Chapter 2 — Quantum and post-quantum security: research frontier
Lesson map
Lesson 02 published. Map, example, EX008.
flowchart TD
N0["Learning outcomes and connection"]
N1["2.1 Why the frontier is hard to see"]
N2["2.2 Research families"]
N3["2.3 What standardization settled and what it did not"]
N4["2.4 Appraisal: what makes a PQC inventory or migrati"]
N5["2.6 Practical activity — Lab 2: code the map"]
N6["2.7 A falsifiable gap"]
N7["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX008"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["2.1 Why the frontier is hard to see"]
N2["2.2 Research families"]
N3["2.3 What standardization settled and what it did not"]
N4["2.4 Appraisal: what makes a PQC inventory or migrati"]
N5["2.6 Practical activity — Lab 2: code the map"]
N6["2.7 A falsifiable gap"]
N7["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX008"]
[Learning outcomes and connection]
|
v
[2.1 Why the frontier is hard to see]
|
v
[2.2 Research families]
|
v
[2.3 What standardization settled and what it did not]
|
v
[2.4 Appraisal: what makes a PQC inventory or migrati]
|
v
[2.6 Practical activity — Lab 2: code the map]
|
v
[2.7 A falsifiable gap]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX008]
Learning outcomes and connection
After this chapter you can (1) describe the six main research families in quantum and post-quantum security and the kind of evidence each produces; (2) explain what the NIST standardization process settled and what it left open; (3) appraise a PQC study for construct validity, baseline fairness and corpus independence; (4) code a literature map and locate an empty cell; and (5) state a falsifiable gap. It builds on the claim ladder of Chapter 1 and supplies the question that Chapter 3 turns into a contribution.
2.1 Why the frontier is hard to see
The field is split across communities that rarely cite each other: quantum-algorithm researchers publishing on arXiv, cryptographers at IACR venues and on the IACR ePrint archive, protocol engineers at the IETF, and practitioners writing vendor reports. Vocabulary differs — "quantum-safe", "quantum-resistant", "post-quantum" and "PQC-ready" are used loosely — so a keyword search misses half the literature. Build a synonym table before you search, and record the date: in this field a two-year-old survey can describe a broken scheme as a leading candidate.
2.2 Research families
- Quantum cryptanalysis and resource estimation. Shor's algorithm breaks factoring and discrete logarithms in polynomial time on a fault-tolerant machine (Shor 1997); Grover's search gives at most a quadratic speed-up against symmetric keys and hashes (Grover 1996), which is why AES-256 and SHA-384/512 remain the conservative choices rather than being replaced. Current research refines qubit and time counts (Gidney and Ekerå 2021; Gidney 2025). Evidence: algorithmic analysis under explicit hardware models.
- Hard problems and schemes. Lattices — learning with errors (Regev 2009) and its module variants underlie ML-KEM and ML-DSA; Falcon (NTRU lattices) is being standardized as FN-DSA. Hashes — SLH-DSA (stateless) and LMS/XMSS (stateful; RFC 8554, RFC 8391) rely only on hash-function properties. Codes — Classic McEliece descends from McEliece (1978); HQC was selected in March 2025 for standardization as a second KEM based on a different assumption (NIST IR 8545). Multivariate — Rainbow, a third-round finalist, was broken by a key-recovery attack (Beullens 2022). Isogenies — SIKE was broken by an efficient key-recovery attack (Castryck and Decru 2022). Evidence: proofs, cryptanalysis, parameter estimates.
- Standards and policy. FIPS 203/204/205 (August 2024), SP 800-227 on using KEMs (September 2025), the draft transition plan NIST IR 8547 and agility guidance in NIST CSWP 39. Evidence: documents with status and history.
- Hybrid protocols. Terminology in RFC 9794; TLS 1.3 hybrid groups such as X25519MLKEM768 in RFC 10024. Research questions concern combiner security, message size, middlebox tolerance and downgrade resistance. Evidence: proofs, interoperability tests, internet measurement.
- Implementation security. Constant-time arithmetic, decryption-failure handling, fault attacks and side channels in lattice implementations; timing leaks from secret-dependent division in several Kyber implementations were reported as "KyberSlash" (Bernstein et al. 2024). Evidence: lab measurement against named code versions.
- Inventory and agility. How organizations discover where cryptography is used, build a cryptographic bill of materials (CBOM) and make algorithms replaceable. Evidence: case studies, benchmarks, field measurements — the least mature family methodologically, as Lab 2 shows.
2.3 What standardization settled and what it did not
The NIST process settled a portfolio: one general-purpose KEM (ML-KEM), a lattice signature (ML-DSA), a conservative hash-based signature (SLH-DSA), with Falcon and HQC to follow (NIST IR 8413 explains the third-round selections). It did not settle deployment: how hybrid secrets should be combined in every protocol, how certificates should carry new or composite keys, how constrained devices should cope with ML-DSA signatures of 2,420–4,627 bytes (FIPS 204 parameter sets), or how an organization can show that it has found every quantum-vulnerable use. The breaks of Rainbow and SIKE late in the process are the field's standing reminder that confidence in a hard problem is earned over years, which is the scientific argument for hybrid deployment and agility.
2.4 Appraisal: what makes a PQC inventory or migration study credible
Ask five questions. Construct validity: does "vulnerable use" mean an algorithm present in code, configured, negotiated, or protecting data with a long lifetime? Ground truth: who adjudicated it, blind to the method under test? Baseline fairness: was the rival tool configured by someone competent, with the same access? Corpus independence: was the method tuned on the corpus it was evaluated on, or validated on a second organization? Unknowns: are unreachable assets reported? A study can be useful while failing some of these, but its claims must shrink accordingly.
2.5 Worked example: appraising synthetic studies Q1–Q8
Q1 and Q6 are single-hospital case studies that report "94% of RSA use found" against a ground truth produced by the same tool — circular. Q2 and Q8 benchmark scanners on a corpus published by one of the vendors — independence "same-vendor". Q3 measures hybrid-group negotiation across a large set of public websites with a documented method and is independent. Q4 benchmarks hybrid handshakes in a lab with no external replication. Q5 reproduces a timing leak in two independent labs. Q7 is a position paper on agility with no data. Coding them (Lab 2) shows that inventory — the family a migration programme depends on most — has no study validated on an independent corpus. That empty cell becomes the Ciphertrail gap.
2.6 Practical activity — Lab 2: code the map
# Lab 2 (synthetic): code eight fictional studies Q1-Q8 and find empty cells.
studies = { # id: (family, evidence type, corpus independence)
"Q1": ("inventory", "single-org case", "none"),
"Q2": ("inventory", "benchmark", "same-vendor"),
"Q3": ("hybrid-protocol", "internet measurement", "independent"),
"Q4": ("hybrid-protocol", "lab benchmark", "none"),
"Q5": ("implementation", "side-channel lab", "independent"),
"Q6": ("inventory", "single-org case", "none"),
"Q7": ("agility", "position paper", "none"),
"Q8": ("inventory", "benchmark", "same-vendor"),
}
families = sorted({f for f, _, _ in studies.values()})
indep = ["none", "same-vendor", "independent"]
print(f"{'family':16s}" + "".join(f"{i:>13s}" for i in indep))
for fam in families:
row = [sum(1 for f, _, c in studies.values() if f == fam and c == i) for i in indep]
print(f"{fam:16s}" + "".join(f"{n:13d}" for n in row))
gaps = [fam for fam in families
if not any(f == fam and c == "independent" for f, _, c in studies.values())]
print("families with no independently validated study:", ", ".join(gaps))
Expected output:
family none same-vendor independent
agility 1 0 0
hybrid-protocol 1 0 1
implementation 0 0 1
inventory 2 2 0
families with no independently validated study: agility, inventory
Extend the coding scheme with a fourth column for "ground truth independent of tool" and re-run; a gap that survives two codings is more defensible than one that appears under a single scheme.
The table makes the gap visible in one glance: four inventory studies, none validated on an independent corpus. The coding is only as good as its rules, so write down what counts as same-vendor or independent before coding and ask a second person to code the eight studies separately. If the second coder moves a study into the independent column, the gap statement must change before it goes into the proposal.
2.7 A falsifiable gap
A gap is not "nobody has studied PQC inventories". It is a specific, testable absence: no published inventory method reports recall of quantum-vulnerable key-establishment and signature uses against blind adjudication on a corpus independent of its development corpus, with unknown share reported. The statement is falsifiable — one counter-example in the literature would close it — and it names the measurements a contribution must make.
Check the gap against the literature again just before submission, because a counter-example published during the thesis would close it. Record the date and the search used for that final check. If a study appears that partly fills the gap, the contribution can still stand, but it must be repositioned as replication or extension rather than first measurement.
2.8 Common errors and limits
- Citing a broken scheme as a candidate because the survey predates the break.
- Treating Grover as fatal to AES; it halves effective key length in the idealized model and is far harder to parallelize.
- Confusing quantum key distribution (QKD) with PQC. QKD is a physical-layer technique with distinct requirements; several national agencies, including the NSA, do not recommend it for national-security systems.
- Mistaking standards status: FN-DSA and HQC were not final standards on 12 October 2026.
- Lab 2's corpus is invented; the method, not the counts, transfers.
Exercises — chapter 2
Rubric 0–3 as in Chapter 1.
- EX008 — Synonym table. Build a twelve-term synonym and exclusion table for a PQC inventory search across arXiv, ePrint and IETF. Evidence: table and two search strings. Rubric: 3 = covers vendor and standards vocabulary and excludes QKD-only work deliberately.
- EX009 — Family evidence. For each of the six families, name the strongest form of evidence and one typical weakness. Evidence: six-row table. Rubric: 3 = weaknesses specific.
- EX010 — Status check. Verify the current status of FIPS 206, the HQC standard and NIST IR 8547 from primary pages. Evidence: three citations with dates checked. Rubric: 3 = primary sources only, dates recorded.
- EX011 — Appraise Q1. Apply the five appraisal questions to Q1. Evidence: a paragraph per question. Rubric: 3 = identifies circular ground truth and the claim it can still support.
- EX012 — Recode the map. Add the "ground truth independent" column to Lab 2 with your own judgements. Evidence: code diff and output. Rubric: 3 = codes justified and gap re-examined.
- EX013 — Lessons from breaks. Explain in 250 words what the Rainbow and SIKE breaks imply for migration architecture. Rubric: 3 = links breaks to hybrid deployment and agility without overstating.
- EX014 — State the gap. Write a one-sentence falsifiable gap for a question of your own. Rubric: 3 = names population, measurement and what would falsify it.
Chapter synthesis
The frontier spans six families with different evidence cultures. Standardization settled a portfolio of algorithms, not their deployment. Inventory and agility — the families migrations depend on most — have the weakest evidence, and a falsifiable gap there is a legitimate doctoral contribution.
Continue studying — chapter 02 of 08
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →