⚛ Quantum Security
Cryptographic Inventory Builder
Document and risk-rate every cryptographic asset in your organisation. The essential first step before any PQC migration programme.
Why start here: You cannot migrate to post-quantum cryptography without knowing what classical cryptography you are currently running. A cryptographic inventory maps every RSA key, ECC certificate, Diffie-Hellman parameter, and symmetric key — giving you a risk-prioritised migration backlog. NIST's PQC migration guidance explicitly identifies cryptographic discovery as step one.
➕ Add Cryptographic Asset
📋 Cryptographic Asset Inventory
0Total Assets
0Quantum Vulnerable
0Quantum Safe
0Unknown
0Critical Priority
⚛ No assets added yet. Add your first cryptographic asset above to start building your inventory.
📖 Algorithm Risk Reference
| Algorithm / Protocol | Quantum Risk | Migration Target | Urgency |
|---|---|---|---|
| RSA (any key size) | Broken by Shor's | ML-KEM (key exchange) / ML-DSA (signatures) | High — start now |
| ECDH / ECDHE (all curves) | Broken by Shor's | ML-KEM-768 in hybrid mode | Critical — HNDL risk |
| ECDSA (P-256, P-384, P-521) | Broken by Shor's | ML-DSA-65 | High |
| Ed25519 / EdDSA | Broken by Shor's | ML-DSA-65 | High |
| Diffie-Hellman (classic) | Broken by Shor's | ML-KEM-768 | Critical — HNDL risk |
| AES-256 | Safe | No migration needed | Low |
| AES-128 | Weakened (Grover) | Upgrade to AES-256 | Medium |
| SHA-256 / SHA-384 / SHA-512 | Safe | No migration needed | None |
| SHA-1 / MD5 | Already broken (classical) | SHA-256+ immediately | Critical — classical |
| ML-KEM (FIPS 203) | Quantum safe | No migration needed | None |
| ML-DSA (FIPS 204) | Quantum safe | No migration needed | None |
| SLH-DSA (FIPS 205) | Quantum safe | No migration needed | None |
| Hybrid PQC (classical + ML-KEM) | Quantum safe | Target state during transition | None |
🔍 Discovery Commands — Finding Crypto in Your Environment
# Scan for TLS certificates and algorithms in use
# Install testssl.sh (transfer offline if needed):
# https://testssl.sh/
# Scan a specific host
./testssl.sh --quiet --csvfile results.csv api.yourserver.internal
# Scan multiple hosts from a list
./testssl.sh --file hostlist.txt --csvfile full_results.csv
# Quick check — what key exchange is in use?
openssl s_client -connect yourserver:443 -tls1_3 2>&1 | \
grep -E "Server Temp Key|Cipher is|TLS session ticket"
# Certificate details
openssl x509 -in /etc/ssl/certs/your-cert.pem -noout -text | \
grep -E "Public Key Algorithm|RSA Public-Key|Signature Algorithm|Not After"
# Find all SSH private keys on a server
find / -name "id_rsa" -o -name "id_ecdsa" -o -name "id_ed25519" 2>/dev/null
find /etc/ssh/ -name "ssh_host_*_key" | while read f; do
echo "=== $f ==="
ssh-keygen -l -f "$f"
done
# Check OpenSSH server key exchange algorithms
ssh -Q kex
# Check what KEX your server offers (from client perspective)
ssh -vvv -o BatchMode=yes yourserver 2>&1 | grep "kex algorithms"
# Find application-level crypto in Java apps
# Search for crypto provider instantiation
grep -r "RSAKey\|ECKey\|KeyPairGenerator\|KeyAgreement" /opt/apps/ \
--include="*.java" --include="*.class" -l
# Certificate Transparency log search — find all your certs
# Uses crt.sh public API (run on internet-connected system)
curl -s "https://crt.sh/?q=%.yourorg.in&output=json" | \
python3 -c "
import json,sys
data=json.load(sys.stdin)
seen=set()
for cert in data:
name=cert.get('name_value','').split('\n')[0]
notafter=cert.get('not_after','')
if name not in seen:
seen.add(name)
print(f'{name}\t{notafter}')
" | sort | uniq
# Network-wide TLS scan with nmap (internal network)
nmap --script ssl-cert,ssl-enum-ciphers -p 443,8443,8080 \
10.0.0.0/24 -oN tls_scan_results.txt