Quantum computing simulators form the classical software foundation on which virtually all quantum algorithm research depends. We present Broken Quantum, the first comprehensive formal security audit of the open-source quantum computing simulator ecosystem. Applying COBALT QAI -- a four-module static analysis engine backed by the Z3 SMT solver -- we analyze 45 open-source quantum simulation frameworks from 22 organizations spanning 12 countries. We identify 547 security findings (40 CRITICAL, 492 HIGH, 15 MEDIUM) across four vulnerability classes: CWE-125/190 (C++ memory corruption), CWE-400 (Python resource exhaustion), CWE-502/94 (unsafe deserialization and code injection), and CWE-77/22 (QASM injection -- a novel, quantum-specific attack vector with no classical analog). All 13 vulnerability patterns are formally verified via Z3 satisfiability proofs (13/13 SAT). The 32-qubit boundary emerges as a consistent formal threshold in both C++ and Python vulnerability chains. Supply chain analysis identifies the first documented case of vulnerability transfer from a commercial quantum framework into US national laboratory infrastructure (IBM Qiskit Aer to XACC/Oak Ridge National Laboratory). Nine frameworks score 100/100 under all four scanners; Qiskit Aer,Cirq, tequila, PennyLane, and 5 others score 0/100.
Comments
29 pages, 9 tables. COBALT QAI scanner available upon request
Quantum computing simulators form the classical software foundation on which virtually all quantum algorithm research depends. We present Broken Quantum, the first comprehensive formal security audit of the open-source quantum computing simulator ecosystem. Applying COBALT QAI -- a four-module static analysis engine backed by the Z3 SMT solver -- we analyze 45 open-source quantum simulation frameworks from 22 organizations spanning 12 countries. We identify 547 security findings (40 CRITICAL, 492 HIGH, 15 MEDIUM) across four vulnerability classes: CWE-125/190 (C++ memory corruption), CWE-400 (Python resource exhaustion), CWE-502/94 (unsafe deserialization and code injection), and CWE-77/22 (QASM injection -- a novel, quantum-specific attack vector with no classical analog). All 13 vulnerability patterns are formally verified via Z3 satisfiability proofs (13/13 SAT). The 32-qubit boundary emerges as a consistent formal threshold in both C++ and Python vulnerability chains. Supply chain analysis identifies the first documented case of vulnerability transfer from a commercial quantum framework into US national laboratory infrastructure (IBM Qiskit Aer to XACC/Oak Ridge National Laboratory). Nine frameworks score 100/100 under all four scanners; Qiskit Aer,Cirq, tequila, PennyLane, and 5 others score 0/100.
Abstract Quantum computing promises unprecedented computational power, posing fundamental threats and offering novel solutions to modern cryptography and cybersecurity. This survey paper reviews the rapidly evolving landscape of quantum-resistant and quantum-native security protocols. By analyzing foundational computational security models and the unique vulnerabilities introduced by quantum algorithms, this work proposes a structured evaluation framework for assessing the robustness of cryptographic systems. Ultimately, this survey highlights the critical transition from classical cryptographic infrastructures to quantum-secure paradigms, ensuring data confidentiality and integrity in the post-quantum era. Keywords: Quantum Computing, Security Protocol, Vulnerabilities 1.Introduction The emergence of quantum computing represents a paradigm shift in both computational physics and information technology. Quantum algorithms, particularly Shor's and Grover's algorithms, inherently challenge the mathematical foundations of classical public-key cryptography. As a result, securing communication channels against quantum-empowered adversaries has become an urgent priority for global infrastructure and national security. The motivation for this survey stems from the immediate need to bridge the gap between theoretical quantum mechanics and applied cybersecurity, ensuring that secure communications can withstand the computational leaps expected in the next decade. The core problem addressed in this paper is the comprehensive evaluation of security protocols under the threat model of a fully scalable quantum computer. The scope encompasses both post-quantum cryptographic (PQC) protocols and inherently quantum protocols, such as those relying on physical quantum states for key distribution. Existing classical approaches are insufficient for two main reasons. First, classical computational security models often rely on mathematical hardness assumptions (like integer factorization) that are rapidly undermined by theoretical quantum algorithms. Second, current software tools for designing secure classical protocols fail to account for quantum state phenomena, such as superposition and entanglement, rendering classical verification methods inadequate for quantum threat models. To address these structural challenges, this paper presents the following contributions: We provide a comprehensive taxonomy of vulnerabilities in both classical and quantum security protocols, mapping specific algorithmic advantages to protocol failure points. We propose a structured, multi-module framework for simulating, attacking, and verifying the security of hybrid quantum-classical cryptographic architectures. 2.Foundations of Classical Protocol Analysis The rigorous analysis of security protocols has traditionally relied on well-defined computational and symbolic models (Toorani, 2016). Researchers have extensively mapped out the taxonomy of attacks on authenticated key exchange (AKE) protocols and password-authenticated key exchange (PAKE) systems, establishing the mathematical groundwork for secure communication. The core idea of these foundational works is to establish provable security bounds that distinguish between information-theoretic and computational security. While this traditional paradigm offers strong mathematical guarantees against classical adversaries, its primary weakness is the failure to incorporate quantum attack vectors into the adversary's capability profile. Our work builds upon these classical models by explicitly injecting quantum algorithmic capabilities into standard protocol verification routines. 2.1.Quantum Algorithm Development and Simulation A significant body of literature focuses on the theoretical development and computational simulation of quantum algorithms capable of compromising or enhancing network security. Academic overviews have formalized algorithms like Grover's and Shor's, demonstrating their theoretical efficiency over classical counterparts in breaking cryptographic primitives. Furthermore, researchers have developed advanced design automation tools, such as decision diagrams, to simulate and verify complex quantum circuits. The strength of these simulation tools lies in their ability to model complex quantum states without requiring expensive physical hardware. However, a notable weakness is that they often abstract away the physical noise and hardware constraints that exist in real-world cryptographic deployments. This survey contextualizes these simulation techniques specifically within the framework of adversarial security testing, bridging theoretical algorithms with practical protocol defense. 3.Physical Implementations and Hardware Considerations Beyond algorithmic theory, the physical realization of quantum states directly impacts the practical security of any quantum protocol. Research into cavity quantum electrodynamics (QED) has demonstrated the complete mathematical construction of fundamental quantum gates, such as the controlled-controlled NOT gate, operating in the weak coupling regime (Fujii et al., 2005). Additionally, methods like Quantum Computed Moments (QCM) address the hardware constraints and noise typical of Near-Term Intermediate Scale Quantum (NISQ) devices, estimating ground state properties even with suboptimal trial states. The strength of this hardware-focused research is its realism regarding current technological limits; however, it often lacks a direct bridge to high-level network protocol verification. Compared to these purely physical studies, our survey integrates physical noise models into a generalized, software-driven protocol verification framework. 4.Approach To systematically evaluate quantum computing security protocols, we propose a structured Quantum Protocol Verification Framework (QPVF). The first module is the "Threat Modeling Engine," which defines the adversary's capabilities, ranging from classical data interception to full quantum memory manipulation. The second module is the "Quantum Circuit Synthesizer," which leverages decision diagram-based tools to translate high-level cryptographic operations into verifiable quantum circuits. The final module is the "Vulnerability Analyzer," which subjects the synthesized circuits to simulated quantum attacks, effectively distinguishing between idealized computational security and realistic hardware-constrained security. This modular pipeline allows security engineers to isolate specific vulnerabilities at both the abstract algorithmic layer and the simulated physical implementation layer. A key design choice in the QPVF is the utilization of decision diagrams for circuit simulation. This choice is predicated on the fact that decision diagrams efficiently handle the exponential state space of quantum systems during complex verification tasks (Wille et al., 2021). Furthermore, our framework explicitly incorporates noise models derived from current NISQ hardware limitations, ensuring that the security evaluation reflects realistic physical constraints rather than purely idealized environments (Vallury & Hollenberg, 2023). To evaluate this framework, we propose a hypothetical benchmarking plan using an artificially generated dataset of 10,000 hybrid quantum-classical cryptographic key exchanges. We will measure the success rate of simulated Grover-based brute-force attacks against varying key sizes and simulated environmental noise levels. This evaluation will compare the theoretical vulnerability threshold of a protocol against the practical threshold observed when quantum noise severely degrades the adversary's computational capabilities. The operational flow of the QPVF is designed to provide end-to-end security verification for next-generation networks. It bridges the critical gap between abstract protocol design and simulated hardware execution. The methodology can be summarized by the following numbered pipeline: Protocol Ingestion: The classical or quantum protocol is parsed into a standardized symbolic representation. Adversary Assignment: The user assigns a precise computational profile, selecting between traditional classical algorithms or advanced quantum capabilities. Circuit Generation: Protocol steps are mapped to equivalent quantum decision diagrams for scalable software simulation. Execution & Attack: Simulated quantum algorithms are executed against the mapped circuits to test for cryptographic resilience. Output Generation: The system outputs a vulnerability score and highlights specific failure points caused by either algorithmic weaknesses or simulated hardware noise. 5.Discussion The transition to quantum-secure protocols carries profound practical implications for global information infrastructure and enterprise deployment. Deploying these advanced protocols requires immense updates to existing software toolkits, as current digital systems are not fundamentally designed to handle the complexity of quantum states. Furthermore, organizations must consider the massive educational and workforce development efforts needed to train software engineers in quantum cryptography, a requirement already highlighted by international hackathons and educational initiatives. Integrating quantum-resistant protocols into complex domains like high-energy physics networks or global banking systems will require bridging the gap between theoretical quantum mechanics and applied computer engineering. Consequently, practical deployment must occur in hybrid phases, maintaining classical cryptographic wrappers while dedicated quantum infrastructure matures. Despite the robust theoretical design of proposed quantum security frameworks, several limitations and failure modes persist in practical applications. First, physical implementation attacks, such as side-channel attacks on the lasers and cavities used in physical quantum gates can bypass theoretical software security guarant
Quantum Software Engineering (QSE) is essential for ensuring the reliability and maintainability of hybrid quantum-classical systems, yet empirical evidence on how bugs emerge and affect quality in real-world quantum projects remains limited. This study presents the first ecosystem-scale longitudinal analysis of software bugs across 123 open source quantum repositories from 2012 to 2024, spanning eight functional categories, including full-stack libraries, simulators, annealing, algorithms, compilers, assembly, cryptography, and experimental computing. Using a mixed method approach combining repository mining, static code analysis, issue metadata extraction, and a validated rule-based classification framework, we analyze 32,296 verified bug reports. Results show that full-stack libraries and compilers are the most bug-prone categories due to circuit, gate, and transpilation-related issues, while simulators are mainly affected by measurement and noise modeling errors. Classical bugs primarily impact usability and interoperability, whereas quantum-specific bugs disproportionately degrade performance, maintainability, and reliability. Longitudinal analysis indicates ecosystem maturation, with bug densities peaking between 2017 and 2021 and declining thereafter. High-severity bugs cluster in cryptography, experimental computing, and compiler toolchains. Repositories employing automated testing detect more bugs and resolve issues faster. A negative binomial regression further shows that automated testing is associated with an approximate 60 percent reduction in expected bug incidence. Overall, this work provides the first large-scale data-driven characterization of quantum software bugs and offers empirical guidance for improving testing, documentation, and maintainability practices in QSE.
The impending arrival of cryptographically relevant quantum computers (CRQCs) threatens the security foundations of modern software: Shor's algorithm breaks RSA, ECDSA, ECDH, and Diffie-Hellman, while Grover's algorithm reduces the effective security of symmetric and hash-based schemes. Despite NIST standardising post-quantum cryptography (PQC) in 2024 (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA), most codebases lack automated tooling to inventory classical cryptographic usage and prioritise migration based on quantum risk. We present Quantum-Safe Code Auditor, a quantum-aware static analysis framework that combines (i) regex-based detection of 15 classes of quantum-vulnerable primitives, (ii) LLM-assisted contextual enrichment to classify usage and severity, and (iii) risk scoring via a Variational Quantum Eigensolver (VQE) model implemented in Qiskit 2.x, incorporating qubit-cost estimates to prioritise findings. We evaluate the system across five open-source libraries -- python-rsa, python-ecdsa, python-jose, node-jsonwebtoken, and Bouncy Castle Java -- covering 5,775 findings. On a stratified sample of 602 labelled instances, we achieve 71.98% precision, 100% recall, and an F1 score of 83.71%. All code, data, and reproduction scripts are released as open-source.
The emergence of quantum computing represents one of the most significant paradigm shifts in the history of computation, with profound implications for offensive security and cyber warfare. This comprehensive research paper presents a systematic analysis of quantum-enabled offensive capabilities, novel attack vectors targeting quantum systems themselves, and the evolving threat landscape at the intersection of quantum computing and artificial intelligence. We introduce the Q-THREAT Framework, a novel temporal risk assessment model that quantifies the "Harvest Now, Decrypt Later" threat across different data confidentiality lifetimes and sectoral exposures. This research synthesizes and categorizes recently documented attack vectors including quantum Rowhammer exploits, timing-based side-channel vulnerabilities in cloud quantum services, and multi-tenant quantum system intrusions. Recent research demonstrates that current quantum cloud platforms from major providers including IBM, Rigetti, and others exhibit significant security vulnerabilities that could be exploited by adversaries to compromise computational integrity, extract sensitive circuit information, and disrupt quantum computations. Furthermore, we analyze the convergence of quantum computing and artificial intelligence as a force multiplier for offensive cyber operations. We present evidence that quantum machine learning algorithms can demonstrate competitive or superior performance in certain cybersecurity applications compared to classical approaches in controlled experimental settings, with recent studies reporting high accuracies in tasks such as malware detection and intrusion detection on benchmark datasets. Our analysis of nation-state quantum programs reveals an accelerating global quantum arms race with significant implications for national security. Based on our findings, we propose a comprehensive defensive framework incorporating post-quantum cryptographic standards, crypto-agility principles, and quantum-safe architectural patterns. This research contributes to the nascent field of quantum cybersecurity by establishing foundational threat models, identifying critical research gaps, and providing actionable recommendations for organizations preparing for the quantum era.
We introduce OpenQARP, the Open Quantum Application Research Package: an open-source Python framework for quantum application research, built on a compiled C++ core. In OpenQARP, an application is assembled from an algorithm library that orchestrates three interchangeable layers: blocks describe circuits, primitives describe what to extract from them, and engines describe how they run. The release spans near-term through fault-tolerant methods, targeting problems from electronic structure to combinatorial optimization, with device-aware compilation, circuit cutting, and resource estimation over a single set of numerical conventions that the code must follow. Every numerical feature is checked against an independent oracle, and every published timing carries a correctness check. Against OpenFermion, Qiskit/Aer, PennyLane/Lightning, Qulacs, qsim, and pytket, OpenQARP is one to two orders of magnitude faster on operator algebra and among the fastest on simulation. It matches mature compilers on two-qubit gate count, and expresses a complete algorithm in the lines a framework needs rather than the plumbing a primitive stack demands.
Quantum computing brings opportunities in the field of cybersecurity, yet ensuring that quantum security software is actually functional is a task of great proportions. This paper provides QuSecVerify, a verification model tailored to quantum cybersecurity applications (such as quantum key distribution, quantum-based intrusion detection, and quantum blockchain applications). We have used three methods that include formal verification over SMT solvers over a Quantum RAM model, mutation testing over security-oriented fault operators, and statistical testing as defined by repeated quantum measurements. We benchmarked the framework on key distribution on a quantum machine learning intrusion detector, BB84, and quantum consensus protocol. Our findings indicate that using our approach identifies 95.7 percent of injected faults, which is 40 percent less verification than in manual verifiability, and 23 bugs were still detected in tested implementations. The work is a bridge in the field of quantum software engineering, as it offers a practical and general tool to verify quantum code that is security-critical. [Here is the QuSecVerify Public Repository that consists of the full Implementation https://github.com/ssadik11/QuSecVerify]