Where the PQC Migration Actually Stands: A Cross-Ecosystem Census of 2.8 Million Packages
· 11:45 – 12:30 Amsterdam time · Blue hall
The NIST 2030 deprecation deadline for quantum-vulnerable public-key algorithms is 1,386 days away as of March 2026. Every PKI operator, certificate authority, and security team needs to know how the software supply chain they depend on is responding. No cross-ecosystem measurement existed. We built one. This session presents findings from the first cross-ecosystem cryptographic census, scanning 2,809,479 packages across 11 package ecosystems including npm, PyPI, Go, Maven, crates.io, NuGet, and others. The results reveal the actual state of PQC adoption in the open-source supply chain that PKI infrastructure depends on. Of the 2.8 million packages scanned, 108,145 use cryptographic libraries. Among those, 21,332 depend on weak or deprecated algorithms such as MD5, SHA-1, DES, and RC4. Only 188 packages, or 0.17 percent of crypto-using packages, have any post-quantum cryptography dependency. PQC adoption is concentrated in 5 of 11 ecosystems, with crates.io accounting for 58 percent of all PQC-dependent packages. Six ecosystems show zero PQC adoption. Maven has the worst weak crypto rate at 51.6 percent.
Beyond the headline numbers, the talk addresses the migration gap that matters most for PKI operators. Dependency-level scanning, the foundation of most software composition analysis tools, misses approximately 4 times the cryptographic surface area visible to source-level analysis. We validated this gap on 20 production projects and found that 30 percent of projects with active cryptographic code show zero dependency-level signal. For PKI operators conducting cryptographic inventories under NIST IR 8547 or OMB M-23-02, this means current tooling systematically undercounts exposure.
Attendees leave with three actionable outcomes: the current state of PQC adoption in their language ecosystem with named libraries and migration paths; a reproducible census methodology they can apply to internal package registries and vendor assessments; and a clear understanding of why dependency scanning alone fails for cryptographic inventory and what to do about it.
All scanning tools, the 357-library classification catalog, the full scan dataset, and a live dashboard are released open source.
Speakers
- Co-Founder · CryptoServe
Abdel Fane is co-founder of CryptoServe and co-creator of QRAMM, the Quantum Readiness Assurance Maturity Model, presented at DEF CON 2025. He led the cross-ecosystem cryptographic census of 2.8 million packages presented in this session, building the scanning methodology and 357-library classification catalog from the ground up.
He has 20 years of security experience across healthcare, financial services, and government, including engagements with Booz Allen Hamilton, Protiviti, Allstate, and the U.S. Department of Veterans Affairs. He holds a Master's in Cyber Forensics and Security. He is also Executive Director of CyberSecurity NonProfit, a 501(c)(3) with 13,000+ members across 16 global chapters.
Attendance
Open session · first come, first served
Saving interest does not reserve a seat. Admission remains first come, first served.
Save favorite
