一句话：首次跨生态实证评估开源供应链的源码级后量子密码（PQC）就绪度，用LLM两阶段扫描百万包，揭示迁移差距与基础设施瓶颈。
后量子密码（PQC）标准落地与“先存后解”威胁使迁移紧迫，但开源供应链就绪度不明。本文首次跨生态实证研究，提出两阶段PQC Scanner：先检测含密码功能的包，再结合提交历史、源码分析与LLM代理后验证，生成二元支持标签与结构化记录。扫描111万个包，识别5.6万个密码相关包；负例审计召回率下界≥97.48%，247样本精度1.000；并发10两周多完成，中位成本$0.0010/包。8个生态仅1.88%密码相关包有源码级PQC支持，Rust领先，NuGet/Ruby/PHP近零；支持仓库中仅19.2%满足完整支持，平均覆盖36%。FIPS后采用加速，但关键库缺位阻碍迁移。
The threat of cryptographically relevant quantum computers, compounded by harvest now, decrypt later attacks, has made migration to post-quantum cryptography (PQC) urgent. With PQC standards finalized and transition guidance phasing out quantum-vulnerable algorithms, the readiness of the open-source supply chain, through which cryptographic vulnerabilities propagate, remains unclear. To fill this gap, we present the first cross-ecosystem empirical study of source-level PQC readiness. PQC Scanner is a two-stage pipeline in which (i) crypto detection identifies packages with cryptographic functionality, and (ii) PQC detection produces a binary support label and source-derived structured readiness record at the repository level using commit history, source analysis, and agent post-verification. Applied to 1,117,913 packages, Stage 1 identifies 55,654 crypto-related packages. Stage 2 evaluates their repositories for source-level PQC support. A separate audit of 219 Stage 2-negative repositories gives a Stage 2 recall lower bound of ≥ 97.48%. On a 247-repository deployment-validation sample, agent post-verification eliminated all false positives, yielding precision of 1.000. The pipeline scales to million-package scans: at concurrency 10, it analyzes over one million packages in just over two weeks, with a median LLM cost of $0.0010 per package. Across 8 ecosystems, we find a migration gap: only 1.88% of crypto-related packages show source-level PQC support, and the repository-deduplicated rate is 1.72%. Rust leads by both counts, while NuGet/Ruby/PHP remain near zero. Source-derived structured readiness records show partial support: among PQC-supporting repositories, only 19.2% satisfy the full-support criterion, with a mean migration coverage of 36%. Adoption accelerates sharply after FIPS publication (August 2024), but migration remains infrastructure-gated: key libraries such as Python’s cryptography (581M downloads/month) and framework integration layers in Java/npm still lack deployable PQC pathways, blocking downstream packages regardless of developer intent. We characterize adoption timing, bottlenecks, and community response strategies, deriving recommendations for maintainers, registry operators, and policy makers.
@inproceedings{paperbot12422,
title = {Post-quantum Cryptography in the Wild: Assessing the Readiness of Open-Source Ecosystems},
author = {Tongxin Yuan and Zhanpeng Liu and Jiashuo Liang and Zhuosheng Zhang and Gongshen Liu and Yang Yu and Guancheng Li},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837461}
}