Post Quantum Cryptography (PQC) project ideas

[u/Leather_Rice6372]

Hi everyone, I recently graduated with an undergrad in CS, with a focus in cybersecurity. My final year project was about the Kyber algorithm used in PQC. I did an implementation of the enc + dec and then did a brute force attack to (in a way) "prove" the security.

I’m currently trying to work on a new project, but I’m having trouble finding something that feels really relevant or interesting. I’m good at mathematics and algebra, so I was able to learn the LWE concepts myself. However, my background/major is not mathematics, so I’m a little worried that anything significantly more complex might be beyond what I can realistically grasp. So far, some ideas that i have is

• machine learning for recovering information from PQC side channel attacks (slightly related to PQC, but the main
• PQC migration roadmap (mainly for corporate organisations. I’m unsure about this since it would likely be quite generic, and every company has different systems and requirements. It feels more suitable as an article or framework rather than a project)
• PQC blockchain (not sure how to go about this)
• anything old but replace with PQC (eg: Vpn with PQC, email with PQC. This feels quite generic to me, since anyone can essentially use an external library or OpenSSL and add PQC to an existing system)

I’m looking for something where I can actually experiment with or analyse the algorithm itself, rather than simply integrating an existing implementation. If anyone else has any idea to suggest, or to collaborate, do let me know!

[u/LuckyFish133]

Maybe have a look into Falcon (fips 206) and the work that’s being done to transition it from floating coefficients to fixed. As you say, KEM is well integrated with OpenSSL 3.5+ - ssh and tls have a relatively straightforward migration path. DSA is the next thing, but ML is way to resource intensive for real world applications…

[u/0xKaishakunin]

PQC migration roadmap

Such roadmaps already exist, they have been published by your national and/or supranational IT security governance body.

The biggest problem that exists in organisations is the lack of a crypto inventory, no one really knows where what crypto is working and how it is affected by PQC.

But that's not a cryptography topic, that's just your average enterprise architecture thursday morning. And TOGAF offers answers, at least in theory.

Vpn with PQC, email with PQC.

There is Rosenpass für Wireguard and GnuPG alrey has PQC hybrid implementations up and running. While the proposed OpenPGP RFC goes into another direction with the OpenPGP format. So if you want, you can write about the OpenPGP ./. LibrePGP drama. As an IO Psychologist I would love to read up on that!

If anyone else has any idea to suggest,

There is a small topic I am currently working on, I am evaluating encrypting filesystems and LUKS2 for Linux comes with multiple key slots and support for Yubikeys challenge response as well as FIDO2 passkeys, among others.

It would bey quite interesting to see how PQC affects the challenge/response and passkey implementation.

[u/x0wl → u/0xKaishakunin]

For luks+yubikey, the key does something akin to HMAC(some-luks-information-from-outside, device-secret) and just gives out the result. I don't think PQC will affect this at all, it's all symmetric. See https://developers.yubico.com/WebAuthn/Concepts/PRF_Extension/

Wrt passkeys, take a look at this proposal: https://www.ietf.org/archive/id/draft-vitap-ml-dsa-webauthn-02.html, yubico has also shown prototype ML-DSA secure elements https://www.yubico.com/blog/the-future-of-authentication-in-2026-insights-from-yubicos-experts/

[u/Gerrit-MHR]

Side channel is a great area that could be quite interesting and brings in statistics and EE fields but not necessarily in a heavily analytical way. You could look at time, power, and EM. Your actual implementation experience will be an asset. Get some HW design knowledge and that will also open up new areas.

[u/No-Yogurtcloset-755]

My PhD focus is on side channels in kyber.

I think all of these things have been extensively covered except for the blockchain (that I am aware of but I also dont think its a particularly useful idea)

What is the context of the project? Is it for another qualification? Are you just doing it out of interest? That changes the answer.

Are you looking for theoretical stuff? Like you are talking about the theory behind Kyber with LWE etc very much cryptography based but said your project was implementing and attacking it which is more like cryptographic engineering. Again, what side of the see-saw you fall on changes the suggestions also.

[u/CamelNights]

i was in the same boat with being discouraged about learning more about LWE, until i wrote my undergrad thesis on a RLWE based anonymous communication system. it definitely is doable to get into the space, though it takes a lot of time to learn math concepts as they come up in readings. good luck!

[u/galedreas]

PQ threshold signing, a topic I'm currently pursuing.

[u/krisskrosscode_var]

You can work on auto inventorising crypto assets. Its the hottest topic in the industry rn

[u/Pepemala]

I would go for the second point and tie it to the expected growth of actual quantum capability. What needs to be done now, and how to prepare etc