发表机构
Centre for Intelligent Cloud Computing, CoE for Advanced Cloud, Faculty of Information Science and Technology, Multimedia University（多媒体大学信息科学与技术学院先进云计算卓越中心智能云计算中心）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出就绪性-主权能力模型（RSCM），用于国家层面测量后量子密码迁移中的密码学主权，并通过实证评估发现二十国具备后量子制造能力，为构建本土量子安全能力提供政策方向。
AI 中文摘要
对密码学的依赖早于量子时代，但向后量子密码学（PQC）的迁移开启了一个重塑这种依赖的罕见窗口，因为现在采用的算法、实现、硬件和标准可能会将依赖或主权锁定数十年。本文介绍了就绪性-主权能力模型（RSCM），这是一种国家层面的测量模型，将PQC就绪性与密码学主权同时操作化，而当前的成熟度模型仅将就绪性作为评分对象，主权文献则仅定义而未测量。RSCM将主权分解为三个不同的构念：本土密码能力、本土后量子控制和外部依赖，并通过一个门控来认证后量子制造者，该门控要求至少在核心层（设计、实现或验证）中展示出经机构持续维持的创造。将该模型应用于从引用的公开证据编码的五十七个有记录的密码行为者，并通过独立第二编码者、合理状态自举和收敛效度检验来测试该编码，我们发现二十个国家通过了门控，其中十五个为全栈制造者，五个为研究制造者；十一个拥有强大的通用能力但缺乏后量子控制；一个为就绪采用者；二十五个为依赖者。门控单元显示出显著的加权一致性，二次加权kappa为0.71，制造者分类在核心上稳定，但在阈值处存在不确定性。就绪性与独立网络指数的秩相关高达0.70，而后量子创造与承诺指数无显著相关，秩相关仅为0.22，这区分了控制与就绪性。本文贡献了框架、基于证据的分级评估以及构建本土量子安全能力的政策方向。
英文摘要
Cryptographic dependence predates the quantum era, but the migration to post-quantum cryptography (PQC) opens a rare window to reshape it, because the algorithms, implementations, hardware, and standards adopted now can lock in dependence or sovereignty for decades. This paper introduces the Readiness-Sovereignty Capability Model (RSCM), a national measurement model that operationalizes PQC readiness together with cryptographic sovereignty, which current maturity models score only as readiness and the sovereignty literature defines without measuring. RSCM decomposes sovereignty into three distinct constructs, indigenous cryptographic capacity, indigenous post-quantum control, and external dependency, and certifies a post-quantum maker only through a gate requiring demonstrated, institutionally sustained creation in at least one core layer, whether design, implementation, or validation. Applying it to fifty-seven documented cryptographic actors coded from cited public evidence, and testing that coding with an independent second coder, a plausible-state bootstrap, and convergent-validity checks, we find that twenty countries clear the gate, fifteen as full-stack makers and five as research makers, eleven hold strong general capacity without post-quantum control, one is a ready adopter, and twenty-five are dependent. The gate cells show substantial weighted agreement, a quadratic-weighted kappa of 0.71, and the maker classification is stable in its core though uncertain at the threshold. Readiness tracks independent cyber indices at rank correlations up to 0.70, while post-quantum creation shows no significant correlation with the commitment index, a rank correlation of only 0.22 that separates control from readiness. The paper contributes the framework, the evidence-graded assessment, and policy directions for building indigenous quantum-safe capacity.
