PostShor

Quantum Readiness Report

tests/fixtures/vulnerable_app
2026-10-14T21:19:31+00:00
13 files scanned

Quantum Readiness Score 0/100
QRS v1.0

15critical

18high

5medium

1low

10info

Harvest-now-decrypt-later exposure. Critical findings protect data with key exchange or encryption that a future quantum computer can break. Adversaries can record it today.

Deadlines that apply

NowHarvest-now-decrypt-later: recorded traffic is already exposed

2026EU: national PQC roadmaps due; migrations start

2030NIST: RSA/ECC deprecated · EU: high-risk systems migrated

2035NIST: RSA/ECC disallowed · EU & NSA CNSA 2.0: migration complete

Migration plan

Phase 1: Stop the harvest 16 findingsNow (0–12 months)

Key exchange and encryption recorded today can be decrypted later. This exposure is already happening.

Remove committed private keys and rotate them.
Enable hybrid X25519MLKEM768 on every TLS endpoint and mlkem768x25519-sha256 for SSH.
Replace RSA-OAEP / ECDH / DH key wrapping of long-lived data with ML-KEM (hybrid during transition).
Upgrade TLS stacks: OpenSSL 3.5+, Go 1.24+, Java 24+, .NET 10, rustls with aws-lc-rs.

Phase 2: Replace signatures and identities 16 findingsBefore 2030 (NIST deprecation)

Signatures can only be forged after Q-day, but roots, firmware keys and PKI take years to rotate.

Inventory CAs and long-lived certificates; plan ML-DSA (or composite) hierarchies.
Move firmware and code signing to ML-DSA, SLH-DSA or LMS/XMSS.
Replace RSA/ECDSA JWT and API signatures with ML-DSA once your libraries support it.
Automate certificate rotation so the switch is a configuration change.

Phase 3: Clean up and build agility 7 findingsOngoing

Algorithms that are already broken, plus everything that makes the next migration cheaper.

Remove MD5, SHA-1, DES/3DES, RC4 and legacy TLS versions.
Move to AES-256 where CNSA 2.0 applies.
Upgrade pre-standard Kyber/Dilithium to ML-KEM/ML-DSA.
Route cryptography through a central, configurable layer (crypto-agility).

Findings

Severity	Finding	Location	Rule
CRITICAL	TLS group list set without a post-quantum hybrid group TLS group list set without a post-quantum hybrid group. ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition. Prioritise this: the exposure starts the day data is recorded. OpenSSL 3.5+ supports ML-KEM, ML-DSA and SLH-DSA and offers X25519MLKEM768 in TLS by default; liboqs for other algorithms.	`c/tls.c:5` `SSL_CTX_set1_groups_list(ctx, "X25519:P-256");`	`C-TLS-GROUPS`
CRITICAL	TLS 1.3 not enabled (post-quantum key exchange requires TLS 1.3) TLS 1.3 not enabled (post-quantum key exchange requires TLS 1.3). SSL 3.0 / TLS 1.0 / TLS 1.1 is already insecure today, independent of quantum computing. How to fix Replace with TLS 1.3 (required for hybrid post-quantum key exchange).	`config/nginx.conf:3` `ssl_protocols TLSv1 TLSv1.1 TLSv1.2;`	`CFG-TLS-NO13`
CRITICAL	nginx ssl_ecdh_curve excludes post-quantum hybrid groups nginx ssl_ecdh_curve excludes post-quantum hybrid groups. ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition. Prioritise this: the exposure starts the day data is recorded.	`config/nginx.conf:4` `ssl_ecdh_curve X25519:prime256v1;`	`CFG-NGINX-CURVES`
CRITICAL	SSH KexAlgorithms set without a post-quantum hybrid SSH KexAlgorithms set without a post-quantum hybrid. ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition. Prioritise this: the exposure starts the day data is recorded.	`config/sshd_config:4` `KexAlgorithms curve25519-sha256,ecdh-sha2-nistp256`	`CFG-SSH-KEX`
CRITICAL	RSA encryption (.NET) RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Anything encrypted this way can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Prioritise this: the exposure starts the day data is recorded. .NET 10 adds MLKem, MLDsa and SlhDsa; Bouncy Castle .NET for earlier runtimes.	`cs/Keys.cs:6` `var ct = rsa.Encrypt(data, RSAEncryptionPadding.OaepSHA256);`	`CS-RSA-ENC`
CRITICAL	ECDH (.NET) ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition. Prioritise this: the exposure starts the day data is recorded. .NET 10 adds MLKem, MLDsa and SlhDsa; Bouncy Castle .NET for earlier runtimes.	`cs/Keys.cs:7` `using var ec = ECDiffieHellman.Create();`	`CS-ECDH`
CRITICAL	RSA encryption RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Anything encrypted this way can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Prioritise this: the exposure starts the day data is recorded. Go 1.24+ ships crypto/mlkem and enables X25519MLKEM768 in crypto/tls by default.	`go/server.go:13` `ct, _ := rsa.EncryptOAEP(nil, rand.Reader, &k.PublicKey, []byte("x"), nil)`	`GO-RSA-ENC`
CRITICAL	TLS CurvePreferences pins classical groups only, disabling Go's default hybrid PQ key exchange TLS CurvePreferences pins classical groups only, disabling Go's default hybrid PQ key exchange. ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition. Prioritise this: the exposure starts the day data is recorded. Go 1.24+ ships crypto/mlkem and enables X25519MLKEM768 in crypto/tls by default.	`go/server.go:15` `cfg := &tls.Config{CurvePreferences: []tls.CurveID{tls.X25519, tls.CurveP256}}`	`GO-TLS-CURVES`
CRITICAL	RSA encryption (JCA Cipher) RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Anything encrypted this way can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Prioritise this: the exposure starts the day data is recorded. Java 24+ provides ML-KEM (JEP 496) and ML-DSA (JEP 497); Bouncy Castle supports them on older JDKs.	`java/Crypto.java:7` `Cipher rsa = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");`	`JVM-RSA-CIPHER`
CRITICAL	ECDH key agreement (JCA) ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition. Prioritise this: the exposure starts the day data is recorded. Java 24+ provides ML-KEM (JEP 496) and ML-DSA (JEP 497); Bouncy Castle supports them on older JDKs.	`java/Crypto.java:9` `KeyAgreement ka = KeyAgreement.getInstance("ECDH");`	`JVM-ECDH`
CRITICAL	ECDH (node:crypto) ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition. Prioritise this: the exposure starts the day data is recorded. JS options: @noble/post-quantum, or Node.js builds linked against OpenSSL 3.5+.	`js/auth.ts:4` `const ecdh = createECDH("prime256v1");`	`JS-ECDH`
CRITICAL	RSA encryption (node:crypto) RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Anything encrypted this way can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Prioritise this: the exposure starts the day data is recorded. JS options: @noble/post-quantum, or Node.js builds linked against OpenSSL 3.5+.	`js/auth.ts:5` `const sealed = publicEncrypt(publicKey, Buffer.from("secret"));`	`JS-RSA-ENC`
CRITICAL	ECDH key agreement ECDH is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition. Prioritise this: the exposure starts the day data is recorded. Python options: liboqs-python (Open Quantum Safe, good for prototyping) or newer pyca/cryptography releases (check release notes for ML-KEM/ML-DSA).	`py/crypto_utils.py:9` `shared = ec.generate_private_key(ec.SECP256R1()).exchange(ec.ECDH(), peer_public_key)`	`PY-ECDH`
CRITICAL	RSA-OAEP encryption RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Anything encrypted this way can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Prioritise this: the exposure starts the day data is recorded. Python options: liboqs-python (Open Quantum Safe, good for prototyping) or newer pyca/cryptography releases (check release notes for ML-KEM/ML-DSA).	`py/crypto_utils.py:14` `return public_key.encrypt(data, padding.OAEP(mgf=padding.MGF1(hashes.SHA256()), algorithm=hashes.SHA256(), label=None))`	`PY-RSA-OAEP`
CRITICAL	X25519 key agreement X25519/X448 key agreement is broken by Shor's algorithm on a cryptographically relevant quantum computer. Data protected by this key exchange can be recorded now and decrypted later (harvest-now-decrypt-later). NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Migrate to Hybrid X25519MLKEM768 (keeps X25519, adds ML-KEM-768). Prioritise this: the exposure starts the day data is recorded. Rust options: RustCrypto ml-kem / ml-dsa crates; rustls with aws-lc-rs supports X25519MLKEM768.	`rust/main.rs:2` `use x25519_dalek::{EphemeralSecret, PublicKey};`	`RS-X25519`
HIGH	RSA key RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. OpenSSL 3.5+ supports ML-KEM, ML-DSA and SLH-DSA and offers X25519MLKEM768 in TLS by default; liboqs for other algorithms.	`c/tls.c:7` `RSA_generate_key_ex(r, 2048, NULL, NULL);`	`C-RSA-KEYGEN`
HIGH	EC key (OpenSSL 3 by-name API) X25519/X448 key agreement is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with Hybrid X25519MLKEM768 (keeps X25519, adds ML-KEM-768). OpenSSL 3.5+ supports ML-KEM, ML-DSA and SLH-DSA and offers X25519MLKEM768 in TLS by default; liboqs for other algorithms.	`c/tls.c:8` `EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(NULL, "X25519", NULL);`	`C-OSSL3-NAMED-EC`
HIGH	Legacy SSL/TLS protocol version enabled Legacy SSL/TLS protocol version enabled. SSL 3.0 / TLS 1.0 / TLS 1.1 is already insecure today, independent of quantum computing. How to fix Replace with TLS 1.3 (required for hybrid post-quantum key exchange).	`config/nginx.conf:3` `ssl_protocols TLSv1 TLSv1.1 TLSv1.2;`	`CFG-TLS-LEGACY`
HIGH	SSH host key uses RSA/ECDSA RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Signatures could be forged after Q-day; long-lived signing keys need to rotate well before then. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures.	`config/sshd_config:2` `HostKey /etc/ssh/ssh_host_rsa_key`	`CFG-SSH-RSA-HOSTKEY`
HIGH	RSA (.NET) RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. .NET 10 adds MLKem, MLDsa and SlhDsa; Bouncy Castle .NET for earlier runtimes.	`cs/Keys.cs:5` `using var rsa = RSA.Create(2048);`	`CS-RSA`
HIGH	RSA key generation RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Go 1.24+ ships crypto/mlkem and enables X25519MLKEM768 in crypto/tls by default.	`go/server.go:12` `k, _ := rsa.GenerateKey(rand.Reader, 2048)`	`GO-RSA-KEYGEN`
HIGH	ECDSA ECDSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Signatures could be forged after Q-day; long-lived signing keys need to rotate well before then. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys. Go 1.24+ ships crypto/mlkem and enables X25519MLKEM768 in crypto/tls by default.	`go/server.go:14` `e, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)`	`GO-ECDSA`
HIGH	Terraform tls_private_key with classical algorithm RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures.	`infra/main.tf:2` `algorithm = "RSA"`	`IAC-TLS-PRIVATE-KEY`
HIGH	Cloud KMS / ACM elliptic-curve key Elliptic-curve cryptography is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for key agreement; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures.	`infra/main.tf:7` `customer_master_key_spec = "ECC_NIST_P256"`	`IAC-KMS-ECC`
HIGH	RSA key pair generation (JCA) RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Java 24+ provides ML-KEM (JEP 496) and ML-DSA (JEP 497); Bouncy Castle supports them on older JDKs.	`java/Crypto.java:6` `KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");`	`JVM-RSA-KEYGEN`
HIGH	ECDSA signature (JCA) ECDSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Signatures could be forged after Q-day; long-lived signing keys need to rotate well before then. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys. Java 24+ provides ML-KEM (JEP 496) and ML-DSA (JEP 497); Bouncy Castle supports them on older JDKs.	`java/Crypto.java:8` `Signature sig = Signature.getInstance("SHA256withECDSA");`	`JVM-ECDSA-SIG`
HIGH	RSA key generation (node:crypto) RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. JS options: @noble/post-quantum, or Node.js builds linked against OpenSSL 3.5+.	`js/auth.ts:3` `const { publicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });`	`JS-RSA-KEYGEN`
HIGH	ECDSA (WebCrypto) ECDSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Signatures could be forged after Q-day; long-lived signing keys need to rotate well before then. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys. JS options: @noble/post-quantum, or Node.js builds linked against OpenSSL 3.5+.	`js/auth.ts:9` `const key = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign"]);`	`JS-WEBCRYPTO-ECDSA`
HIGH	RSA key generation (pyca/cryptography) RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Python options: liboqs-python (Open Quantum Safe, good for prototyping) or newer pyca/cryptography releases (check release notes for ML-KEM/ML-DSA).	`py/crypto_utils.py:8` `private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)`	`PY-RSA-KEYGEN`
HIGH	DES / 3DES cipher DES / 3DES is already insecure today, independent of quantum computing. How to fix Replace with AES-256-GCM.	`py/crypto_utils.py:19` `cipher = DES3.new(key, DES3.MODE_CBC)`	`PY-DES`
HIGH	JWT/JOSE RSA signature algorithm RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. Signatures could be forged after Q-day; long-lived signing keys need to rotate well before then. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Python options: liboqs-python (Open Quantum Safe, good for prototyping) or newer pyca/cryptography releases (check release notes for ML-KEM/ML-DSA).	`py/crypto_utils.py:25` `JWT_ALG = "RS256"`	`JOSE-RSA-SIG`
HIGH	Cryptographic dependency: pycrypto PyCrypto has been unmaintained since 2013 and has known CVEs. Replace it with pycryptodome or pyca/cryptography. How to fix PyCrypto has been unmaintained since 2013 and has known CVEs. Replace it with pycryptodome or pyca/cryptography.	`requirements.txt:1` `pycrypto`	`DEP-PYPI-PYCRYPTO`
HIGH	RSA (RustCrypto rsa) RSA is broken by Shor's algorithm on a cryptographically relevant quantum computer. NIST IR 8547 (draft) deprecates it after 2030 and disallows it after 2035. How to fix Replace with ML-KEM-768 (FIPS 203), deployed as the hybrid X25519MLKEM768 during the transition for encryption/key transport; ML-DSA-65 (FIPS 204); SLH-DSA (FIPS 205) or LMS/XMSS for long-lived firmware/root keys for signatures. Rust options: RustCrypto ml-kem / ml-dsa crates; rustls with aws-lc-rs supports X25519MLKEM768.	`rust/main.rs:6` `let key = RsaPrivateKey::new(&mut rng, 2048).unwrap();`	`RS-RSA`
MEDIUM	MD5 (.NET) MD5 is already insecure today, independent of quantum computing. How to fix Replace with SHA-256 or SHA-3 (SHA-384+ for CNSA 2.0).	`cs/Keys.cs:8` `using var md5 = MD5.Create();`	`CS-MD5`
MEDIUM	Go 1.22 predates default post-quantum TLS Go 1.24 added crypto/mlkem and turned on hybrid X25519MLKEM768 key exchange in crypto/tls by default. Builds targeting older Go versions negotiate classical key exchange only. How to fix Raise the go directive to 1.24 or later and build with a current toolchain.	`go/go.mod:3` `go 1.22`	`DEP-GO-TOOLCHAIN-PRE-PQ`
MEDIUM	MD5 hash (JCA) MD5 is already insecure today, independent of quantum computing. How to fix Replace with SHA-256 or SHA-3 (SHA-384+ for CNSA 2.0).	`java/Crypto.java:10` `MessageDigest md = MessageDigest.getInstance("MD5");`	`JVM-MD5`
MEDIUM	SHA-1 hash SHA-1 is already insecure today, independent of quantum computing. How to fix Replace with SHA-256 or SHA-3 (SHA-384+ for CNSA 2.0).	`js/auth.ts:6` `const etag = createHash("sha1").update("x").digest("hex");`	`JS-SHA1`
MEDIUM	MD5 hash MD5 is already insecure today, independent of quantum computing. How to fix Replace with SHA-256 or SHA-3 (SHA-384+ for CNSA 2.0).	`py/crypto_utils.py:20` `checksum = hashlib.md5(data).hexdigest()`	`PY-MD5`
LOW	Cryptographic dependency: node-forge Provides classical public-key crypto (RSA/ECC). Review how it is used and plan the post-quantum path. How to fix Track this library's post-quantum roadmap; the source findings show where it is called.	`package.json:1` `node-forge`	`DEP-NPM-NODE-FORGE`
INFO	Hybrid post-quantum key exchange Hybrid PQ key exchange (X25519MLKEM768 etc.) is a post-quantum-safe choice. How to fix No action needed. Keep the implementation up to date and FIPS-validated where required.	`c/tls.c:12` `SSL_CTX_set1_groups_list(ctx, "X25519MLKEM768:X25519");`	`GEN-HYBRID-KEM`
INFO	Cryptographic dependency: golang.org/x/crypto Provides classical public-key crypto (RSA/ECC). Review how it is used and plan the post-quantum path. How to fix Track this library's post-quantum roadmap; the source findings show where it is called.	`go/go.mod:6` `golang.org/x/crypto`	`DEP-GO-GOLANG-ORG-X-CRYPTO`
INFO	Cryptographic dependency: github.com/cloudflare/circl Cloudflare CIRCL: includes ML-KEM, ML-DSA and hybrids alongside classical algorithms. How to fix Track this library's post-quantum roadmap; the source findings show where it is called.	`go/go.mod:7` `github.com/cloudflare/circl`	`DEP-GO-GITHUB-COM-CLOUDFLARE-CIRCL`
INFO	ML-KEM / hybrid PQ key exchange ML-KEM (FIPS 203) is a post-quantum-safe choice. How to fix No action needed. Keep the implementation up to date and FIPS-validated where required.	`go/server.go:16` `good := &tls.Config{CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.X25519}}`	`GO-MLKEM`
INFO	Hybrid post-quantum key exchange Hybrid PQ key exchange (X25519MLKEM768 etc.) is a post-quantum-safe choice. How to fix No action needed. Keep the implementation up to date and FIPS-validated where required.	`go/server.go:16` `good := &tls.Config{CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.X25519}}`	`GEN-HYBRID-KEM`
INFO	ML-KEM reference ML-KEM (FIPS 203) is a post-quantum-safe choice. How to fix No action needed. Keep the implementation up to date and FIPS-validated where required.	`java/Crypto.java:11` `KeyPairGenerator pq = KeyPairGenerator.getInstance("ML-KEM-768");`	`GEN-ML-KEM`
INFO	Cryptographic dependency: @noble/post-quantum Provides post-quantum algorithms. How to fix Track this library's post-quantum roadmap; the source findings show where it is called.	`package.json:1` `@noble/post-quantum`	`DEP-NPM-NOBLE-POST-QUANTUM`
INFO	Cryptographic dependency: cryptography Provides classical public-key crypto (RSA/ECC). Review how it is used and plan the post-quantum path. How to fix Track this library's post-quantum roadmap; the source findings show where it is called.	`requirements.txt:2` `cryptography`	`DEP-PYPI-CRYPTOGRAPHY`
INFO	Rust post-quantum crate Post-quantum algorithm (unspecified) is a post-quantum-safe choice. How to fix No action needed. Keep the implementation up to date and FIPS-validated where required.	`rust/main.rs:3` `use ml_kem::MlKem768;`	`RS-PQC`
INFO	ML-KEM reference ML-KEM (FIPS 203) is a post-quantum-safe choice. How to fix No action needed. Keep the implementation up to date and FIPS-validated where required.	`rust/main.rs:3` `use ml_kem::MlKem768;`	`GEN-ML-KEM`

Cryptographic inventory

Algorithm	Occurrences	Files
RSA	17	11
ECDH	9	9
ECDSA	3	3
MD5	3	3
Post-quantum algorithm (unspecified)	3	3
ML-KEM (FIPS 203)	3	3
SSL 3.0 / TLS 1.0 / TLS 1.1	2	1
X25519/X448 key agreement	2	2
Elliptic-curve cryptography	2	2
Hybrid PQ key exchange (X25519MLKEM768 etc.)	2	2
DES / 3DES	1	1
PyCrypto (unmaintained library)	1	1
SHA-1	1	1