PQC-Readiness of Open-Source Software: An Empirical Study
Lukas Mehl · Sole author
20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026), Emerging Results, Vision & Reflection Track. Leibniz International Proceedings in Informatics (LIPIcs), Vol. 394, pp. 53:1–53:14. Published Oct 5, 2026.
Abstract
Migrating open-source systems to post-quantum cryptography requires knowing where classical public-key primitives still appear in code, yet much empirical work has targeted dependency graphs or misuse of APIs rather than primitive-level, multi-language usage at scale. This paper describes a static analyzer that scans Python, Java, and Go repositories using syntax-aware parsing, classifies cryptographic calls and imports as post-quantum-vulnerable, quantum-safe, or PQC-ready, and aggregates findings for ecosystem-level measurement.
Applied to a stratified sample of about fourteen and a half thousand GitHub repositories, vulnerable primitives are found to be widespread at the level of explicit calls and imports, with strongly language-dependent rates shaped in part by how transport and certificate stacks are treated in static analysis. Evidence of PQC-ready APIs is exceedingly rare by comparison, underscoring a stark adoption gap relative to migration goals. Methodological limitations are stated so the baseline can be interpreted, reproduced, and extended.
Keywords
Presented at ESEM 2026 on Oct 9, 2026 by proxy presenter Phuong T. Nguyen (University of L'Aquila).
How to cite
Lukas Mehl. PQC-Readiness of Open-Source Software: An Empirical Study. In 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 394, pp. 53:1-53:14, Schloss Dagstuhl, Leibniz-Zentrum für Informatik (2026). https://doi.org/10.4230/LIPIcs.ESEM.2026.53
@InProceedings{mehl:LIPIcs.ESEM.2026.53,
author = {Mehl, Lukas},
title = {{PQC-Readiness of Open-Source Software: An Empirical Study}},
booktitle = {20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026)},
pages = {53:1--53:14},
series = {Leibniz International Proceedings in Informatics (LIPIcs)},
ISBN = {978-3-95977-450-5},
ISSN = {1868-8969},
year = {2026},
volume = {394},
editor = {Feldt, Robert and Paasivaara, Maria and Mendez, Daniel and Wagner, Stefan and Bar\'{o}n, Marvin Mu\~{n}oz},
publisher = {Schloss Dagstuhl -- Leibniz-Zentrum f{\"u}r Informatik},
address = {Dagstuhl, Germany},
URL = {https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ESEM.2026.53},
URN = {urn:nbn:de:0030-drops-280211},
doi = {10.4230/LIPIcs.ESEM.2026.53},
annote = {Keywords: post-quantum cryptography, static analysis, empirical study, open-source software, cryptographic primitives}
}© Lukas Mehl. Published by Schloss Dagstuhl in LIPIcs under a Creative Commons Attribution 4.0 (CC BY 4.0) license.