For Code Scan Outcome Analysis
Scope of Discovery
What it shows:
- Scanning covers:
- Source code repositories (Java, Python, C/C++)
- Build artifacts (JARs, DLLs, binaries)
- Embedded certificates inside applications
- Third-party crypto libraries (OpenSSL, BouncyCastle, WolfSSL, etc.)
- Custom libraries uploaded for scanning.
Why it matters:
- Ensures PQC readiness evaluation includes both application code and dependencies.
Action:
- Ensure all critical repos and binaries are included in the scan scope.
Algorithm Detection
What it shows:
Algorithms used in code are
categorized into:
- Symmetric
- Asymmetric
- Hash
- Key Derivation Functions (KDFs)
- Message Authentication Codes.
Why it matters:
- RSA/ECC/DH are quantum-vulnerable.
- MD5/SHA-1 are already insecure.
- PQC adoption requires NIST-recommended replacements.
Action:
- Replace vulnerable algorithms with PQC or hybrid alternatives.
- Ensure KDFs and symmetric algorithms meet NIST security levels.
PQC Score Calculator
Using standardized criteria based on NIST PQC guidelines and quantum threat models (such as Shor’s and Grover’s algorithms), the calculator assigns a numerical score that reflects the level of readiness for post-quantum security
| Type | Score |
|---|---|
| Quantum Resistant crypto categories identified | 1 |
| Quantum Vulnerable crypto categories identified | 0 |
PQC Score = ∑(Quantum-Resistant Crypto Categories
identified) / (Total Crypto Categories) X *10
Explanation
- ∑(Count of Quantum Resistant crypto categories identified) → The sum of all crypto assets that are identified as Quantum Resistant.
- Total Crypto categories → The total number of crypto assets identified across the configurations.
- The result is multiplied by 10 to convert it into a 1–10 scale
Eg: Assume you have 100 Crypto Category
Quantum-Vulnerable & Quantum-Resistant values derived from Quantum Readiness column value
| Tab Name | Crypto categories | Total | Total Quantum-Vulnerable | Total Quantum-Resistant |
|---|---|---|---|---|
| Direct Cryptographic Usage | Algorithm | 50 | 40 | 10 |
| Direct Cryptographic Usage | Certificates | 10 | 5 | 5 |
| Cryptographic Dependancies | Cryptographic Library | 40 | 30 | 10 |
- Total crypto categories (Algorithm +Certificates +Cryptographic library)→ 100
- Total Quantum vulnerable crypto categories identified (Algorithm +Certificates +Cryptographic library)→ 75
- Total Quantum-Resistant crypto categories identified (Algorithm +Certificates +Cryptographic library) → 25
Example calculation:
PQC Score = (25/100)*10 = 2.5
Threat Level
Interpretation
Severity Assessment (NIST-Aligned)
What it shows:
Algorithms are rated by PQC risk:
Critical 
High 
Medium
Low
Note:
- If the cryptographic algorithm is referenced from a constant, variable, configuration, or resolved at runtime and cannot be determined through static analysis, the algorithm cannot be determined and will be marked as Unknown
- If there are no key lengths mentioned in the cryptographic class ,then the severity would be marked as High.
| Algorithm | NIST Status | Severity based on Grovers/Shor Analysis | PQC Readiness |
|---|---|---|---|
| AES-128 | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-192 | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-256 | Approved (FIPS 197) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-ECB | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-192-ECB | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-256-ECB | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-128-CBC | Approved (FIPS 197 / SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CBC | Approved (FIPS 197 / SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CBC | Approved (FIPS 197 / SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CTR | Approved (FIPS 197 / SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CTR | Approved (FIPS 197 / SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CTR | Approved (FIPS 197 / SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-GCM | Approved (FIPS 197 / SP 800-38D) | High | Quantum Vulnerable |
| AES-192-GCM | Approved (FIPS 197 / SP 800-38D) | High | Quantum Vulnerable |
| AES-256-GCM | Approved (FIPS 197 / SP 800-38D) | Low (Quantum Safe) | Quantum Resistant |
| Camellia-128-CBC | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | High | Quantum Vulnerable |
| Camellia-192-GCM | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | High | Quantum Vulnerable |
| Camellia-256-GCM | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | Low (Quantum Safe) | Quantum Resistant |
| CAMELLIA-128 | Approved / Recognized (SP 800-57) | High | Quantum Vulnerable |
| CAMELLIA-192 | Approved / Recognized (SP 800-57) | High | Quantum Vulnerable |
| CAMELLIA-256 | Approved / Recognized (SP 800-57) | Low (Quantum Safe) | Quantum Resistant |
| Camellia-192-CBC | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | High | Quantum Vulnerable |
| Camellia-256-CBC | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | Low (Quantum Safe) | Quantum Resistant |
| Camellia-128-GCM | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | High | Quantum Vulnerable |
| CAMELLIA-128-CTR | Approved / Recognized (SP 800-57) | High | Quantum Vulnerable |
| CAMELLIA-192-CTR | Approved / Recognized (SP 800-57) | High | Quantum Vulnerable |
| CAMELLIA-256-CTR | Approved / Recognized (SP 800-57) | Low (Quantum Safe) | Quantum Resistant |
| CAMELLIA-128-CCM | Approved / Recognized (SP 800-38C, ISO/IEC 18033-3) | High | Quantum Vulnerable |
| CAMELLIA-192-CCM | Approved / Recognized (SP 800-38C, ISO/IEC 18033-3) | High | Quantum Vulnerable |
| CAMELLIA-256-CCM | Approved / Recognized (SP 800-38C, ISO/IEC 18033-3) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CCM | Approved (FIPS 197 / SP 800-38C) | High | Quantum Vulnerable |
| AES-192-CCM | Approved (FIPS 197 / SP 800-38C) | High | Quantum Vulnerable |
| AES-256-CCM | Approved (FIPS 197 / SP 800-38C) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-OCB | Approved (FIPS 197 / RFC 7253) | High | Quantum Vulnerable |
| AES-192-OCB | Approved (FIPS 197 / RFC 7253) | High | Quantum Vulnerable |
| AES-256-OCB | Approved (FIPS 197 / RFC 7253) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-XTS | Approved (SP 800-38E) | High | Quantum Vulnerable |
| AES-256-XTS | Approved (SP 800-38E) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CFB | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CFB | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CFB | Approved (SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CFB1 | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CFB1 | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CFB1 | Approved (SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CFB8 | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CFB8 | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CFB8 | Approved (SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-OFB | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-192-OFB | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-256-OFB | Approved (SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-SIV | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-192-SIV | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-256-SIV | Approved (SP 800-38F) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-WRAP | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-192-WRAP | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-256-WRAP | Approved (SP 800-38F) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-KW | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-192-KW | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-256-KW | Approved (SP 800-38F) | Low (Quantum Safe) | Quantum Resistant |
| 3DES-112 | Approved (FIPS 46-3 / SP 800-67) | High | Quantum Vulnerable |
| 3DES-168 | Approved (FIPS 46-3 / SP 800-67) | High | Quantum Vulnerable |
| Blowfish-128 | Not Approved / Legacy | Critical | Quantum Vulnerable |
| Blowfish-192 | Not Approved / Legacy | Critical | Quantum Vulnerable |
| Blowfish-256 | Not Approved / Legacy | Critical | Quantum Vulnerable |
| Twofish-128 | Not Approved / Legacy | High | Quantum Vulnerable |
| Twofish-192 | Not Approved / Legacy | High | Quantum Vulnerable |
| Twofish-256 | Not Approved / Legacy | High | Quantum Vulnerable |
| Threefish-256 | Not Approved / Legacy | High | Quantum Vulnerable |
| Threefish-512 | Not Approved / Legacy | Low (Quantum Safe) | Quantum Resistant |
| THREEFISH-1024 | Not Approved / Legacy | Low (Quantum Safe) | Quantum Resistant |
| Serpent -128 | Not Approved / Legacy | High | Quantum Vulnerable |
| Serpent -192 | Not Approved / Legacy | High | Quantum Vulnerable |
| Serpent -256 | Not Approved / Legacy | Low (Quantum Safe) | Quantum Resistant |
| ChaCha20 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| XChaCha20 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ChaCha20-Poly1305 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| XChaCha20-Poly1305 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| AES-128-POLY1305 | Approved / FIPS 197, SP 800-38D | High | Quantum Vulnerable |
| AES-192-POLY1305 | Approved / FIPS 197, SP 800-38D | High | Quantum Vulnerable |
| AES-256-POLY1305 | Approved / FIPS 197, SP 800-38D | Low (Quantum Safe) | Quantum Resistant |
| DES-56 | Deprecated (FIPS 46-3) | Critical | Quantum Vulnerable |
| RC2-40 | Deprecated (SP 800-38 / Legacy) | Critical | Quantum Vulnerable |
| RC2-64 | Deprecated (SP 800-38 / Legacy) | Critical | Quantum Vulnerable |
| RC2-128 | Deprecated (SP 800-38 / Legacy) | Critical | Quantum Vulnerable |
| RC4-40 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC2-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-40 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-64 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-32-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-32-192 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-32-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-64-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-64-192 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-64-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-128-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-128-192 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-128-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC6-128 | Not FIPS-approved | High | Quantum Vulnerable |
| RC6-192 | Not FIPS-approved | High | Quantum Vulnerable |
| RC6-256 | Not FIPS-approved | High | Quantum Vulnerable |
| RC6-512 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| RC6-1024 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| Rijndael-128 | Not FIPS-approved | High | Quantum Vulnerable |
| Rijndael-192 | Not FIPS-approved | High | Quantum Vulnerable |
| Rijndael-256 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| IDEA-128 | Not NIST-approved / Obsolete | Critical | Quantum Vulnerable |
| ARIA-128 | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192 | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ARIA-128-CBC | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192-CBC | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256-CBC | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ARIA-128-CTR | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192-CTR | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256-CTR | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ARIA-128-GCM | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192-GCM | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256-GCM | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ARIA-128-CCM | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192-CCM | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256-CCM | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| RC6-128 | Not FIPS-approved | Critical | Quantum Vulnerable |
| RC6-192 | Not FIPS-approved | High | Quantum Vulnerable |
| RC6-256 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| Algorithm | NIST Status | Severity based on Grovers/Shor Analysis | PQC readiness |
|---|---|---|---|
| RSA-512 | Approved (Deprecated, FIPS 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| RSA-768 | Approved (Deprecated, FIPS 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| RSA-1024 | Approved (Deprecated, FIPS 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| RSA-1536 | Approved (Deprecated, FIPS 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| RSA-2048 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-3072 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-4096 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-6144 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-7680 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-8192 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-12288 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-15360 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-2048 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-3072 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-4096 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-7680 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-15360 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| DSA-1024 | Approved (Deprecated, FIPS 186-3 / 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| DSA-2048 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| DSA-3072 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| DSA-4096 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| DSA-8192 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| DH-1024 | Approved (Deprecated, FIPS 186-4 / SP 800-56A Rev. 3) | Critical | Quantum Vulnerable |
| DH-2048 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| DH-3072 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| DHE-2048 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| DHE-3072 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| DHE-4096 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| ECDSA-P192 | Approved (Deprecated, FIPS 186-4 / SP 800-186) | Critical | Quantum Vulnerable |
| ECDSA-P224 | Approved (FIPS 186-4 / SP 800-186) | High | Quantum Vulnerable |
| ECDSA-P256 | Approved (FIPS 186-4 / SP 800-186) | High | Quantum Vulnerable |
| ECDSA-P384 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDSA-P521 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDSA-brainpoolP256r1 | Not Approved | High | Quantum Vulnerable |
| ECDSA-brainpoolP384r1 | Not Approved | High | Quantum Vulnerable |
| ECDSA-brainpoolP512r1 | Not Approved | High | Quantum Vulnerable |
| ECDSA-secp256k1 | Not Approved | High | Quantum Vulnerable |
| ECDH-P192 | Approved (Deprecated, FIPS 186-4) | Critical | Quantum Vulnerable |
| ECDH-P224 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDH-P256 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDH-P384 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDH-P521 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDH-brainpoolP256r1 | Not Approved | High | Quantum Vulnerable |
| ECDH-brainpoolP384r1 | Not Approved | High | Quantum Vulnerable |
| ECDH-brainpoolP512r1 | Not Approved | High | Quantum Vulnerable |
| ECDH-secp256k1 | Not Approved | High | Quantum Vulnerable |
| Ed25519 | Not Approved (draft RFC / NIST not yet standardized) | High | Quantum Vulnerable |
| Ed448 | Not Approved (draft RFC / NIST not yet standardized) | High | Quantum Vulnerable |
| X25519 | Not Approved (draft RFC / NIST not yet standardized) | High | Quantum Vulnerable |
| X448 | Not Approved (draft RFC / NIST not yet standardized) | High | Quantum Vulnerable |
| ML-DSA-44 | FIPS 204 | Low (Quantum Safe) | Quantum Resistant |
| ML-DSA-65 | FIPS 204 | Low (Quantum Safe) | Quantum Resistant |
| ML-DSA-87 | FIPS 204 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-128s | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-128f | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-192s | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-192f | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-256s | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-256f | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| FALCON-512 | Draft FIPS 206 | Low (Quantum Safe) | Quantum Resistant |
| FALCON-1024 | Draft FIPS 206 | Low (Quantum Safe) | Quantum Resistant |
| Algorithm | NIST/FIPS Status (FIPS/SP) | Severity based on Grovers/Shor Analysis | Quantum Readiness |
|---|---|---|---|
| MD5 | Deprecated / Legacy (FIPS 180-4) | Critical | Quantum Vulnerable |
| MD4 | Deprecated / Legacy (FIPS 180-4) | Critical | Quantum Vulnerable |
| MD2 | Deprecated / Legacy (FIPS 180-4) | Critical | Quantum Vulnerable |
| SHA-0 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| SHA-1 | Deprecated / Legacy (FIPS 180-4) | Critical | Quantum Vulnerable |
| SHA-224 | Approved (FIPS 180-4) | High | Quantum Vulnerable |
| SHA-256 | Approved (FIPS 180-4) | Low (Quantum Safe) | Quantum Resistant |
| SHA-384 | Approved (FIPS 180-4) | Low (Quantum Safe) | Quantum Resistant |
| SHA-512 | Approved (FIPS 180-4) | Low (Quantum Safe) | Quantum Resistant |
| SHA-512/224 | Approved (FIPS 180-4) | High | Quantum Vulnerable |
| SHA-512/256 | Approved (FIPS 180-4) | Low (Quantum Safe) | Quantum Resistant |
| SHA3-224 | Approved (FIPS 202 / SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| SHA3-256 | Approved (FIPS 202 / SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| SHA3-384 | Approved (FIPS 202 / SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| SHA3-512 | Approved (FIPS 202 / SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| RIPEMD-128 | Not FIPS-approved | Critical | Quantum Vulnerable |
| RIPEMD-160 | Not FIPS-approved | Critical | Quantum Vulnerable |
| RIPEMD-256 | Not FIPS-approved | High | Quantum Vulnerable |
| RIPEMD-320 | Not FIPS-approved | High | Quantum Vulnerable |
| Whirlpool | Not FIPS-approved | High | Quantum Vulnerable |
| Tiger | Not FIPS-approved | High | Quantum Vulnerable |
| BLAKE-224 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| BLAKE-256 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| BLAKE-384 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| BLAKE-512 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| BLAKE2s-128 | Standardized (RFC 7693, not NIST-approved) | Critical | Quantum Vulnerable |
| BLAKE2s-160 | Standardized (RFC 7693, not NIST-approved) | Critical | Quantum Vulnerable |
| BLAKE2s-224 | Standardized (RFC 7693, not NIST-approved) | High | Quantum Vulnerable |
| BLAKE2s-256 | Standardized (RFC 7693, not NIST-approved) | High | Quantum Vulnerable |
| BLAKE2b-224 | Standardized (RFC 7693, not NIST-approved) | High | Quantum Vulnerable |
| BLAKE2b-256 | Standardized (RFC 7693, not NIST-approved) | High | Quantum Vulnerable |
| BLAKE2b-384 | Standardized (RFC 7693, not NIST-approved) | Low (Quantum Safe) | Quantum Resistant |
| BLAKE2b-512 | Standardized (RFC 7693, not NIST-approved) | Low (Quantum Safe) | Quantum Resistant |
| BLAKE3 | Not Approved (IETF draft, not standardized by NIST) | High | Quantum Vulnerable |
| KMAC128 | Approved (SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| KMAC256 | Approved (SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| Skein-256-128 | Not Approved (SHA-3 competition finalist, not standardized) | Critical | Quantum Vulnerable |
| Skein-256-160 | Not Approved (SHA-3 competition finalist, not standardized) | Critical | Quantum Vulnerable |
| Skein-256-224 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| Skein-256-256 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| Skein-512-224 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| Skein-512-256 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| Skein-512-384 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Skein-512-512 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Skein-1024-384 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Skein-1024-512 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Skein-1024-1024 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Algorithm | NIST/FIPS Status (FIPS/SP) | Severity based on Grovers/Shor Analysis | Quantum Readiness |
|---|---|---|---|
| HMAC-SHA1 | Approved (FIPS 198-1) | Critical | Quantum Vulnerable |
| HMAC-SHA224 | Approved (FIPS 198-1) | High | Quantum Vulnerable |
| HMAC-SHA256 | Approved (FIPS 198-1) | Low (Quantum Safe) | Quantum Resistant |
| HMAC-SHA384 | Approved (FIPS 198-1) | Low (Quantum Safe) | Quantum Resistant |
| HMAC-SHA512 | Approved (FIPS 198-1) | Low (Quantum Safe) | Quantum Resistant |
| CMAC-AES-128 | Approved (FIPS 197 / SP 800-38B) | High | Quantum Vulnerable |
| CMAC-AES-192 | Approved (FIPS 197 / SP 800-38B) | High | Quantum Vulnerable |
| CMAC-AES-256 | Approved (FIPS 197 / SP 800-38B) | Low (Quantum Safe) | Quantum Resistant |
| GMAC-AES-128 | Approved (FIPS 197 / SP 800-38D) | High | Quantum Vulnerable |
| GMAC-AES-192 | Approved (FIPS 197 / SP 800-38D) | High | Quantum Vulnerable |
| GMAC-AES-256 | Approved (FIPS 197 / SP 800-38D) | Low (Quantum Safe) | Quantum Resistant |
| Poly1305-128 (ChaCha20-Poly1305) | Not explicitly FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| Poly1305-XChaCha20-128 | Not explicitly FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| KMAC128 | Approved (SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| KMAC256 | Approved (SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| DES-CBC-MAC-56 | Deprecated / Legacy (FIPS 46-3) | Critical | Quantum Vulnerable |
| 3DES-CBC-MAC-112 | Deprecated / Legacy (FIPS 46-3) | Critical | Quantum Vulnerable |
| 3DES-CBC-MAC-168 | Deprecated / Legacy (FIPS 46-3) | Critical | Quantum Vulnerable |
| HMAC-MD5 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| MD5-CBC-MAC-56 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| MD5-CBC-MAC-128 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| Algorithm | NIST Status | Severity based on Grovers/Shor Analysis | Quantum Readiness |
|---|---|---|---|
| PBKDF1-HMAC-MD5 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| PBKDF1-HMAC-SHA1 | Deprecated / Legacy (FIPS 180-1 / PKCS #5) | Critical | Quantum Vulnerable |
| PBKDF2-HMAC-MD5 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| PBKDF2-HMAC-SHA1 | Approved (PKCS #5 / SP 800-132) | Critical | Quantum Vulnerable |
| PBKDF2-HMAC-SHA224 | Approved (PKCS #5 / SP 800-132) | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| PBKDF2-HMAC-SHA256 | Approved (PKCS #5 / SP 800-132) | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| PBKDF2-HMAC-SHA384 | Approved (PKCS #5 / SP 800-132) | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| PBKDF2-HMAC-SHA512 | Approved (PKCS #5 / SP 800-132) | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| HKDF-HMAC-SHA1 | Not explicitly FIPS-approved, widely used | Critical | Quantum Vulnerable |
| HKDF-HMAC-SHA224 | Not explicitly FIPS-approved, widely used | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| HKDF-HMAC-SHA256 | Not explicitly FIPS-approved, widely used | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| HKDF-HMAC-SHA384 | Not explicitly FIPS-approved, widely used | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| HKDF-HMAC-SHA512 | Not explicitly FIPS-approved, widely used | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| Argon2d | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| Argon2i | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| Argon2id | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| bcrypt-HMAC-SHA1 | Not FIPS-approved | High | Quantum Vulnerable |
| bcrypt-HMAC-SHA224 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| bcrypt-HMAC-SHA256 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| bcrypt-HMAC-SHA384 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| bcrypt-HMAC-SHA512 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| scrypt-HMAC-SHA1 | Not FIPS-approved | High | Quantum Vulnerable |
| scrypt-HMAC-SHA224 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| scrypt-HMAC-SHA256 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| scrypt-HMAC-SHA384 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| scrypt-HMAC-SHA512 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
Why it matters:
- Provides a prioritized list of risks for remediation.
Action:
- Focus on replacing Critical and High algorithms first.
Certificates in Code
What it shows:
- Discovery of hardcoded or embedded certificates in application code, configs, or keystores.
- Classification: internal vs public-facing certificates.
- PQC readiness of certificate algorithms and signature schemes.
Why it matters:
- Hardcoded certificates are often forgotten but may secure APIs or internal services.
- These certs must follow the same PQC migration plan as server certs.
Action:
- Replace vulnerable embedded certs with PQC-ready or hybrid certs.
Crypto Libraries
What it shows:
- Detection of standard crypto libraries (e.g., OpenSSL, BouncyCastle, WolfSSL).
- Detection of custom libraries uploaded by the user for PQC evaluation.
- Library PQC readiness (support for hybrid or PQC algorithms).
Why it matters:
- Applications inherit the cryptographic strength of their libraries.
- Non-standard/custom libraries may hide risks if not reviewed.
Action:
- Upgrade libraries to PQC-ready versions.
- Submit custom/internal libraries for analysis to ensure coverage.
Quantum Readiness Classification
What it shows:
Algorithms, certificates, and
libraries are classified as:
- Classical → Quantum-vulnerable
- Hybrid → Transitional (RSA/ECC + PQC)
- PQC-only → Quantum-safe
Why it matters:
- Gives a single maturity snapshot of application crypto posture.
Action:
- Track transition progress from Classical → Hybrid → PQC only.
High-Risk Findings
What it shows:
- Algorithms or certs using deprecated schemes (MD5, SHA-1, DES, 3DES, weak RSA/ECC).
- Libraries that are outdated or lack PQC support.
Why it matters:
- High-risk findings can lead to application-level compromise or regulatory non-compliance.
Action:
- Prioritize replacing or upgrading high-risk crypto usage.
Dashboards
What it shows:
- PQC Readiness Score: % PQC-ready vs vulnerable algorithms/libraries
- Readiness by Language: Crypto usage breakdown by programming language
- Readiness by Repository: PQC maturity per repo/project
- Library Readiness: Standard and custom libraries by PQC support level
- Algorithm Summary: Symmetric, asymmetric, hash, KDF usage trends
- Certificates in Code: PQC readiness of embedded certificates
- Quantum Readiness Trend: Migration progress over time.
Why it matters:
- Provides both developer and leadership visibility into PQC migration status.
Action:
- Use dashboards to track and report migration progress across teams.
Migration Guidance
What it shows:
- Recommended steps to transition to PQC ready code:
- Replace vulnerable algorithms with NIST-approved PQC or hybrid alternatives.
- Upgrade crypto libraries to PQC-supported versions.
- Re-issue embedded certificates with PQC or hybrid certs.
- Enforce minimum key sizes and secure KDFs.
Why it matters:
- Prevents sudden breakage or compliance failures when PQC adoption becomes mandatory.
Action:
- Follow a phased approach: Classical → Hybrid → PQC-only.
