2026-10-05T21:32:41Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:28021 2026-10-05T06:44:05Z ddc:004 open_access

PQC-Readiness of Open-Source Software: An Empirical Study Mehl, Lukas post-quantum cryptography static analysis empirical study open-source software cryptographic primitives Migrating open-source systems to post-quantum cryptography requires knowing where classical public-key primitives still appear in code, yet much empirical work has targeted dependency graphs or misuse of APIs rather than primitive-level, multi-language usage at scale. This paper describes a static analyzer that scans Python, Java, and Go repositories using syntax-aware parsing, classifies cryptographic calls and imports as post-quantum-vulnerable, quantum-safe, or PQC-ready, and aggregates findings for ecosystem-level measurement. Applied to a stratified sample of about fourteen and a half thousand GitHub repositories, vulnerable primitives are found to be widespread at the level of explicit calls and imports, with strongly language-dependent rates shaped in part by how transport and certificate stacks are treated in static analysis. Evidence of PQC-ready APIs is exceedingly rare by comparison, underscoring a stark adoption gap relative to migration goals. Methodological limitations are stated so the baseline can be interpreted, reproduced, and extended. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Lukas Mehl 2026 Is Part Of LIPIcs, Volume 394, 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/LIPIcs.ESEM.2026.53 urn:nbn:de:0030-drops-280211 https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ESEM.2026.53 eng https://creativecommons.org/licenses/by/4.0/legalcode