PaperlayerView exact revision on arXiv

Source-linked AI summary

A Global Readiness and Sovereignty Capability Model for Post-Quantum Cryptography Migration

Mohamed Aly Bouke

arXiv:2609.18477v1cs.CRcs.CY

TL;DR

PQC migration can lock in cryptographic dependence for decades, while existing readiness measures do not show whether countries control the technology they deploy. The paper presents RSCM, a national model that measures readiness alongside decomposed sovereignty and applies a sustained-creation gate for post-quantum makers. Its assessment finds that post-quantum creation is concentrated among makers, while many capable countries lack post-quantum control.

  • Problem

    PQC migration can establish cryptographic foundations for decades, yet readiness alone does not distinguish countries controlling their post-quantum stack from those relying on foreign foundations.

    Source: §1 · p. 2, §4 · p. 6

  • Method

    RSCM assesses readiness and three sovereignty constructs, applying a gate requiring institutionally sustained indigenous post-quantum creation in design, implementation, or validation.

    Source: §4 · p. 6, §4.4 · p. 8

  • Results

    Across fifty-seven countries, post-quantum creation is concentrated among makers that are almost all wealthy or long-industrialized, while many capable countries lack post-quantum control.

    Source: §10 · p. 22

  • Takeaways & Limitations

    Separating general capacity from post-quantum control prevents classical capability or governance strength from being read as post-quantum sovereignty.

    Source: §7 · p. 18

    The maker count has a contested threshold: a second coder changed six of twenty re-coded verdicts, all at the gate boundary, and the central control construct lacks an independent external criterion.

    Source: §8.1 · p. 20

Abstract

from arXiv · show

Cryptographic dependence predates the quantum era, but the migration to post-quantum cryptography (PQC) opens a rare window to reshape it, because the algorithms, implementations, hardware, and standards adopted now can lock in dependence or sovereignty for decades. This paper introduces the Readiness-Sovereignty Capability Model (RSCM), a national measurement model that operationalizes PQC readiness together with cryptographic sovereignty, which current maturity models score only as readiness and the sovereignty literature defines without measuring. RSCM decomposes sovereignty into three distinct constructs, indigenous cryptographic capacity, indigenous post-quantum control, and external dependency, and certifies a post-quantum maker only through a gate requiring demonstrated, institutionally sustained creation in at least one core layer, whether design, implementation, or validation. Applying it to fifty-seven documented cryptographic actors coded from cited public evidence, and testing that coding with an independent second coder, a plausible-state bootstrap, and convergent-validity checks, we find that twenty countries clear the gate, fifteen as full-stack makers and five as research makers, eleven hold strong general capacity without post-quantum control, one is a ready adopter, and twenty-five are dependent. The gate cells show substantial weighted agreement, a quadratic-weighted kappa of 0.71, and the maker classification is stable in its core though uncertain at the threshold. Readiness tracks independent cyber indices at rank correlations up to 0.70, while post-quantum creation shows no significant correlation with the commitment index, a rank correlation of only 0.22 that separates control from readiness. The paper contributes the framework, the evidence-graded assessment, and policy directions for building indigenous quantum-safe capacity.

1 Introduction

PQC migration creates a long-lived opportunity to shape cryptographic dependence, but readiness measures alone do not show whether a country controls the technology it deploys. The paper introduces RSCM to measure readiness and sovereignty together, then applies it in an evidence-graded assessment and proposes capacity-building directions.

1 Introduction

  • PQC migration can lock in dependence for decades, while a readiness score can miss whether algorithms, vendors, and hardware are controlled domestically or supplied from abroad.The transition is a rare opportunity to reshape that dependence, and choices made now can become the foundation of a country's quantum-safe stack.Source: §1 · pp. 1–2
  • Existing maturity models assess product or organizational readiness, sovereignty writing lacks a reproducible national measure, and systematic assessment undercovers Africa and the Arab world.These are the three gaps the paper identifies.Source: §1 · p. 2
  • RSCM measures readiness alongside indigenous cryptographic capacity, indigenous post-quantum control, and external dependency, with a maker gate for sustained indigenous creation in design, implementation, or validation.The model uses a coded rubric tied to cited public evidence and distinguishes post-quantum control from general capacity.Source: §1 · p. 2
  • The paper applies its evidence-graded assessment to fifty-seven documented cryptographic actors, including under-studied Global South countries, and offers policy directions for building indigenous quantum-safe capacity.Its scoring methodology includes an audit trail, evidence grades, an independent second coder, robustness checks, and validation against independent indices.Source: §1 · p. 2

2 Related Work

Prior work assesses migration readiness, national sovereignty, or system risk, but does not provide a reproducible, evidence-traceable national measure of cryptographic control. RSCM addresses that opening by combining national readiness assessment with a decomposed account of sovereignty.

2.1 Migration and maturity models

  • Product- and organization-level maturity models assess readiness but not national control of cryptographic capability, so they cannot distinguish domestic authorship from adoption.Comparative migration frameworks extend assessment to institutional and sectoral readiness but still do not measure national control of the underlying capability.Source: §2.1 · pp. 2–3

2.2 National strategy and sovereignty

  • Sovereignty writing supplies the vocabulary of control and dependence, but largely does not operationalize it as a reproducible national instrument grounded in checkable cryptographic evidence.Broad indices aggregate heterogeneous factors that cannot be traced to a checkable cryptographic fact.Source: §2.2 · p. 3

2.3 Quantum-safe risk scoring

  • Quantum-safe risk frameworks score asset or organizational exposure, not national autonomy or who controls the cryptography on which systems depend.A system can be patched with standardized algorithms and score as low-risk while its operating country lacks control over those algorithms.Source: §2.3 · p. 3

2.4 Digital sovereignty and supply chains

  • Digital-sovereignty research treats cryptography as a foundational technology whose foreign dependence can propagate through the digital order; RSCM makes that concern measurable country by country.Table 1 characterizes RSCM as uniquely national, sovereignty-measuring, evidence-citing, and comparable across countries.Source: §2.4 · pp. 3–4, Table 1 · p. 4

2.5 Synthesis and positioning

  • RSCM fills the opening with a national, evidence-traceable model that separates general capacity, post-quantum control, and external dependency, and gates maker status on demonstrated capability.The comparison identifies no existing instrument jointly measuring national readiness and these decomposed sovereignty dimensions.Source: §2.5 · p. 4

3 Background

Harvest-now-and-decrypt-later risk makes migration timing relevant before a quantum computer exists, while standards, national policies, and the costs of transition shape how countries respond. The background frames migration as an ongoing capability-building effort, not simply installation of a particular algorithm.

3.1 The harvest-now quantum threat

  • Stored ciphertext can be decrypted once a capable quantum computer exists, so long-lived secrets face an effective protection deadline before that machine arrives.The paper links this urgency to binding national deadlines and notes that countries with larger archives of long-lived secrets face nearer effective deadlines.Source: §3.1 · p. 4

3.2 Standardized algorithms and hybrids

  • The standardized set combines two module-lattice algorithms with a stateless hash-based signature scheme; hybrid deployment can reduce reliance on any single new algorithm.Migration also requires inventory and coordinated updates to protocols, libraries, and hardware, while quantum key distribution is not scored as post-quantum algorithm deployment.Source: §3.2 · pp. 4–5

3.3 The national mandate landscape

  • National responses range from binding deadlines and inventory duties to general cybersecurity strategies without post-quantum content.The United States sets a migration horizon echoed elsewhere; China pursues a parallel track, and the UAE has the Arab region's only binding mandate in the regional core.Source: §3.3 · p. 5

3.4 Crypto-agility

  • Crypto-agility is the ability to replace cryptographic primitives repeatedly at low cost, relying on inventory, abstraction from primitives, and governance that can mandate changes.At the national level it also depends on the ability to detect a needed change and obtain a trusted replacement; sourcing every replacement abroad can automate dependence rather than remove it.Source: §3.4 · p. 5

3.5 Standardization and its geography

  • Algorithm authorship, standard-setting, and adoption are distinct relationships, and the model credits each where it occurs rather than equating adoption with control.The open standardization process involved submission, analysis, attack, and selection, while Korean and Chinese processes show selection authority need not be singular.Source: §3.5 · pp. 5–6

3.6 The economics of the transition

  • Buying foreign products can speed and lower the short-term cost of migration while leaving low sovereignty; building indigenous capacity is slower and costlier initially but is framed over repeated primitive replacements.Transition costs include inventory, protocol and application re-engineering, hardware changes, and staff retraining, with costs scaling with digital infrastructure size and age.Source: §3.6 · p. 6

4 The RSCM Framework

RSCM scores national migration readiness alongside separate dimensions of cryptographic sovereignty. Its maker gate distinguishes sustained post-quantum creation from general cryptographic capacity.

4 The RSCM Framework

  • RSCM scores readiness, indigenous cryptographic capacity, and post-quantum control separately, so classical or institutional strength alone does not establish post-quantum control.The model also records external dependency as a distinct construct.Source: §4 · p. 6

4.1 The readiness dimensions

  • Readiness covers five dimensions from intention to execution: strategy and mandate, inventory, standards adoption, deployment, and workforce.Deployment excludes quantum key distribution; the dimensions are scored separately to distinguish different migration profiles.Source: §4.1 · p. 6

4.2 Defining cryptographic sovereignty

  • Cryptographic sovereignty means a country’s control over the quantum-safe cryptography its digital order depends on; using a foreign standard alone does not negate control.The model treats control as layered and distinguishes it from general cryptographic capacity and autarky.Source: §4.2 · p. 6

4.3 Decomposing sovereignty

  • Sovereignty is decomposed into general capacity, post-quantum control, and external dependency; indigenous capacity includes classical-inclusive capability, while post-quantum control credits only the quantum-safe layer.Post-quantum control is coded through five objective sub-variables, including indigenous primitives, implementation, validation, national integration, and replaceability; dependency records deployed components a country does not control.Source: §4.3 · pp. 7–8

4.4 The post-quantum maker gate

  • A post-quantum maker must demonstrate institutionally sustained indigenous capability at level three or higher in design, implementation, or validation.The gate recognizes research, implementation, and validation makers as distinct types; full-stack makers meet the threshold in both design and implementation.Source: §4.4 · p. 8

4.5 Aggregation and measurement

  • Readiness and indigenous capacity are means of five ordinal levels, while Cr averages the three creation layers and does not determine the maker gate.The gate instead tests whether any one creation layer reaches level three on a sustained institutional basis; equal-interval aggregation is a modeling choice that the paper tests under alternative monotone spacings.Source: §4.5 · pp. 8–9

4.6 A capacity-by-creation typology

  • The capacity-by-creation typology distinguishes makers, capable post-quantum-dependent countries, ready adopters, and dependents using the maker gate and stated capacity and readiness thresholds.Countries with qualifying evidence at the threshold or based on a single low-confidence source are treated as boundary cases.Source: §4.6 · pp. 10–11, Table 6 · p. 11

5 Methodology

The methodology makes national scoring evidence-anchored and auditable by separating human coding from deterministic computation. It specifies the sample, evidence rules, and checks used to assess the resulting scores.

5.1 The Scoring Pipeline

  • The two-stage workflow confines human judgment to cited, rubric-based worksheet coding; deterministic computation then produces scores and classes reproducibly.A disputed classification can be traced to its coded cells and recomputed after recoding.Source: §5.1 · p. 11

5.2 Country selection

  • The sampling frame combines African Union and Arab League countries with a calibration set of documented post-quantum actors.Countries must have public evidence sufficient to score a majority of dimensions; this favors better-documented, more capable states and excludes some low-evidence countries into a no-evidence category.Source: §5.2 · pp. 11–12

5.3 Data sources and collection

  • The assessment uses a structured public-source search, preferring primary government and agency records before flagged secondary reporting.The search was principally in English, making some regional material less accessible, and the scores are a dated snapshot that can be updated and recoded.Source: §5.3 · p. 13

5.4 Evidence and decision rules

  • Evidence is tied to cited public sources, and fixed rules assign lower levels when support is absent, cap announcements and pilots below operational levels, and exclude quantum key distribution from PQC deployment.The model measures publicly evidenced capability, so classified work may be understated.Source: §5.4 · p. 13

5.5 Reliability, robustness, and validity

  • Reliability and robustness checks include independent recoding, alternative ordinal spacings, threshold shifts, and a plausible-state bootstrap; construct checks compare scores with external indices and objective markers.The marker checks are construct-alignment checks, not fully independent validation, because some markers also inform coding.Source: §5.5 · p. 14

5.6 Coding examples

  • Four worked examples show how evidence is matched to codebook levels and converted into scores.The UAE policy scores four; Saudi Arabia’s classical standard scores two; Kenya’s foreign-supplied infrastructure scores two and raises dependency; Senegal’s university scheme scores three but does not meet the sustained-institution maker gate.Source: §5.6 · p. 14

6 Results

The results separate general cryptographic capacity from post-quantum creation and dependency, showing that capability and post-quantum control do not always coincide. Twenty countries clear the maker gate, but the count is stable in its core and contested near the threshold.

6 Results

  • Several countries have high indigenous cryptographic capacity but near-zero post-quantum creation, a distinction a single sovereignty score would hide.Table 7 reports readiness, capacity, creation, dependency, and class for all fifty-seven assessed countries.Source: §6 · p. 14, Table 7 · p. 15

6.1 The post-quantum makers

  • Twenty countries clear the sustained post-quantum creation gate: fifteen are full-stack makers and five are research makers, with no pure implementation or validation makers.The full-stack label marks qualifying design and implementation, not equal breadth; four makers are boundary cases.Source: §6.1 · pp. 15–16, Table 8 · p. 16

6.2 Capacity without post-quantum control

  • Eleven countries are capable but post-quantum-dependent, including Malaysia, whose strong classical capacity coexists with adopted primitives and near-zero post-quantum creation.The group also includes Saudi Arabia, Qatar, Israel, India, Iran, Estonia, Argentina, Mexico, Pakistan, and Ethiopia.Source: §6.2 · p. 16

6.3 The dependent majority

  • Twenty-five countries are dependent, while Singapore is the sole ready adopter, advancing migration without indigenous capacity or post-quantum control.Figure 3 maps the classes across assessed countries.Source: §6.3 · p. 16, Figure 3 · p. 17

6.4 Regional distribution

  • Europe and North America lead the assessed regions, while Africa has the lowest capacity and creation, highest dependency, and seventeen dependent countries among eighteen assessed.Asia spans the widest range; the two-country South American and Oceanian means carry no interpretive weight, and the sample is purposive rather than a census.Source: §6.4 · pp. 16–17, Table 9 · p. 17, Figure 3 · p. 17

6.5 Uncertainty and robustness

  • Gate-cell agreement was κw=0.71, but coders disagreed on six of twenty maker verdicts, all at the two-to-three threshold; the core remained stable while the margin was contested.The bootstrap retained maker status in 96% of draws on average, but its within-one-level calibration understates gate uncertainty.Source: §6.5 · pp. 17–18, Table 10 · p. 18

7 Discussion

The discussion argues that separating general capacity, post-quantum control, and dependency prevents classical capability from being mistaken for post-quantum sovereignty. Cases and a hypothetical weakening of a standardized algorithm illustrate why control matters, while the model measures control rather than security.

7 Discussion

  • Separating capacity, post-quantum control, and dependency shows that the latter is narrower than strong general cryptographic capacity and that using a foreign standard alone does not determine sovereignty.Control can also rest on domestic implementation and replacement; authorship is one route among several.Source: §7 · p. 18

7.1 Case studies

  • The United States and United Arab Emirates qualify as full-stack makers, Malaysia as capable but dependent, Belgium and Austria as research-led full-stack makers, and Senegal does not qualify on an isolated result.The United States is credited for standardization authority and engineering, not authorship of the primitives; Senegal's contribution is not institutionally sustained.Source: §7.1 · pp. 18–19

7.2 Broader implications

  • Imported algorithms, hardware, and tooling can place digital infrastructure in an uncontrolled supply chain; independent design, implementation, or evaluation becomes strategic in a possible multi-standard world.The model does not assess cryptographic security or trustworthiness, and its classes compress a continuous, interacting reality.Source: §7.2 · p. 19

7.3 Scenario and historical parallel

  • In a hypothetical weakening of a standardized algorithm family, makers could assess and revise it domestically, while dependent countries would rely on makers or vendors for remediation.The scenario illustrates a contingency for which the paper describes post-quantum control as insurance.Source: §7.3 · p. 19

8 Limitations and Threats to Validity

The authors qualify the assessment as a proposed, operationalized, reliability-tested model rather than a validated instrument or definitive global ranking. Its maker threshold, public-evidence basis, purposive sample, and snapshot timing constrain interpretation.

8.1 Limitations

  • Six of twenty re-coded maker verdicts changed, all at the two-to-three threshold, so the twenty-maker count is a robust core of roughly a dozen with a contested margin.The central post-quantum-control construct also lacks an independent external criterion, and capacity is the least reliable coding component.Source: §8.1 · p. 20

8.2 Construct validity

  • The framework’s dimensions and ordinal anchors were not established through formal content validation, so it remains a proposed operationalized model rather than a validated instrument.The authors identify expert elicitation or empirical dimension analysis on a larger sample as a key next step.Source: §8.2 · p. 20

8.3 Measurement validity

  • Public-evidence gaps may make countries look more dependent than they are, especially where relevant government material is not indexed; absent evidence is not itself evidence of dependence.Classifications rely on documented foreign provenance, while per-sector production data are not publicly available for most countries.Source: §8.3 · pp. 20–21

8.4 External validity, sampling, and time

  • Readiness correlates with the National Cyber Security Index at 0.70 and the ITU Global Cybersecurity Index at 0.48, while post-quantum creation’s correlation with commitment tiers is 0.22 and not significant.No independent external criterion currently measures post-quantum control, and the sample is purposive, potentially overrepresenting better-documented countries.Source: §8.4 · p. 21

9 Recommendations

The recommendations propose domestic and international steps for countries facing readiness and sovereignty deficits, particularly in the Global South. They range from coordination and procurement to linking research with national programs and supporting indigenous capacity.

9.1 Continental coordination

  • A regional migration timeline, critical-sector inventory obligation, and register of quantum-vulnerable systems could give countries a shared starting point.The authors expect coordination to be among the lower-cost recommendations, but the model does not quantify that expectation.Source: §9.1 · pp. 21–22, §9 · p. 21

9.2 Governance sovereignty first

  • Active participation in international standards committees could give countries a voice in decisions they currently inherit, though governance participation alone does not remove algorithm or hardware dependence.The authors describe this as a step requiring expert time rather than capital.Source: §9.2 · p. 22

9.3 Sovereignty-aware procurement

  • Procurement rules should assess domestic control of algorithms, vendors, hardware, and key material rather than treating a nationally operated system as necessarily sovereign.The external-dependency construct offers an auditable criterion for evaluating bids.Source: §9.3 · p. 22

9.4 Indigenous research as a lever

  • Funded mandates, procurement preferences, and sustained university support could connect existing research efforts to national migration programs and build indigenous capacity.The paper presents partial control, rather than matching the largest makers, as a realistic ambition for the coming decade.Source: §9.4 · p. 22

9.5 Support and burden sharing

  • International support could provide risk audits, inventory assistance, open independently analyzed implementations, and training, strengthening indigenous capacity rather than supplying another foreign stack.The authors frame support as a shared risk response for countries unable to fund an industrial response.Source: §9.5 · p. 22

10 Conclusion

RSCM measures readiness alongside three distinct dimensions of cryptographic sovereignty and uses a sustained-creation gate to identify post-quantum makers. The assessment finds post-quantum control concentrated among makers, while many capable countries lack control and the authors call for broader and longitudinal assessment.

10 Conclusion

  • Across fifty-seven countries, post-quantum creation is concentrated among makers, while many capable countries lack post-quantum control.The countries of Africa and the Arab world combine low readiness with post-quantum layers resting on foreign foundations.Source: §10 · p. 22
  • RSCM measures readiness alongside indigenous cryptographic capacity, post-quantum control, and external dependency, with a maker gate for sustained creation in a core layer.The gate requires demonstrated indigenous creation on an institutionally sustained basis.Source: §10 · p. 22
  • Separating these dimensions prevents classical capability and governance authority from being mistaken for post-quantum sovereignty.The conclusion warns that measuring migration progress alone can mistake speed for autonomy and leave a country more dependent.Source: §10 · pp. 22–23
  • The authors propose expanding the sample, especially among low-capacity countries omitted for lack of public evidence, and tracking change longitudinally.A longitudinal track could show whether post-quantum control remains concentrated or begins to redistribute.Source: §10 · p. 23
Loading 2609.18477v1…