Post-quantum Cryptography in the Wild: Assessing the Readiness of Open-Source Ecosystems

Abstract

The threat of cryptographically relevant quantum computers, compounded by harvest now, decrypt later attacks, has made migration to post-quantum cryptography (PQC) urgent. With PQC standards finalized and transition guidance phasing out quantum-vulnerable algorithms, the readiness of the open-source supply chain, through which cryptographic vulnerabilities propagate, remains unclear. To fill this gap, we present the first cross-ecosystem empirical study of source-level PQC readiness. PQC Scanner is a two-stage pipeline in which (i) crypto detection identifies packages with cryptographic functionality, and (ii) PQC detection produces a binary support label and source-derived structured readiness record at the repository level using commit history, source analysis, and agent post-verification. Applied to 1,117,913 packages, Stage 1 identifies 55,654 crypto-related packages. Stage 2 evaluates their repositories for source-level PQC support. A separate audit of 219 Stage 2-negative repositories gives a Stage 2 recall lower bound of ≥ 97.48%. On a 247-repository deployment-validation sample, agent post-verification eliminated all false positives, yielding precision of 1.000. The pipeline scales to million-package scans: at concurrency 10, it analyzes over one million packages in just over two weeks, with a median LLM cost of $0.0010 per package. Across 8 ecosystems, we find a migration gap: only 1.88% of crypto-related packages show source-level PQC support, and the repository-deduplicated rate is 1.72%. Rust leads by both counts, while NuGet/Ruby/PHP remain near zero. Source-derived structured readiness records show partial support: among PQC-supporting repositories, only 19.2% satisfy the full-support criterion, with a mean migration coverage of 36%. Adoption accelerates sharply after FIPS publication (August 2024), but migration remains infrastructure-gated: key libraries such as Python’s cryptography (581M downloads/month) and framework integration layers in Java/npm still lack deployable PQC pathways, blocking downstream packages regardless of developer intent. We characterize adoption timing, bottlenecks, and community response strategies, deriving recommendations for maintainers, registry operators, and policy makers.