Problem
Research questions and friction points this paper is trying to address.
post-quantum cryptography
TLS deployment
organisational readiness
infrastructure providers
migration assessment
Measuring Post-Quantum TLS Deployment Across UK Internet Sectors
🤖 AI Summary
To accurately assess the real-world deployment status of post-quantum cryptography (PQC) across UK sectors and avoid conflating partial protocol support with comprehensive migration readiness, this study conducts a large-scale measurement of 4,665 organizations spanning ten industries. By actively probing HTTPS and SMTP services for PQC key exchange support and correlating domain/IP ownership to identify infrastructure providers, the research reveals—systematically for the first time—that PQC adoption is primarily driven by underlying cloud service providers rather than sector-specific factors. Current observable deployment is highly concentrated and uneven: 44.0% of HTTPS and 6.4% of SMTP services support PQC, with only 144 organizations deploying PQC in both protocols, and no instances of post-quantum certificate signatures detected.
📝 Abstract
Post-quantum cryptography (PQC) is becoming an important component of long-term trust in Internet-facing infrastructure. Publicly observable PQC support provides evidence of externally visible deployment, but does not necessarily reflect the overall progress of an organisation's post-quantum migration. This distinction matters when observable deployment is used as an indicator of organisational readiness or progress towards migration deadlines.
We present a measurement study of observable PQC deployment across 4,665 UK organisations spanning ten sectors. We measure post-quantum key-exchange support across HTTPS and SMTP STARTTLS endpoints, attribute reachable endpoints to their underlying infrastructure providers where possible, and statistically examine protocol-, sector-, and provider-level deployment patterns. Among reachable endpoints, 44.0\% of HTTPS services supported at least one evaluated PQC key-exchange group, compared with 6.4\% of SMTP services. Among organisations reachable over both protocols, HTTPS support was significantly more common than SMTP support (matched odds ratio 16.89). Although deployment varied across sectors, infrastructure provider identity was substantially more predictive than organisational sector, and observable deployment was highly concentrated among a small number of providers. Only 144 organisations supported PQC across both web and email infrastructure, highlighting an uneven and fragmented migration landscape. No post-quantum certificate signatures were observed across the measured endpoints. These findings show that observable PQC deployment is currently shaped predominantly by infrastructure-provider deployment decisions and should not be interpreted as a complete measure of organisational migration readiness.
Innovation
Methods, ideas, or system contributions that make the work stand out.
post-quantum cryptography
TLS deployment
infrastructure providers
measurement study
organisational readiness
🔎 Similar Papers
No similar papers found.
