arXiv subjects

R. D. N. Shakya

Publications and source records attributed to R. D. N. Shakya.

3 recordsLinked to original sources

arXiv2026

SoK: Post-Quantum Cryptography Implementation in Software: Approaches, Challenges and the PQC-HOT Framework

Secure implementation of post-quantum cryptography (PQC) requires attention to cryptographic mechanisms, software integration, developer capability, and organisational support. Understanding how available approaches address these requirements is important for preparing software systems for quantum threats. This Systematisation of Knowledge (SoK) synthesises 30 publications and analyses PQC implementation approaches and challenges using a Human, Organisational, and Technological (HOT) perspective. We identify four approach categories: guidelines, frameworks, tools and libraries, and educational interventions. Technological support receives greater representation in the extracted mapping, while no approach is classified primarily as organisational, despite secondary organisational contributions in some approaches. The challenge synthesis identifies five layers covering implementation security, system integration and lifecycle, tooling, organisational governance, and human factors. Together, these findings highlight a difference between the primary support functions of the mapped approaches and the breadth of the reported implementation challenges. We propose PQC-HOT, an evidence-informed analytical framework connecting implementation tasks with technical resources, practitioner capabilities, and organisational arrangements. We derive research priorities and engineering implications to guide framework evaluation and support secure, maintainable PQC-enabled software.

cs.CR↗

arXiv2026

Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development: A Gamified Fix

The transition to Post Quantum Cryptography (PQC) introduces considerable implementation complexity, requiring strict adherence to constant-time execution, side channel resistance, and precise parametrisation. Simultaneously, large language models (LLMs) are heavily embedded in software development workflows, including cryptographic engineering. While LLMs improve productivity, evidence shows that they frequently generate insecure or suboptimal code, particularly in security critical domains. This paper introduces Secure Coding Drift in PQC, a novel socio technical vulnerability model capturing the gradual degradation of secure coding practices due to sustained reliance on LLM-generated code. Unlike prior work that focuses on static vulnerabilities, we conceptualise security risk as a longitudinal behavioural phenomenon rising from human AI interaction. To mitigate this, we propose a gamified, LLM augmented secure coding framework that embeds adversarial evaluation, behavioural feedback, and security scoring into development workflows. Our approach reframes LLMs from passive assistants into active security co-pilots, contributing toward safer PQC implementation in AI mediated environments.

cs.CR↗

arXiv2026

When Security Meets Usability: An Empirical Investigation of Post-Quantum Cryptography APIs

Advances in quantum computing increasingly threaten the security and privacy of data protected by current cryptosystems, particularly those relying on public-key cryptography. In response, the international cybersecurity community has prioritized the implementation of Post-Quantum Cryptography (PQC), a new cryptographic standard designed to resist quantum attacks while operating on classical computers. The National Institute of Standards and Technology (NIST) has already standardized several PQC algorithms and plans to deprecate classical asymmetric schemes, such as RSA and ECDSA, by 2035. Despite this urgency, PQC adoption remains slow, often due to limited developer expertise. Application Programming Interfaces (APIs) are intended to bridge this gap, yet prior research on classical security APIs demonstrates that poor usability of cryptographic APIs can lead developers to introduce vulnerabilities during implementation of the applications, a risk amplified by the novelty and complexity of PQC. To date, the usability of PQC APIs has not been systematically studied. This research presents an empirical evaluation of the usability of the PQC APIs, observing how developers interact with APIs and documentation during software development tasks. The study identifies cognitive factors that influence the developer's performance when working with PQC primitives with minimal onboarding. The findings highlight opportunities across the PQC ecosystem to improve developer-facing guidance, terminology alignment, and workflow examples to better support non-specialists.

cs.CR↗