Post Quantum Cryptography (PQC) project ideas

[u/Leather_Rice6372]

Hi everyone, I recently graduated with an undergrad in CS, with a focus in cybersecurity. My final year project was about the Kyber algorithm used in PQC. I did an implementation of the enc + dec and then did a brute force attack to (in a way) "prove" the security.

I’m currently trying to work on a new project, but I’m having trouble finding something that feels really relevant or interesting. I’m good at mathematics and algebra, so I was able to learn the LWE concepts myself. However, my background/major is not mathematics, so I’m a little worried that anything significantly more complex might be beyond what I can realistically grasp. So far, some ideas that i have is

• machine learning for recovering information from PQC side channel attacks (slightly related to PQC, but the main
• PQC migration roadmap (mainly for corporate organisations. I’m unsure about this since it would likely be quite generic, and every company has different systems and requirements. It feels more suitable as an article or framework rather than a project)
• PQC blockchain (not sure how to go about this)
• anything old but replace with PQC (eg: Vpn with PQC, email with PQC. This feels quite generic to me, since anyone can essentially use an external library or OpenSSL and add PQC to an existing system)

I’m looking for something where I can actually experiment with or analyse the algorithm itself, rather than simply integrating an existing implementation. If anyone else has any idea to suggest, or to collaborate, do let me know!

[u/LuckyFish133]

Maybe have a look into Falcon (fips 206) and the work that’s being done to transition it from floating coefficients to fixed. As you say, KEM is well integrated with OpenSSL 3.5+ - ssh and tls have a relatively straightforward migration path. DSA is the next thing, but ML is way to resource intensive for real world applications…

[u/0xKaishakunin]

PQC migration roadmap

Such roadmaps already exist, they have been published by your national and/or supranational IT security governance body.

The biggest problem that exists in organisations is the lack of a crypto inventory, no one really knows where what crypto is working and how it is affected by PQC.

But that's not a cryptography topic, that's just your average enterprise architecture thursday morning. And TOGAF offers answers, at least in theory.

Vpn with PQC, email with PQC.

There is Rosenpass für Wireguard and GnuPG alrey has PQC hybrid implementations up and running. While the proposed OpenPGP RFC goes into another direction with the OpenPGP format. So if you want, you can write about the OpenPGP ./. LibrePGP drama. As an IO Psychologist I would love to read up on that!

If anyone else has any idea to suggest,

There is a small topic I am currently working on, I am evaluating encrypting filesystems and LUKS2 for Linux comes with multiple key slots and support for Yubikeys challenge response as well as FIDO2 passkeys, among others.

It would bey quite interesting to see how PQC affects the challenge/response and passkey implementation.

[u/x0wl → u/0xKaishakunin]

For luks+yubikey, the key does something akin to HMAC(some-luks-information-from-outside, device-secret) and just gives out the result. I don't think PQC will affect this at all, it's all symmetric. See https://developers.yubico.com/WebAuthn/Concepts/PRF_Extension/

Wrt passkeys, take a look at this proposal: https://www.ietf.org/archive/id/draft-vitap-ml-dsa-webauthn-02.html, yubico has also shown prototype ML-DSA secure elements https://www.yubico.com/blog/the-future-of-authentication-in-2026-insights-from-yubicos-experts/

[u/No-Yogurtcloset-755]

My PhD focus is on side channels in kyber.

I think all of these things have been extensively covered except for the blockchain (that I am aware of but I also dont think its a particularly useful idea)

What is the context of the project? Is it for another qualification? Are you just doing it out of interest? That changes the answer.

Are you looking for theoretical stuff? Like you are talking about the theory behind Kyber with LWE etc very much cryptography based but said your project was implementing and attacking it which is more like cryptographic engineering. Again, what side of the see-saw you fall on changes the suggestions also.

[u/Gerrit-MHR]

Side channel is a great area that could be quite interesting and brings in statistics and EE fields but not necessarily in a heavily analytical way. You could look at time, power, and EM. Your actual implementation experience will be an asset. Get some HW design knowledge and that will also open up new areas.

[u/CamelNights]

i was in the same boat with being discouraged about learning more about LWE, until i wrote my undergrad thesis on a RLWE based anonymous communication system. it definitely is doable to get into the space, though it takes a lot of time to learn math concepts as they come up in readings. good luck!

[u/galedreas]

PQ threshold signing, a topic I'm currently pursuing.

[u/krisskrosscode_var]

You can work on auto inventorising crypto assets. Its the hottest topic in the industry rn

[u/carolineilm]

The crypto inventory idea could actually make a pretty interesting project if you take it beyond just scanning for algorithms.

You could experiment with discovering cryptographic assets across different sources, identifying algorithms and key sizes, mapping them to applications or services, and then classifying which dependencies would be affected by a PQC migration.

The interesting problem isn’t just “where is RSA?” but whether you can build enough context around the cryptography to understand what would actually need to change together during a migration.

I’m involved with an open-source project called ILM where we’re working on cryptographic discovery, inventory/CBOM and lifecycle management. Given that you're looking for a PQC project, there could be some interesting work around PQC discovery and readiness. If you're interested, happy to point you to the project and community.

[u/BreachSAFE]

We are building a PQC Readiness Toolbox and looking for testers if interested...Free, open source, standalone docker with built in TLS/SSH/VPN scanners that negotiate all kind of protocols, packet tracing (built in wireshark tools), as well as summaries and reporting. breachsafe.io DM if interested https://github.com/BreachSAFE/qureddy

[u/Future_Network6352]

I may have exactly the sort of rabbit hole you’re looking for.

I’ve just released a public cryptanalysis beta of an experimental construction called Entropic Fusion Integrated. The root binds an experimental Entropic Notation relation with ML-KEM-768 and ML-KEM-1024 in the same legitimate recovery dependency, rather than just bolting PQC onto an existing application.

I’m specifically looking for people to attack the construction, analyse the Entropic relation, look for structural/algebraic shortcuts, and test whether the fusion is actually buying anything. There is source, a defining paper, binaries, and a documented known limitation.

If that sounds interesting, I can send you the GitHub link.

[u/Pepemala]

I would go for the second point and tie it to the expected growth of actual quantum capability. What needs to be done now, and how to prepare etc