bindings for liboqs. https://github.com/open-quantum-safe/liboqs-go. Kyber, Dilithium, SPHINCS+.
  13. Open Quantum Safe. liboqs-java: Java bindings for liboqs. https://github.com/open-quantum-safe/liboqs-java. Kyber, Dilithium, SPHINCS+ via JNI.
  14. Paramiko. Key handling - paramiko documentation. https://docs.paramiko.org/en/stable/api/keys.html. RSAKey, ECDSA key types; URL: https://github.com/paramiko/paramiko.
  15. PyCA. Cryptography: Python cryptographic recipes and primitives. https://cryptography.io. Documentation: RSA, ECDSA, and hazmat APIs.
  16. PyJWT. Digital signature algorithms - pyjwt documentation. https://pyjwt.readthedocs.io/en/stable/algorithms.html. RS256 (RSA), ES256 (ECDSA); URL: https://github.com/jpadilla/pyjwt.
  17. Sazzadur Rahaman, Ya Xiao, Sharmin Afrose, Fahad Shaon, Ke Tian, Miles Frantz, Murat Kantarcioglu, and Danfeng (Daphne) Yao. Cryptoguard: High precision detection of cryptographic vulnerabilities in massive-sized java projects. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS '19, pages 2455-2472, New York, NY, USA, 2019. Association for Computing Machinery. GitHub: https://github.com/CryptoGuardOSS/cryptoguard. URL: https://doi.org/10.1145/3319535.3345659.
  18. Daniel Setó-Rey, Carlos López-Nozal, and José Ignacio Santos-Martín. Vulnerability of software package repositories: Pypi, maven and npm. ERCIM News, 2024(139), 2024. URL: https://ercim-news.ercim.eu/en139/special/vulnerability-of-software-package-repositories-pypi-maven-and-npm.
  19. Inc. Square. go-jose: JOSE standards (JWE, JWS, JWT) in go. https://github.com/square/go-jose. RSA and ECDSA key operations for signing/verification.
  20. Douglas Stebila and Michele Mosca. Post-quantum key exchange for the internet and the open quantum safe project. Cryptology ePrint Archive, Paper 2016/1017, 2016. URL: https://eprint.iacr.org/2016/1017.
  21. The Go Authors. golang.org/x/crypto: supplementary cryptography libraries. https://pkg.go.dev/golang.org/x/crypto. RSA, ECDSA, TLS, and related packages beyond standard library.
  22. The Go Authors. Package crypto - go standard library. https://pkg.go.dev/crypto/rsa, https://pkg.go.dev/crypto/ecdsa, https://pkg.go.dev/crypto/tls. crypto/rsa, crypto/ecdsa, crypto/tls used throughout; URL: https://github.com/golang/go.
  23. Tink Cryptographic Library. Tink: Multi-language cryptography library. https://github.com/tink-crypto/tink. RSA signatures; PQC in language-specific subrepos (tink-cc, tink-go, tink-java, tink-py).
  24. Tree-sitter. Tree-sitter: a parser generator tool and an incremental parsing library. https://tree-sitter.github.io/tree-sitter/. Used for Java and Go parsing in our scanner.
  25. Melina Vidoni. A systematic process for mining software repositories: Results from a systematic literature review. Information and Software Technology, 144, 2022. URL: https://doi.org/10.1016/j.infsof.2021.106791.
  26. Anna-Katharina Wickert, Lars Baumgärtner, Florian Breitfelder, and Mira Mezini. Python crypto misuses in the wild. In Proceedings of the 15th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), ESEM '21, New York, NY, USA, 2021. Association for Computing Machinery. URL: https://doi.org/10.1145/3475716.3484195.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact