Post-quantum readiness

Post-quantum crypto compliance, built in.

Attackers are already running harvest-now, decrypt-later. They capture today's RSA- and ECC-protected traffic to crack once a quantum computer arrives. The NSA's CNSA 2.0 mandate sets hard deadlines to migrate.

foxguard audits your code and dependencies for quantum-vulnerable crypto, tags each finding with its CNSA 2.0 deadline, and emits a Cryptographic Bill of Materials. The whole audit runs locally from one free Rust binary.

terminal
# Audit the current directory for quantum-vulnerable crypto
foxguard pqc .

01 What gets flagged

foxguard detects five quantum-vulnerable primitives. Each falls to Shor's algorithm. Their security rests on integer factoring or discrete log, both of which a large-scale quantum computer solves efficiently.

Algorithm Role Why it breaks
RSA Public-key encryption & signatures Shor's algorithm factors the modulus, breaking RSA outright.
ECDSA Elliptic-curve signatures Elliptic-curve discrete log falls to Shor, so signatures can be forged.
ECDH Elliptic-curve key agreement Shared secrets are recoverable, exposing every derived session key.
DH Finite-field key agreement Relies on discrete log, which a quantum computer solves efficiently.
DSA Finite-field signatures Same discrete-log foundation as DH, so signatures can be forged.

Detection scope

  • ✓ Source code in 5 languages. Python, JavaScript, Go, Java, and Rust.
  • ✓ Web-server configuration. Flags quantum-vulnerable TLS settings.
  • ✓ 6 lockfile formats. Cargo.lock, requirements.txt, poetry.lock, Pipfile.lock, pnpm-lock.yaml, and package-lock.json, so PQ-vulnerable dependencies are caught too.

02 The CNSA 2.0 timeline

CNSA 2.0 sets exclusive-use deadlines by system class. foxguard tags each finding with the year its class must be fully migrated, sourced from the NSA CNSA 2.0 FAQ (Dec 2024, v2.1), so you know your runway.

2030
Networking & firmware

Software/firmware signing and networking gear (VPNs, routers) go CNSA 2.0 first. Hash-based and ML-DSA signatures are already fieldable.

2033
Web, cloud & operating systems

Browsers, web servers, cloud services, operating systems, and legacy/custom apps must finish migrating to quantum-resistant algorithms.

2035
National security systems

The NSM-10 outer limit: all National Security Systems fully quantum-resistant. foxguard falls back to this year when a finding has no more specific class.

Years are the exclusive-use milestones, the date by which a class must have completed migration. The 2035 limit comes from the White House National Security Memorandum 10 (NSM-10).

03 Generate a CBOM

A Cryptographic Bill of Materials inventories every crypto primitive in your codebase. It is the crypto counterpart to an SBOM. foxguard emits one in CycloneDX 1.6, the version that standardizes crypto assets.

terminal
# Write a CycloneDX 1.6 CBOM to a file
foxguard pqc . --format cbom --output cbom.json

What's inside

  • •Cryptographic-asset components grouped by algorithm, with the crypto primitive (e.g. pk-encryption, signature, key-agree) and functions.
  • •Evidence occurrences with the exact file, line, and column for every usage.
  • •Library components for flagged dependencies, with package manager and version text.
  • •Linked vulnerability entries with severity, CWE, and a remediation recommendation.
  • •A deterministic serial number, so re-running on unchanged code yields the same CBOM.

Why it matters

  • •Compliance reporting. A machine-readable artifact to demonstrate CNSA 2.0 progress.
  • •Supply-chain visibility. Surface quantum-vulnerable crypto pulled in by dependencies.
  • •Tracking migration. Diff CBOMs over time to watch quantum-vulnerable usage trend to zero.
  • •Standard format. CycloneDX 1.6 feeds existing toolchains rather than a bespoke schema.

04 Migration readiness

Every pqc scan rolls up to one readiness level, so you can gate CI or report status without reading every line. It's computed from the share of post-quantum findings with an unmet CNSA 2.0 deadline.

Level What it means
clean No CNSA-relevant findings. Either no quantum-vulnerable crypto is in use, or no PQ rules matched.
on-track A minority of post-quantum findings carry an unmet CNSA 2.0 deadline.
at-risk A majority (≥ 50%) of post-quantum findings carry an unmet CNSA 2.0 deadline. Migration has not begun.

The scan also tallies findings per deadline year (e.g. how many fall under 2030 vs. 2033), so you can plan the migration in the order the deadlines actually land.

Audit your crypto before the deadline

Run one command. It's free and needs no configuration or signup.

foxguard pqc .
Read the PQC docs → Compare with other scanners →