Post-Quantum Cryptography · Assessment
Harvest now,
decrypt later.
Adversaries are archiving your TLS sessions today. When a cryptographically relevant quantum computer (CRQC) arrives — Mosca's theorem puts the window at 2028–2035 — those ciphertexts decrypt. Q finds, scores, and migrates your cryptographic estate before that window closes.
// Mosca's inequality: if t_migrate + t_threat ≥ t_secure — migrate now.
48 / 58
Tracked algorithms are quantum-vulnerable
RSA, ECDH, ECDSA, DSA — all broken by Shor's algorithm at scale
2028–2035
CRQC arrival window
NIST IR 8547 and NSA CNSA 2.0 migration deadline guidance
≥ 2^152
Classical security of ML-KEM-768
NIST FIPS 203 Category 3 — equivalent to AES-192 classical security
Platform
Three instruments. One assessment.
QScout
Cryptographic Bill of Materials
Active TLS inspection + certificate analysis across your IP ranges and domains. Produces a full CBOM in CycloneDX 1.6 format — every algorithm, key length, curve, and protocol version.
Output: CycloneDX 1.6 CBOM · Formats: JSON, XML
QScore
HNDL Risk Quantification
Harvest Now, Decrypt Later risk scored 0–100 across seven weighted factors: algorithm weakness, key longevity, data sensitivity, adversary capability index, migration lead time, regulatory exposure, and detected HNDL campaign indicators.
Output: board-ready HNDL score + estimated financial exposure
QStrike
Quantum Exposure Modeling
A heuristic model of when a cryptographically relevant quantum computer (CRQC) could break the algorithms in your CBOM. Generates a probability-weighted Board Number — estimated dollar exposure at each CRQC milestone year.
Output: probability-weighted financial exposure matrix
NIST FIPS 203 / 204 / 205 · Algorithm Reference
Real numbers. No marketing math.
Measured on an AMD EPYC 9654 (Genoa), single core, liboqs 0.10.1. ECDH-P256 included as classical baseline.
- ML-KEM-512PQC-ready
- type
- KEM
- fips
- 203
- sec
- 1
- pk
- 800
- sk
- 1632
- ct/sig
- 768
- keygen
- 17 μs
- op
- 20 μs
- ML-KEM-768PQC-ready
- type
- KEM
- fips
- 203
- sec
- 3
- pk
- 1184
- sk
- 2400
- ct/sig
- 1088
- keygen
- 25 μs
- op
- 28 μs
- ML-KEM-1024PQC-ready
- type
- KEM
- fips
- 203
- sec
- 5
- pk
- 1568
- sk
- 3168
- ct/sig
- 1568
- keygen
- 36 μs
- op
- 40 μs
- ML-DSA-65PQC-ready
- type
- Signature
- fips
- 204
- sec
- 3
- pk
- 1952
- sk
- 4000
- ct/sig
- 3309
- keygen
- 44 μs
- op
- 183 μs
- SLH-DSA-128fPQC-ready
- type
- Signature
- fips
- 205
- sec
- 1
- pk
- 32
- sk
- 64
- ct/sig
- 17088
- keygen
- 5800 μs
- op
- 27000 μs
- ECDH P-256vulnerable
- type
- KEM
- fips
- —
- sec
- 3†
- pk
- 64
- sk
- 32
- ct/sig
- 64
- keygen
- 60 μs
- op
- 80 μs
- RSA-2048vulnerable
- type
- Signature
- fips
- —
- sec
- 2†
- pk
- 256
- sk
- 1192
- ct/sig
- 256
- keygen
- 84000 μs
- op
- 1200 μs
† Classical security level only — broken by Shor's algorithm at scale. Sec. Level: NIST categories 1–5 (AES-128 through AES-256 equivalent). Op = Encaps/Decaps for KEM, Sign for signature.
Threat Model
The HNDL attack surface, annotated.
2016–present
Collection phase
Nation-state adversaries (APT41, Cozy Bear, Unit 61398) archive encrypted TLS sessions, VPN captures, and key exchanges at petabyte scale. GCHQ / NSA intercept documentation confirms bulk capture programmes.
2024
NIST FIPS 203 / 204 / 205 published
ML-KEM, ML-DSA, SLH-DSA finalized. NSA CNSA 2.0 mandates migration timelines. OMB M-23-02 requires agencies to begin cryptographic inventory. The standard is live — the migration clock is running.
2025–2027
Migration window — critical phase
Large systems (PKI roots, HSMs, TLS termination, code-signing pipelines) require 18–36 months for safe migration. Organizations that have not begun CBOM generation by end-2025 risk missing the safe window entirely.
2028–2035
CRQC arrival (consensus range)
IBM, Google, IonQ, and PsiQuantum roadmaps converge on cryptographically relevant qubit counts in this window. At ~4,000 noisy-or-corrected logical qubits, RSA-2048 falls to Shor in hours. Mosca's theorem: if you haven't migrated, it's already too late.
Migration Roadmap
Four phases. Thirty-six months.
A phased approach to post-quantum cryptographic readiness, calibrated to OMB M-23-02 and NSA CNSA 2.0 timelines. Begin Phase 01 before end-2025 to remain inside the safe migration window.
Foundation
Months 1 — 3
Inventory and risk assessment. CBOM generation across IP ranges, domains, and code repositories. Baseline HNDL exposure scored.
Planning
Months 4 — 9
Prioritization and roadmap. ML-KEM / ML-DSA selection per system tier. PKI hierarchy mapping. Vendor-side migration timelines collected.
Implementation
Months 10 — 36
Algorithm migration and testing. Hybrid-mode rollout (X25519 + ML-KEM-768). HSM firmware upgrades. Code-signing pipeline transition.
Sustainment
Ongoing
Continuous monitoring and updates. New-algorithm watch (FIPS 206, BIKE, HQC). Crypto-agility validation against future standards.
Competitive Landscape
Purpose-built for the PQC problem.
Traditional vulnerability scanners were designed for CVE triage, not cryptographic agility assessment. The capabilities they lack are precisely the ones Mosca's theorem demands.
| Capability | Q | Tenable | Qualys |
|---|---|---|---|
| HNDL risk scoring (0–100) | |||
| CBOM generation (CycloneDX 1.6) | |||
| PQC algorithm detection | |||
| Adversarial quantum simulation | |||
| Board-ready financial exposure | |||
| Mosca timeline calculator | |||
| Crypto-agility migration roadmap | |||
| OMB M-23-02 / NSA CNSA 2.0 mapping |
Standards Alignment
Get started
Get your HNDL score
without installing an agent.
No agent installation required. Q runs an edge HTTPS reachability probe, builds a partial CBOM from the in-app algorithm database, and returns an HNDL risk score from a domain list and data-sensitivity profile. Full on-the-wire cipher enumeration (deep TLS inspection) is in beta. Q is in private beta — request early access and we'll set up your account.