Post-quantum cryptography migration inventory
A defensive cryptography laboratory that finds public-key algorithm use in prepared evidence, ranks migration priorities, and compares classical and post-quantum operations.
Project definition
Problem statement
Post-quantum migration starts with knowing where vulnerable public-key algorithms are used. Real organisations may have relevant evidence in certificates, protocol settings, source code, dependency records, key stores, and configuration files.
The engineering problem is to build a reproducible defensive laboratory that discovers algorithm use in prepared evidence, classifies migration urgency, records operational constraints, and verifies selected replacements without claiming to secure a production organisation.
Project objectives
- Define a traceable cryptographic inventory model for systems, evidence sources, algorithms, purposes, key sizes, owners, and dependencies.
- Discover supported algorithm references from prepared certificates, protocol outputs, source files, and configurations.
- Classify findings against current migration categories and documented NIST post-quantum standards.
- Compare selected classical and post-quantum operations through key, signature, ciphertext, timing, and compatibility measurements.
- Produce a prioritised migration report with evidence, assumptions, exceptions, and verification results.
Project structure
Project components
Inventory model
Stores systems, evidence sources, algorithm observations, cryptographic purpose, dependency relationships, and migration state.
Evidence parsers
Extracts supported algorithm evidence from prepared certificates, command output, source code, manifests, and configuration fixtures.
Algorithm classifier
Normalises names, identifies classical public-key use, distinguishes symmetric and hashing use, and records confidence and evidence location.
Migration planner
Scores urgency using exposure, lifetime, interoperability, dependency, and replacement-readiness criteria.
Post-quantum laboratory
Runs controlled ML-KEM and ML-DSA operations and records size, timing, success, and compatibility evidence.
Report generator
Produces inventory, coverage, priority, exception, benchmark, and verification tables from stored results.
Methodology
Project workflow
- 01Load prepared evidence
The user selects a synthetic organisation fixture containing systems, certificates, configurations, source snippets, and protocol records.
- 02Build inventory
Parsers create traceable observations and link every normalised algorithm record to its source evidence.
- 03Classify migration need
Rules identify public-key dependencies and calculate documented migration priorities and exceptions.
- 04Run replacement experiments
Selected ML-KEM and ML-DSA cases are exercised under controlled parameters and measured repeatedly.
- 05Review report
The final output connects each priority and recommendation to evidence, assumptions, benchmark results, and unresolved constraints.
Demonstration scenario
A prepared organisation contains web certificates, SSH settings, application code, signing configuration, and a long-retention data service. The laboratory finds the public-key algorithms, links each observation to evidence, prioritises the long-retention dependency, runs selected ML-KEM and ML-DSA experiments, and exports a migration report with measured size and timing results.
Engineering
Tools and method
- Command-line application
- Python commands for fixture ingestion, inventory, classification, experiments, report export, and deterministic evaluation.
- Cryptographic tools
- OpenSSL 3.6.3 operations for classical and standardised post-quantum algorithms, with temporary keys removed after each run.
- Evidence storage
- SQLite records for fixtures, observations, normalised algorithms, migration scores, experiments, and generated reports.
- Safety model
- Local fixtures, bounded file types, no network scanning, no credential collection, and no claims about untested production systems.
- Reproducibility
- Pinned dependencies, deterministic fixtures, repeated benchmarks, expected findings, and machine-readable experiment manifests.
Testing
Evaluation
Evaluation measures
- Precision and recall of algorithm discovery across prepared evidence fixtures
- Traceability from every inventory record to the exact source evidence
- Consistency of migration priorities for documented test cases
- ML-KEM and ML-DSA operation success across supported parameter sets
- Key, ciphertext, signature, and timing comparisons across repeated trials
- Completeness and reproducibility of generated migration reports
Project boundaries
- The laboratory uses synthetic local fixtures and does not scan production networks or third-party systems.
- It inventories documented evidence and cannot prove the absence of undiscovered cryptography.
- Migration scores are transparent planning aids, not compliance or security certifications.
- Post-quantum experiments cover the supported standards and tool versions documented by the project.
Included
- 01Offline scanner for prepared source, configuration, certificate, protocol, and software inventory evidence
- 02Eight synthetic assets with 32 traceable findings and declared ground truth
- 03Transparent migration scoring across exposure, retention, criticality, dependencies, and readiness
- 04OpenSSL experiments for four KEM and four signature algorithms with 25 repetitions each
- 05SQLite, JSON, CSV, HTML, screenshots, and eleven engineering charts
- 06Seventeen automated tests and a clean dependency audit
- 07Complete source code in a private GitHub repository
- 0897-page project documentation in PDF and editable Word formats
- 0913-page setup and usage guide in PDF and editable Word formats
Project record
No information is collected on this page.
- Permanent project ID
- GP-CY-0DBYQOO
- Catalogued
- 23 Aug 2026
- Completed
- 24 Aug 2026
- Verified
- 24 Aug 2026
- Demonstration
- Included in repository
Handover
After purchase
- 01Payment is confirmed
The project is marked unavailable and cannot be purchased again.
- 02Repository access is granted
The buyer's submitted GitHub account receives access to the private repository.
- 03The purchase record is delivered
The certification sheet is prepared from the reviewed buyer details and sent privately by email.