R.D.N. Shakya of RMIT University, Craig Costello, and Nalin A.G. Arachchilage have completed a Systematisation of Knowledge (SoK) revealing that simply having standardised post-quantum cryptography (PQC) algorithms is insufficient for securing software. Their analysis demonstrates that existing approaches to PQC integration provide “disconnected support across the software development lifecycle,” failing to coordinate preparation, implementation, and ongoing maintenance. The work shows evaluation evidence for PQC integration largely remains limited to controlled settings, indicating a stronger demonstration of technical feasibility than proof of operational readiness for real-world deployment.

Standardized PQC Algorithms and Software Integration Challenges

While the standardization of post-quantum cryptography (PQC) algorithms is underway, a comprehensive examination of their integration into existing software development processes reveals critical gaps in practical application. This analysis focused on approaches to implementation, migration and developer education, assessing them against NIST PQC standards and existing migration guidance.

Current developer education initiatives, while introducing concepts like quantum threats and PQC protocols, often fall short of equipping developers with the practical skills needed for secure integration. The study identified a lack of evidence demonstrating training in essential tasks such as secure algorithm and API selection, correct implementation within existing systems, and comprehensive testing procedures.

This distinction is important because understanding algorithms is insufficient. Developers must also be able to apply them correctly within established software development processes. These gaps emphasize that secure PQC integration demands a socio-technical approach, connecting organizational strategy, developer skills, secure engineering practices, and ongoing assurance processes. The research also examined how well existing approaches cover the entire software development lifecycle (SDLC). This fragmented approach suggests a systemic challenge beyond purely technical hurdles, requiring a more unified and lifecycle-oriented strategy for successful PQC integration.

The team studied the performance of the algorithms, but the focus remained on the broader integration landscape, not just the algorithms themselves. This limitation emphasises the need for more rigorous, real-world testing and validation to ensure that PQC solutions can withstand the complexities and challenges of production environments. The findings suggest that transitioning from standardized cryptographic algorithms to practical software deployment requires a concerted effort to address these gaps and develop empirically validated approaches that connect technical, developer and organizational requirements.

PQC Integration Landscape: Implementation, Migration, Education

The current focus on post-quantum cryptography (PQC) implementation often prioritizes technical mechanisms over a comprehensive integration strategy. While approaches exist to support PQC implementation, migration and developer education, the analysis reveals these efforts remain fragmented across the entire integration process, hindering a smooth transition from standardized algorithms to practical software deployment. Existing approaches often address individual activities, such as algorithm implementation, migration planning, or testing, rather than the end-to-end software development and deployment process.

The SoK identified that current education efforts address knowledge acquisition more strongly than the development of skills needed to actually integrate PQC into functioning systems. The study’s assessment of existing approaches considered alignment with NIST PQC standards (FIPS 203-205) and PQCC migration activities, alongside coverage of software development lifecycle (SDLC) activities and cybersecurity practices. Researchers coded each study across five dimensions, including performance evaluation and testing, to map its contribution to the broader PQC integration landscape.

Fragmented Approaches Across the Software Development Lifecycle

Current approaches to cryptography (PQC) integration prioritize initial planning and technical activities, neglecting sustained support throughout the entire software development lifecycle. While frameworks exist to support migration planning and governance, tools and libraries largely address specific technical tasks such as vulnerability analysis and code refactoring. This specialization, though valuable, contributes to the fragmentation observed across the lifecycle.

The principal limitation, the analysis shows, is not a lack of support for individual migration activities, but the difficulty in integrating these approaches into a cohesive, end-to-end solution. Evidence-based assessment of PQC migration approaches reveals that many remain at the conceptual or prototype stage, with limited reporting of deployment maturity.

The analysis categorizes PQC migration activities into preparation, baseline understanding, planning and execution and monitoring and evaluation. Approaches are then mapped against NIST Cybersecurity Framework v2 functions, revealing varying degrees of alignment. While governance, identification, protection, and detection receive consistent attention, response and recovery functions are less frequently addressed. This suggests a potential weakness in the ability to effectively address security incidents involving PQC-protected systems.

“Implementation, migration, and education approaches address distinct aspects of PQC integration, yet rarely form an integrated pathway from requirements analysis to maintenance activities,” the paper states, emphasising the need for a more unified approach. Future work, the researchers recommend, should connect activities from cryptographic asset identification and decision-making through implementation, testing, deployment and maintenance. Traceability between organizational decisions and developer activities is also important.

This integrated approach aims to move beyond isolated capabilities and encourage a coordinated, sustained use of PQC throughout the software development lifecycle. The findings demonstrate that the literature has established important implementation, migration and educational approaches, but these remain fragmented across the PQC integration process.

Alignment of PQC Approaches with Migration Recommendations

Existing approaches to preparing for cryptography (PQC) disproportionately emphasize knowledge acquisition over practical skills needed for secure implementation, testing and migration. While foundational understanding of PQC concepts and standards receives consistent attention, the development of competencies in secure algorithm and API selection remains underdeveloped, creating a potential bottleneck for widespread adoption. Analysis of seven reviewed education approaches revealed all mapped to the ‘PR.

The SoK highlights a gap between imparting theoretical knowledge and equipping developers with the hands-on expertise required to integrate PQC into real-world systems, suggesting a need for more robust, practical training modules. The SoK demonstrates that while these stages are individually addressed, coordination between them, and across the entire software development lifecycle, remains fragmented.

Deployment Maturity Gaps in PQC Integration Research

Existing approaches to securing software with post-quantum cryptography (PQC) often focus on individual tasks like algorithm implementation or migration planning, rather than a complete lifecycle from development to sustained operation. This fragmented approach can create security gaps, as technically sound implementation does not guarantee identification of all vulnerable classical cryptographic dependencies needing migration. The analysis reveals that while initial steps are being taken, a cohesive strategy for long-term security remains elusive.

The current state of PQC integration research emphasizes initiating migration over managing its sustained state, with limited attention paid to continuous monitoring and evaluation. Evidence suggests that most approaches remain conceptual, existing as prototypes or experiments, and lack identified instances of pilot or production-level deployment. This limited deployment maturity constrains the ability to demonstrate real-world effectiveness beyond controlled environments, hindering the transition from theoretical security to practical resilience.

This broader scope reveals that tools and libraries support direct PQC integration, hardness estimation, and testing of PQC schemes, yet these efforts often operate in isolation. The systematic characterization of existing approaches highlights a need for a more integrated and coordinated strategy. The research identified key questions guiding the investigation, including the extent to which existing approaches align with established PQC standards and recommendations. This alignment is critical, as simply having standardized algorithms does not guarantee their secure integration into software systems.

The work systematically assesses the current landscape, focusing on software development lifecycle (SDLC) coverage, NIST Cybersecurity Framework (CSF) alignment, deployment maturity and evaluation evidence. The evaluation of existing approaches also revealed a disparity between initial verification and long-term assurance. A migration process concluding after implementation and initial verification may only provide temporary security, highlighting the importance of ongoing monitoring and evaluation.

Existing approaches often address individual activities, such as algorithm implementation, migration planning, or testing, rather than the end-to-end software development and deployment process. The study’s findings demonstrate that while technical and organizational foundations are being established, a comprehensive approach connecting preparation, implementation, migration, deployment, maintenance, and developer practices is lacking.

“Addressing these activities in isolation can leave security-critical gaps,” the researchers note, emphasizing the need for a more comprehensive and coordinated strategy. This transition requires a shift in focus from simply implementing PQC algorithms to building robust, lifecycle-oriented approaches that address the entire software development process.

Empirical Validation: Testing and Evaluation of PQC Approaches

While tools and libraries supporting direct PQC implementation, hardness estimation, and scheme testing are available, the research reveals a pronounced imbalance between the development of these resources and rigorous, real-world validation. Studies assessing PQC implementations focus on functional, conformance, security and performance properties, but evidence of testing extends primarily to controlled settings. However, these frameworks remain at a conceptual or prototype stage, lacking reported empirical evaluation.

One study, for example, focused on planning, requirement analysis, coding and testing, but its assessment remained theoretical. The level of deployment maturity also varies considerably. One study, for example, achieved experimental validation through protocol conformance and performance evaluation, but the majority remain theoretical.

This suggests that while foundational work is underway, translating these concepts into deployable solutions requires further investigation. “Future research should therefore focus on lifecycle-integrated PQC support,” the study concludes, “PQC-specific software testing and assurance guidance, competency-oriented developer education, and empirical evaluation in realistic software engineering environments.” The research identifies a need to move beyond demonstrating isolated support toward establishing evidence-based approaches for secure and sustainable PQC integration in practice. The work emphasizes the importance of addressing these gaps to encourage coordinated, sustained efforts in PQC integration, ultimately ensuring the long-term security of software systems against emerging quantum threats.

👉 More information
🗞 SoK: Post-Quantum Cryptography (PQC) Integration in Software Development: Approaches, Gaps, and Future Directions
✍️ Shakya R. D. N., Craig Costello and Nalin A. G. Arachchilage
🧠 ArXiv: http://arxiv.org/abs/2611.08442v1

More like this