Proposal of Post-Quantum Cryptography for Application Developers Cheat sheet

Dear Maintainers,

I would like to propose new cheat sheet for Post- Quantum Cryptography for Application Developers.

OWASP already covers aspects of PQC across various projects and in specific cheat sheets:

1.Transport Layer Security cheat sheet discusses explicitly about X25519MLKEM768 and configuration examples for OpenSSL, Apache and NGINX. 2. JSON Wen Token Cheat Sheet covers ML-DSA and hybrid ML-DSA signatures, including their large signature-size implications. 3. SAML Security Cheat Sheet discusses the need to support additional signing algorithms as post-quantum algorithms become prevalent. 4. OWASP Top 10: Cryptographic Failures tells organisations already need to need to prepare for PQC and references NIST/ENISA guidance. 5. Web Security Testing Guide has PQC testing guidance explicitly, including ML-DSA, ML-KEM and hybrid X25519+ML-KEM. 6. OWASP MAS / MASTG has a separate Post-Quantum section mentioning ML-KEM, ML-DSA and SLH-DSA. 7. OWASP IoT Security Verification Standard has PQC requirements for devices expected to operate beyond 2030.

In addition, OWASP has already started considering PQC within its application-security standards. ASVS issues #3140 and #3361 demonstrate that post-quantum cryptography, including topics such as Harvest Now, Decrypt Later, long-term confidentiality, long-term signatures, hybrid cryptography, and PQC primitives, is already being discussed within the project.

Therefore, this proposal is not intended to repeat, replace, or consolidate all existing PQC technical guidance.

I also had a look at already existing issues and PRs in Cheat Sheets Project to check for overlapping/duplication, but I could not find anything related to PQC.

So there appears an opportunity for a centralized, application developer-focused Cheat Sheet that answers a practical question:

" What should application developers do today to prepare their applications for the transition to post-quantum cryptography?" " Given my application's existing cryptographic architecture, how should I reason about post‑quantum migration?"

The proposed Cheat Sheet would complement existing OWASP guidance rather than replace or duplicate it.

So the scope could be:

1. Understand application exposure — What cryptographic mechanisms and protocols does the application actually depend on?
2. Classify the cryptographic use case — encryption/key establishment vs signatures vs transport vs stored data.
3. Reason about migration impact — What changes when the underlying algorithm or protocol needs to change?
4. Hybrid approaches — How should developers think about classical + PQC mechanisms where supported?
5. Crypto-agility — How can applications avoid hard-coding cryptographic assumptions?
6. Dependencies and protocols — What happens when a framework, library, protocol, or external service doesn't yet support the required PQC mechanisms?
7. Readiness checklist — What can developers do now, even when immediate migration isn't possible?
8. Pointers to existing OWASP guidance — TLS, JWT, WSTG, MASTG, ASVS, etc.

I would like to get feedback on:

1. Whether this developer-focused PQC decision/readiness layer would be useful as a standalone Cheat Sheet.
2. Whether the proposed scope overlaps too much with existing OWASP guidance.
3. Whether some of the proposed content would be better incorporated into an existing Cheat Sheet instead.
4. Whether the incremental PR approach would be suitable for developing and reviewing the content.

The goal is not to create another general PQC reference, but to provide a concise bridge between the existing PQC standards/guidance and the practical decisions application developers need to make.