Search papers, labs, and topics across Lattice.
This paper presents an empirical study evaluating the usability of Post-Quantum Cryptography (PQC) APIs by observing developers interacting with the APIs and documentation during software development tasks. The study identifies cognitive factors impacting developer performance when working with PQC primitives with minimal onboarding, revealing usability challenges specific to PQC. The findings suggest improvements in developer-facing guidance, terminology alignment, and workflow examples to facilitate PQC adoption by non-specialists.
PQC adoption is slow not just due to complexity, but also because current PQC APIs suffer from poor usability, leading developers to make mistakes even with minimal onboarding.
Advances in quantum computing increasingly threaten the security and privacy of data protected by current cryptosystems, particularly those relying on public-key cryptography. In response, the international cybersecurity community has prioritized the implementation of Post-Quantum Cryptography (PQC), a new cryptographic standard designed to resist quantum attacks while operating on classical computers. The National Institute of Standards and Technology (NIST) has already standardized several PQC algorithms and plans to deprecate classical asymmetric schemes, such as RSA and ECDSA, by 2035. Despite this urgency, PQC adoption remains slow, often due to limited developer expertise. Application Programming Interfaces (APIs) are intended to bridge this gap, yet prior research on classical security APIs demonstrates that poor usability of cryptographic APIs can lead developers to introduce vulnerabilities during implementation of the applications, a risk amplified by the novelty and complexity of PQC. To date, the usability of PQC APIs has not been systematically studied. This research presents an empirical evaluation of the usability of the PQC APIs, observing how developers interact with APIs and documentation during software development tasks. The study identifies cognitive factors that influence the developer's performance when working with PQC primitives with minimal onboarding. The findings highlight opportunities across the PQC ecosystem to improve developer-facing guidance, terminology alignment, and workflow examples to better support non-specialists.
