SoK: Post-Quantum Cryptography (PQC) Implementation in Software Systems
This Systematization of Knowledge (SoK) paper analyzes Post-Quantum Cryptography (PQC) implementation challenges through the Human, Organisation, and Technology (HOT) framework, revealing a critical imbalance where human and organisational factors are underexplored, and proposes the PQC-HOT model to guide a coordinated socio-technological transformation for successful integration.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
The Big Picture: A Quantum Storm is Coming
Imagine the world of digital security is like a fortress protecting your bank account, passwords, and private messages. Right now, the locks on the doors are made of a very strong metal (current encryption like RSA).
However, scientists are building a new kind of "super-drill" called a Quantum Computer. Once this drill is powerful enough, it will be able to smash through those metal locks in seconds, leaving your data wide open.
To stop this, cryptographers have invented new, super-strong locks made of a different material called Post-Quantum Cryptography (PQC). These new locks are designed so that even the super-drill can't break them.
The Problem: We have the blueprints for these new locks, but we don't know how to actually install them in the millions of existing buildings (software systems) we use every day. This paper is a massive investigation into why installing these new locks is so difficult.
The Investigation: Looking at the "Three-Legged Stool"
The authors realized that people were only looking at the problem through one lens: Technology. They were asking, "Is the math right?" and "Is the code fast?"
But the authors argue that installing these new locks is like trying to balance a three-legged stool. If one leg is missing or wobbly, the whole thing falls over. They call these three legs HOT:
- H - Human: The people (developers) who have to build and install the locks.
- O - Organisation: The companies and governments that pay for it, make the rules, and manage the transition.
- T - Technology: The actual math, code, and tools used to make the locks.
What They Found: The "Technological Bias"
To get the facts, the researchers started with a massive pile of over 10,000 publications about PQC. They carefully sifted through this mountain of information, narrowing it down to just 29 high-quality studies for their final analysis. Here is what they discovered:
- The "Technological" Leg is Huge: Almost all the research focuses on Technology. People are busy inventing better math, writing code libraries, and testing if the algorithms work. It's like having a warehouse full of perfect lock blueprints.
- The "Human" Leg is Tiny: There is very little research on how to teach developers how to use these new locks. Most training is for university students, not for the actual software engineers working in companies. It's like having the blueprints but no instruction manual for the construction crew.
- The "Organisational" Leg is Missing: The review found ZERO studies that explicitly addressed governance structures, organizational planning, or regulatory compliance for PQC. It's like having the locks and the crew, but no project manager to tell them when to start.
The Analogy: Imagine you are trying to replace the engine in a car while it's still driving down the highway.
- Technology is the new engine.
- Human is the mechanic trying to swap it.
- Organisation is the traffic control and the budget to buy the new engine.
- The Paper's Finding: We have a great new engine (Technology), but we haven't trained the mechanics (Human) or organized the traffic (Organisation). If we just bolt the engine on without the other two, the car will crash.
The "Cross-Cutting" Danger
The paper explains that these problems don't stay in their own lanes. They mix together and make things worse. This is called Socio-Technological Coupling.
- Example: If the Technology tools are confusing (bad design), the Human developer gets stressed and makes a mistake.
- Result: Because the Organisation didn't have a plan for training or checking the work, that mistake goes unnoticed until the system fails.
The authors call this a "vicious cycle." A weak tool makes a human error, and a lack of organizational support lets that error become a disaster.
The Solution: The PQC-HOT Model
To fix this, the authors propose a new way of thinking called the PQC-HOT Model.
Think of this model as a three-way handshake. For Post-Quantum security to work, you cannot just upgrade the math. You must upgrade all three at the same time:
- Build better tools that are easy for humans to use (Technology).
- Train the humans so they understand how to use them safely (Human).
- Create company plans that give time, money, and rules for the switch (Organisation).
The Main Takeaway
The paper concludes that moving to Post-Quantum security is not just a math problem. It is a people and management problem disguised as a math problem.
If we only focus on the "lock" (the code) and ignore the "locksmith" (the developer) and the "building owner" (the organization), the new security will fail. To succeed, we need to treat the transition as a complete system overhaul where the code, the people, and the business plans all work together in harmony.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.