- The paper measures negotiated TLS parameters across 32,011 domains using browser-based TLS probing, OpenSSL, cURL, packet captures, and infrastructure fingerprinting, finding that 49.3% use hybrid X25519MLKEM768 while 50.7% remain classical.
- The paper finds that 15.70% of domains still negotiate TLS 1.2, with critical sectors such as banking, government, defence, telecom, and energy particularly exposed to Harvest-Now-Decrypt-Later risks and classical fallback.
- The paper identifies a major authentication gap because zero observed certificates use post-quantum or hybrid signatures, showing that hybrid key exchange alone cannot provide end-to-end quantum security without PQC-enabled PKI and trusted certificates.
This paper presents a large-scale empirical measurement of post-quantum cryptographic (PQC) readiness across 32,011 active Internet domains, combining active TLS probing with a quantum threat model (2606.16473). The central finding is a split deployment landscape: 49.3% of domains negotiate hybrid post-quantum key exchange (X25519MLKEM768), while the remaining 50.7% rely exclusively on classical key agreement, and 0% of observed certificates use post-quantum or hybrid signature algorithms. The study thereby quantifies a transition that is well underway at the confidentiality layer but essentially absent at the authentication layer.
Measurement methodology
The dataset merges 31,884 domains from the Tranco ranking with 127 banking domains drawn from the Reserve Bank of India's authorized institution list, yielding a corpus spanning banking, government, defence, cloud, education, e-commerce, healthcare, media, telecom, energy, and a large residual category. The extraction framework is a multi-tool pipeline: Selenium with Chrome DevTools Protocol collects negotiated TLS parameters (version, cipher suite, key exchange group, HTTP protocol) under realistic browser conditions; OpenSSL s_client probes with SNI extract handshake and certificate details; cURL captures HTTP headers, Alt-Svc advertisements (for HTTP/3/QUIC inference), web server strings, and CDN fingerprints; and a ThreadPoolExecutor with 50 workers provides parallelism with thread-safe CSV writes. Wireshark packet captures and Chrome Developer Tools inspections serve as independent validation of the automated extraction.
The authors are explicit that all reported parameters are negotiated values, jointly determined by client and server policy rather than server capability alone. This is an important methodological caveat that shapes the interpretation of every adoption figure in the paper: a domain observed with classical key exchange may still support hybrid PQC for capable clients, and vice versa.
Protocol distribution and legacy dependence
TLS 1.3 dominates at 52.41% of domains (16,779), with QUIC/HTTP/3 at 31.89% (10,208) and TLS 1.2 persisting at 15.70% (5,024). The paper argues that TLS 1.2 is architecturally incompatible with practical PQC integration: its cipher-suite-coupled key exchange cannot accommodate KEM-based hybrids with large key shares (832–1,216 bytes for ML-KEM hybrids versus 32 bytes for X25519), whereas TLS 1.3's key_share extension natively supports hybrid negotiation. A device-level observation on a banking domain illustrates the negotiation problem concretely: one device established a QUIC connection with X25519 and AES-256-GCM, while another fell back to TLS 1.2 with ECDHE-RSA and AES-128-GCM against the same server. The implication drawn is that server-side PQC deployment is insufficient; client modernization is a co-requisite, and fallback paths can silently negate quantum-resistant benefits.
Sector-wise, TLS 1.2 concentration is highest precisely where the stakes are largest—banking, government, defence, telecom, and energy. The authors contextualize this with ENISA incident statistics (public administration at 19% of observed incidents; 488 reported financial-sector incidents in 2023–2024), arguing that the combination of high attack frequency and classical cryptography elevates long-term Harvest-Now-Decrypt-Later (HNDL) exposure in these sectors.
Cipher suites and key exchange
The cipher suite analysis draws a sharp classical-versus-quantum distinction: TLS 1.3 suites (TLS_AES_256_GCM_SHA384 at 19,837 domains, TLS_AES_128_GCM_SHA256 at 6,319) provide strong authenticated encryption but remain anchored to classical public-key operations, while legacy ECDHE-RSA and DHE-RSA suites in TLS 1.2 are vulnerable to both Shor (key establishment) and Grover (reduced symmetric security). The paper is careful to note these suites are not insecure against classical adversaries—only not quantum-safe.
The key exchange distribution is the study's headline quantitative result:
| Key exchange group |
Share |
Quantum impact |
| X25519MLKEM768 |
49.30% |
Hybrid, quantum-resistant |
| X25519 |
38.15% |
Vulnerable |
| prime256v1 (P-256) |
10.33% |
Vulnerable |
| secp384r1 |
1.40% |
Vulnerable |
| secp521r1 |
0.71% |
Vulnerable |
| RSA |
0.09% |
Vulnerable |
| X448 |
0.01% |
Vulnerable |
The authors appropriately temper the hybrid figure: hybrid constructions do not provide absolute security, since ML-KEM lacks the cryptanalytic maturity of classical schemes, hybrid implementations enlarge the side-channel attack surface, and downgrade mechanisms can coerce classical-only negotiation. The near-even 49.3/50.7 split is characterized as evidence of a transitional ecosystem rather than a completed or failed migration.
The authentication gap
The most consequential finding is the certificate analysis. Across the entire dataset, certificate signature algorithms are exclusively classical: PKCS #1 RSA with SHA-256 (54.05%), ECDSA variants (~43.1% combined), and RSA with SHA-512 (2.85%). Zero post-quantum or hybrid certificates were observed, and the TLS handshake signature_algorithms extensions likewise contained only RSA/ECDSA options. The paper states plainly that this leaves the authentication layer open to certificate forgery and man-in-the-middle attacks under a quantum adversary, and that hybrid key exchange alone therefore cannot deliver end-to-end quantum security. The authors attribute the gap to the PKI ecosystem rather than algorithm availability—CA issuance workflows, certificate transparency logging, and browser trust stores for PQC signatures remain under development.
Infrastructure and sector risk
CDN analysis shows Cloudflare (37.97% of CDN-attributed domains) serving hybrid X25519MLKEM768 by default, with AWS CloudFront, Google Cloud CDN/GFE, Akamai, Fastly, and Imperva offering hybrid PQC in varying modes; Sucuri shows no direct PQC; and 45.37% of domains have hidden or undetectable CDN configuration, an explicit visibility limitation. Web server analysis similarly shows PQC support is inherited from TLS libraries (OpenSSL ≥ 3.5, OQS providers, Go-based stacks) rather than implemented in server software, with 35.56% of origins hidden or unidentified. A sector risk heatmap assigns high or very high quantum risk to BFSI, government, defence, telecom, energy, and legal sectors (none to partial PQC adoption), and low risk to cloud/CDN, search, social media, and media sectors—consistent with the paper's thesis that performance-driven platforms lead adoption while regulated critical infrastructure lags due to compliance cycles and infrastructure longevity.
Limitations and open questions
Several constraints qualify the results. First, the negotiated-parameters caveat means adoption percentages conflate server capability and client capability; the study does not disentangle the two at scale (the device-level experiment is anecdotal). Second, 45.37% of CDN attribution and 35.56% of web server attribution are hidden or unknown, so quantum readiness for roughly a third to a half of the infrastructure layer cannot be assessed. Third, the dataset is anchored in the Tranco ranking plus Indian banking domains, so sector proportions (e.g., only 183 BFSI domains) may not generalize to sector-weighted Internet populations. Fourth, the paper does not report scan coverage or failure rates beyond DNS-resolution skipping, nor does it measure whether the 50.7% classical-key-exchange domains would negotiate hybrids with a PQC-capable client. Open questions left by the study include: how quickly PQC certificates can be issued and trusted at scale through existing CA and transparency infrastructure; whether downgrade-prevention mechanisms suffice to stop classical fallback in mixed deployments; and what migration strategies can accelerate PQC uptake in compliance-bound sectors.
Conclusion
This measurement study documents an Internet in asymmetric transition: confidentiality against quantum adversaries is roughly half-deployed through hybrid X25519MLKEM768 key exchange concentrated in cloud and CDN infrastructure, while authentication remains 100% classical, and 15.70% of domains—disproportionately in critical sectors—still negotiate TLS 1.2. The paper's central claim, well supported by its data, is that key exchange migration without certificate migration leaves the trust model intact for classical attackers but not for quantum-capable ones, and that HNDL risk persists wherever classical key agreement or TLS 1.2 fallback remains reachable. The identified barrier is no longer standards availability (ML-KEM, ML-DSA, SLH-DSA are standardized) but operational and ecosystem-level migration, particularly in PKI.