When Security Meets Usability: An Empirical Investigation of Post-Quantum Cryptography APIs

TL;DR

This paper empirically investigates the usability challenges of Post-Quantum Cryptography APIs, highlighting the need for improved developer guidance and documentation to facilitate secure implementation amidst increasing quantum threats.

Contribution

It provides the first systematic empirical evaluation of PQC API usability, identifying cognitive factors affecting developer performance and offering recommendations for API improvement.

Findings

Developers face cognitive challenges when using PQC APIs.

Poor API usability can lead to security vulnerabilities.

Enhanced documentation and guidance can improve developer performance.

Abstract

Advances in quantum computing increasingly threaten the security and privacy of data protected by current cryptosystems, particularly those relying on public-key cryptography. In response, the international cybersecurity community has prioritized the implementation of Post-Quantum Cryptography (PQC), a new cryptographic standard designed to resist quantum attacks while operating on classical computers. The National Institute of Standards and Technology (NIST) has already standardized several PQC algorithms and plans to deprecate classical asymmetric schemes, such as RSA and ECDSA, by 2035. Despite this urgency, PQC adoption remains slow, often due to limited developer expertise. Application Programming Interfaces (APIs) are intended to bridge this gap, yet prior research on classical security APIs demonstrates that poor usability of cryptographic APIs can lead developers to introduce vulnerabilities during implementation of the applications, a risk amplified by the novelty and complexity of PQC. To date, the usability of PQC APIs has not been systematically studied. This research presents an empirical evaluation of the usability of the PQC APIs, observing how developers interact with APIs and documentation during software development tasks. The study identifies cognitive factors that influence the developer's performance when working with PQC primitives with minimal onboarding. The findings highlight opportunities across the PQC ecosystem to improve developer-facing guidance, terminology alignment, and workflow examples to better support non-specialists.