SoK: Post-Quantum Cryptography Implementation in Software: Approaches, Challenges and the PQC-HOT Framework
arXiv:2606.04669
The paper surveys how post‑quantum cryptography can be integrated into software, highlighting technical, human, and organizational challenges, and proposes a conceptual PQC‑HOT framework to guide implementation.
Abstract
Achieving quantum resilience in software systems is increasingly critical as quantum computing threatens conventional cryptographic mechanisms. One approach to achieving quantum resilience is implementing software systems with Post-Quantum Cryptography (PQC) mechanisms. However, developers and organisations face significant challenges in integrating PQC into real world systems due to implementation complexity, limited expertise, and insufficient organisational readiness. Existing studies largely emphasise cryptographic performance and algorithmic security, offering limited insight into the broader Human Organisation Technology (HOT) factors influencing successful PQC implementation. This Systematisation of Knowledge (SoK) examines PQC implementation approaches and challenges through the Human, Organisation, and Technology (HOT) dimensions. Our analysis reveals a strong technological bias in current research, with human and organisational factors remaining underexplored. We further show that PQC implementation challenges are interconnected constraints spanning all HOT dimensions. These findings suggest that PQC implementation extends beyond cryptographic replacement and requires coordinated HOT transformation to achieve quantum resilience. To support this, we propose the PQC HOT framework, a conceptual framework that synthesises implementation approaches and challenges to support structured analysis. We outline future research directions and design implications for scalable and sustainable quantum-resilient software systems.