arXiv subjects

Nalin A. G. Arachchilage

Publications and source records attributed to Nalin A. G. Arachchilage.

5 recordsLinked to original sources

arXiv2026

SoK: Post-Quantum Cryptography Implementation in Software: Approaches, Challenges and the PQC-HOT Framework

Secure implementation of post-quantum cryptography (PQC) requires attention to cryptographic mechanisms, software integration, developer capability, and organisational support. Understanding how available approaches address these requirements is important for preparing software systems for quantum threats. This Systematisation of Knowledge (SoK) synthesises 30 publications and analyses PQC implementation approaches and challenges using a Human, Organisational, and Technological (HOT) perspective. We identify four approach categories: guidelines, frameworks, tools and libraries, and educational interventions. Technological support receives greater representation in the extracted mapping, while no approach is classified primarily as organisational, despite secondary organisational contributions in some approaches. The challenge synthesis identifies five layers covering implementation security, system integration and lifecycle, tooling, organisational governance, and human factors. Together, these findings highlight a difference between the primary support functions of the mapped approaches and the breadth of the reported implementation challenges. We propose PQC-HOT, an evidence-informed analytical framework connecting implementation tasks with technical resources, practitioner capabilities, and organisational arrangements. We derive research priorities and engineering implications to guide framework evaluation and support secure, maintainable PQC-enabled software.

cs.CR↗

arXiv2026

Advancing Inclusivity in Cybersecurity Education: Integrating Intersectionality to Enhance Student Engagement in Australian Higher Education Curriculums Strategies, Barriers, and Future Directions

Australian women, gender-diverse individuals, and culturally and linguistically diverse (CALD) communities are often more susceptible to phishing and other forms of cybercrimes due to factors such as language barriers, limited access to cybersecurity education, and social isolation. These communities encounter substantial obstacles both entering and progressing in the cybersecurity field. In Australia, the Higher Education sector still leans heavily on a largely uniform cybersecurity curriculum, focusing heavily on technical proficiency, overlooking the vital impact of intersectionality and user-centered thinking for boosting student engagement and learning. Without gender inclusivity and proper consideration of intersectionality forms such as CALD, the workforce is deprived of the varied perspectives necessary to tackle today's intricate cybersecurity issues. In this study, we conducted semi-structured interviews with 15 experienced academics teaching and coordinating cyber security programs from a diverse range of Australian universities, covering all states, to explore their perspectives on: i) current strategies for addressing the women, gender-diverse and CALD perspective in cyber security education in the Australian HE sector; ii) barriers to incorporate women, gender-diverse and CALD perspective in cybersecurity curriculums in higher education; iii) future work and support that is needed. Our research highlights a lack of systematic methods for integrating intersectional perspectives into cybersecurity curriculums. In particular, we identified four key barriers and four areas where support and future efforts are needed to address this issue. Our findings offer vital insights that can substantially guide curriculum development in cybersecurity education.

cs.CY↗

arXiv2026

Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development: A Gamified Fix

The transition to Post Quantum Cryptography (PQC) introduces considerable implementation complexity, requiring strict adherence to constant-time execution, side channel resistance, and precise parametrisation. Simultaneously, large language models (LLMs) are heavily embedded in software development workflows, including cryptographic engineering. While LLMs improve productivity, evidence shows that they frequently generate insecure or suboptimal code, particularly in security critical domains. This paper introduces Secure Coding Drift in PQC, a novel socio technical vulnerability model capturing the gradual degradation of secure coding practices due to sustained reliance on LLM-generated code. Unlike prior work that focuses on static vulnerabilities, we conceptualise security risk as a longitudinal behavioural phenomenon rising from human AI interaction. To mitigate this, we propose a gamified, LLM augmented secure coding framework that embeds adversarial evaluation, behavioural feedback, and security scoring into development workflows. Our approach reframes LLMs from passive assistants into active security co-pilots, contributing toward safer PQC implementation in AI mediated environments.

cs.CR↗

arXiv2017

Designing Privacy for You : A User Centric Approach For Privacy

Privacy directly concerns the user as the data owner (data- subject) and hence privacy in systems should be implemented in a manner which concerns the user (user-centered). There are many concepts and guidelines that support development of privacy and embedding privacy into systems. However, none of them approaches privacy in a user- centered manner. Through this research we propose a framework that would enable developers and designers to grasp privacy in a user-centered manner and implement it along with the software development life cycle.

cs.HC↗

arXiv2017

A Generic Cognitive Dimensions Questionnaire to Evaluate the Usability of Security APIs

Programmers use security APIs to embed security into the applications they develop. Security vulnerabilities get introduced into those applications, due to the usability issues that exist in the security APIs. Improving usability of security APIs would contribute to improve the security of applications that programmers develop. However, currently there is no methodology to evaluate the usability of security APIs. In this study, we attempt to improve the Cognitive Dimensions framework based API usability evaluation methodology, to evaluate the usability of security APIs.

cs.CR↗