{"id":"arxiv:2610.36145","kind":"preprint","title":"They Will See Johnny's Message: A Measurement Study of Post-Quantum Cryptography Across Email Delivery Paths","authors":["Jaehwan Park","Sunghyun Park","Kevin Nam","Doowon Kim"],"author_count":4,"year":2026,"published":"2026-10-26","venue":null,"cited_by":0,"doi":null,"arxiv_id":"2610.36145","nct_id":null,"source_url":"https://arxiv.org/abs/2610.36145","archive_url":"https://space-kitty.com/papers/arxiv:2610.36145","updated":"2026-10-26","pmid":null,"pmcid":null,"openalex_id":"W7224120617","pdf_url":"https://arxiv.org/pdf/2610.36145","abstract":"Harvest-now, decrypt-later (HNDL) attacks make the transition to post-quantum cryptography (PQC) urgent for email. This paper presents a systematic measurement that jointly examines PQC deployment across email service stages, negotiation by communicating peers, and usable message encryption. Endpoint-level support alone does not establish PQC readiness across email workflows because submission, relay, and access use independently negotiated Transport Layer Security (TLS) connections. We therefore combine three snapshots of relay, submission, access, and webmail services associated with the Tranco Top~1M domains with controlled tests of mail clients, sending servers, and OpenPGP and S/MIME implementations. Our measurements reveal a transition concentrated among a few providers, with available capability not consistently translating into actual use. Fewer than half of the domains in each service panel support PQC, and Google alone accounts for approximately 87\\% of hybrid-capable relay domains. Only two of eight tested sending providers negotiate PQC with our receiver, although five accept it inbound. When TLS groups are restricted to PQC, four of the six incompatible senders fall back to plaintext where unencrypted SMTP remains permitted. At the message layer, limited native key generation, key-format incompatibilities, and backend integration failures further constrain usable PQC encryption.","abstract_license":"CC0-1.0 (arXiv descriptive metadata)","license":null,"is_open_access":false,"retracted":false,"peer_reviewed":false,"categories":["cs.CR"],"details":null,"provenance":"arxiv","attribution":"Abstract: arXiv descriptive metadata (CC0). Thank you to arXiv for use of its open access interoperability. This service was not reviewed or approved by, nor does it necessarily express or reflect the policies or opinions of, arXiv.","topics":[{"slug":"quantum-communication-crypto","name":"Quantum Networks & Post-Quantum Cryptography","domain_slug":"quantum-computing"}],"cited_in_dossiers":[]}