Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

When Security Meets Usability: An Empirical Investigation of Post-Quantum Cryptography APIs

Marthin Toruan, R. D. N. Shakya, Samuel Tseitkin, Raymond K. Zhao, Nalin Arachchilage

TL;DR

An empirical evaluation of the usability of the PQC APIs is presented, observing how developers interact with APIs and documentation during software development tasks to highlight opportunities across the PQC ecosystem to improve developer-facing guidance, terminology alignment, and workflow examples to better support non-specialists.

Abstract

Advances in quantum computing increasingly threaten the security and privacy of data protected by current cryptosystems, particularly those relying on public-key cryptography. In response, the international cybersecurity community has prioritized the implementation of Post-Quantum Cryptography (PQC), a new cryptographic standard designed to resist quantum attacks while operating on classical computers. The National Institute of Standards and Technology (NIST) has already standardized several PQC algorithms and plans to deprecate classical asymmetric schemes, such as RSA and ECDSA, by 2035. Despite this urgency, PQC adoption remains slow, often due to limited developer expertise. Application Programming Interfaces (APIs) are intended to bridge this gap, yet prior research on classical security APIs demonstrates that poor usability of cryptographic APIs can lead developers to introduce vulnerabilities during implementation of the applications, a risk amplified by the novelty and complexity of PQC. To date, the usability of PQC APIs has not been systematically studied. This research presents an empirical evaluation of the usability of the PQC APIs, observing how developers interact with APIs and documentation during software development tasks. The study identifies cognitive factors that influence the developer's performance when working with PQC primitives with minimal onboarding. The findings highlight opportunities across the PQC ecosystem to improve developer-facing guidance, terminology alignment, and workflow examples to better support non-specialists.

When Security Meets Usability: An Empirical Investigation of Post-Quantum Cryptography APIs

TL;DR

An empirical evaluation of the usability of the PQC APIs is presented, observing how developers interact with APIs and documentation during software development tasks to highlight opportunities across the PQC ecosystem to improve developer-facing guidance, terminology alignment, and workflow examples to better support non-specialists.

Abstract

Advances in quantum computing increasingly threaten the security and privacy of data protected by current cryptosystems, particularly those relying on public-key cryptography. In response, the international cybersecurity community has prioritized the implementation of Post-Quantum Cryptography (PQC), a new cryptographic standard designed to resist quantum attacks while operating on classical computers. The National Institute of Standards and Technology (NIST) has already standardized several PQC algorithms and plans to deprecate classical asymmetric schemes, such as RSA and ECDSA, by 2035. Despite this urgency, PQC adoption remains slow, often due to limited developer expertise. Application Programming Interfaces (APIs) are intended to bridge this gap, yet prior research on classical security APIs demonstrates that poor usability of cryptographic APIs can lead developers to introduce vulnerabilities during implementation of the applications, a risk amplified by the novelty and complexity of PQC. To date, the usability of PQC APIs has not been systematically studied. This research presents an empirical evaluation of the usability of the PQC APIs, observing how developers interact with APIs and documentation during software development tasks. The study identifies cognitive factors that influence the developer's performance when working with PQC primitives with minimal onboarding. The findings highlight opportunities across the PQC ecosystem to improve developer-facing guidance, terminology alignment, and workflow examples to better support non-specialists.
Paper Structure (42 sections, 4 figures, 5 tables)

This paper contains 42 sections, 4 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Literature Review
  3. Importance of migrating to PQC
  4. Usability Issues of Security API
  5. Related Work
  6. Research Methodology
  7. Programming Language and Chosen PQC APIs
  8. Task design
  9. Participant recruitment
  10. The pilot study
  11. Study procedure
  12. Evaluation of PQC Usability
  13. Results
  14. Participant Demographics
  15. Task Performance
  16. ...and 27 more sections

Figures (4)

  • Figure 1: Cognitive Dimensions Framework.
  • Figure 2: Study Procedure Diagram.
  • Figure 3: Key Encapsulation Mechanism and Symmetric Encryption Workflow.
  • Figure 4: Mistake on PQ-Sandbox Documentation (Source: ExequantumDocs).