AI 中文总结
本文对英国10个领域4665家组织的后量子TLS部署开展测量，发现HTTPS的后量子密钥交换支持率远高于SMTP，部署主要由基础设施提供商决定，迁移格局不平衡且碎片化。
AI 中文摘要
后量子密码学（PQC）正成为面向互联网基础设施长期信任的重要组成部分。公开可见的PQC支持提供了外部可见部署的证据，但不一定反映组织后量子迁移的整体进展；当将可见部署用作组织就绪度或迁移截止日期进展的指标时，这种区分至关重要。本文对覆盖10个领域的4665家英国组织的可见PQC部署情况开展测量研究，测量HTTPS和SMTP STARTTLS端点的后量子密钥交换支持情况，尽可能将可达端点归属到其底层基础设施提供商，并从协议、领域和提供商层面统计分析部署模式。在可达端点中，44.0%的HTTPS服务支持至少一种经评估的PQC密钥交换组，而SMTP服务的这一比例为6.4%；在同时支持两种协议的组织中，HTTPS支持的普及度显著高于SMTP，匹配比值比为16.89。尽管各领域的部署情况存在差异，但基础设施提供商身份的预测性远高于组织领域，且可见部署高度集中在少数提供商中；仅有144家组织在Web和电子邮件基础设施上均支持PQC，凸显出迁移格局的不平衡与碎片化。在所测量的端点中，未观测到任何后量子证书签名。这些研究结果表明，当前可见的PQC部署主要由基础设施提供商的部署决策决定，不应将其解读为组织迁移就绪度的完整衡量标准。
英文摘要
Post-quantum cryptography (PQC) is becoming an important component of long-term trust in Internet-facing infrastructure. Publicly observable PQC support provides evidence of externally visible deployment, but does not necessarily reflect the overall progress of an organisation's post-quantum migration. This distinction matters when observable deployment is used as an indicator of organisational readiness or progress towards migration deadlines. We present a measurement study of observable PQC deployment across 4,665 UK organisations spanning ten sectors. We measure post-quantum key-exchange support across HTTPS and SMTP STARTTLS endpoints, attribute reachable endpoints to their underlying infrastructure providers where possible, and statistically examine protocol-, sector-, and provider-level deployment patterns. Among reachable endpoints, 44.0\% of HTTPS services supported at least one evaluated PQC key-exchange group, compared with 6.4\% of SMTP services. Among organisations reachable over both protocols, HTTPS support was significantly more common than SMTP support (matched odds ratio 16.89). Although deployment varied across sectors, infrastructure provider identity was substantially more predictive than organisational sector, and observable deployment was highly concentrated among a small number of providers. Only 144 organisations supported PQC across both web and email infrastructure, highlighting an uneven and fragmented migration landscape. No post-quantum certificate signatures were observed across the measured endpoints. These findings show that observable PQC deployment is currently shaped predominantly by infrastructure-provider deployment decisions and should not be interpreted as a complete measure of organisational migration readiness.
