For Code Scan Outcome Analysis
Scope of Discovery
What it shows:
- Scanning covers:
- Source code repositories (Java, Python, C/C++)
- Build artifacts (JARs, DLLs, binaries)
- Embedded certificates inside applications
- Third-party crypto libraries (OpenSSL, BouncyCastle, WolfSSL, etc.)
- Custom libraries uploaded for scanning.
Why it matters:
- Ensures PQC readiness evaluation includes both application code and dependencies.
Action:
- Ensure all critical repos and binaries are included in the scan scope.
Algorithm Detection
What it shows:
Algorithms used in code are
categorized into:
- Symmetric
- Asymmetric
- Hash
- Key Derivation Functions (KDFs)
- Message Authentication Codes.
Why it matters:
- RSA/ECC/DH are quantum-vulnerable.
- MD5/SHA-1 are already insecure.
- PQC adoption requires NIST-recommended replacements.
Action:
- Replace vulnerable algorithms with PQC or hybrid alternatives.
- Ensure KDFs and symmetric algorithms meet NIST security levels.
Quantum Readiness Overview
Quantum vulnerable: Code that is embedded with classical public-key algorithms that are at risk in a post-quantum environment
Quantum resistant: Code that is embedded with post-quantum or hybrid implementations designed to withstand classical as well as quantum computational attacks
Additionally, a code scan may return unknown findings for crypto assets that can be scanned only in runtime.
The Quantum Readiness Overview donut chart represents
this classification, with distinct views for the following usage patterns:
direct cryptographic usage and library-based cryptographic usage.
- Direct cryptographic usage: Cryptographic algorithms and operations that are implemented or invoked directly in the application code
- Library-based cryptographic usage: Cryptographic functionality provided indirectly through third-party libraries, SDKs, or frameworks that internally use cryptographic algorithms
As seen in the image, the chart is rendered using three segments, Quantum Resistant, Quantum Vulnerable, and Unknown (Runtime-Resolved) each representing the percentage distribution of the quantum exposure findings.
The chart is rendered with the following
interactivities:
- Use the filter in the top-right corner of the chart to view the quantum readiness according to the following usage patterns: direct cryptographic usage (Algorithm) and library-based cryptographic usage (Library)
- Hover over each segment to see the percentage distribution (also displayed in the chart legend).
- Click a legend to show/hide the corresponding category on the chart.
- Click Know More for a detailed reading and the recommended next steps.
Severity Assessment (NIST-Aligned)
What it shows:
Algorithms are rated by PQC risk:
Critical 
High 
Medium
Low
Note:
- If the cryptographic algorithm is referenced from a constant, variable, configuration, or resolved at runtime and cannot be determined through static analysis, the algorithm cannot be determined and will be marked as Unknown
- If there are no key lengths mentioned in the cryptographic class ,then the severity would be marked as High.
| Algorithm | NIST Status | Severity based on Grovers/Shor Analysis | PQC Readiness |
|---|---|---|---|
| AES-128 | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-192 | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-256 | Approved (FIPS 197) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-ECB | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-192-ECB | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-256-ECB | Approved (FIPS 197) | High | Quantum Vulnerable |
| AES-128-CBC | Approved (FIPS 197 / SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CBC | Approved (FIPS 197 / SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CBC | Approved (FIPS 197 / SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CTR | Approved (FIPS 197 / SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CTR | Approved (FIPS 197 / SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CTR | Approved (FIPS 197 / SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-GCM | Approved (FIPS 197 / SP 800-38D) | High | Quantum Vulnerable |
| AES-192-GCM | Approved (FIPS 197 / SP 800-38D) | High | Quantum Vulnerable |
| AES-256-GCM | Approved (FIPS 197 / SP 800-38D) | Low (Quantum Safe) | Quantum Resistant |
| Camellia-128-CBC | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | High | Quantum Vulnerable |
| Camellia-192-GCM | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | High | Quantum Vulnerable |
| Camellia-256-GCM | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | Low (Quantum Safe) | Quantum Resistant |
| CAMELLIA-128 | Approved / Recognized (SP 800-57) | High | Quantum Vulnerable |
| CAMELLIA-192 | Approved / Recognized (SP 800-57) | High | Quantum Vulnerable |
| CAMELLIA-256 | Approved / Recognized (SP 800-57) | Low (Quantum Safe) | Quantum Resistant |
| Camellia-192-CBC | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | High | Quantum Vulnerable |
| Camellia-256-CBC | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | Low (Quantum Safe) | Quantum Resistant |
| Camellia-128-GCM | Approved (ISO/IEC 18033-3 / JIS X 6319-3) | High | Quantum Vulnerable |
| CAMELLIA-128-CTR | Approved / Recognized (SP 800-57) | High | Quantum Vulnerable |
| CAMELLIA-192-CTR | Approved / Recognized (SP 800-57) | High | Quantum Vulnerable |
| CAMELLIA-256-CTR | Approved / Recognized (SP 800-57) | Low (Quantum Safe) | Quantum Resistant |
| CAMELLIA-128-CCM | Approved / Recognized (SP 800-38C, ISO/IEC 18033-3) | High | Quantum Vulnerable |
| CAMELLIA-192-CCM | Approved / Recognized (SP 800-38C, ISO/IEC 18033-3) | High | Quantum Vulnerable |
| CAMELLIA-256-CCM | Approved / Recognized (SP 800-38C, ISO/IEC 18033-3) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CCM | Approved (FIPS 197 / SP 800-38C) | High | Quantum Vulnerable |
| AES-192-CCM | Approved (FIPS 197 / SP 800-38C) | High | Quantum Vulnerable |
| AES-256-CCM | Approved (FIPS 197 / SP 800-38C) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-OCB | Approved (FIPS 197 / RFC 7253) | High | Quantum Vulnerable |
| AES-192-OCB | Approved (FIPS 197 / RFC 7253) | High | Quantum Vulnerable |
| AES-256-OCB | Approved (FIPS 197 / RFC 7253) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-XTS | Approved (SP 800-38E) | High | Quantum Vulnerable |
| AES-256-XTS | Approved (SP 800-38E) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CFB | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CFB | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CFB | Approved (SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CFB1 | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CFB1 | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CFB1 | Approved (SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-CFB8 | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-192-CFB8 | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-256-CFB8 | Approved (SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-OFB | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-192-OFB | Approved (SP 800-38A) | High | Quantum Vulnerable |
| AES-256-OFB | Approved (SP 800-38A) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-SIV | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-192-SIV | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-256-SIV | Approved (SP 800-38F) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-WRAP | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-192-WRAP | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-256-WRAP | Approved (SP 800-38F) | Low (Quantum Safe) | Quantum Resistant |
| AES-128-KW | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-192-KW | Approved (SP 800-38F) | High | Quantum Vulnerable |
| AES-256-KW | Approved (SP 800-38F) | Low (Quantum Safe) | Quantum Resistant |
| 3DES-112 | Approved (FIPS 46-3 / SP 800-67) | High | Quantum Vulnerable |
| 3DES-168 | Approved (FIPS 46-3 / SP 800-67) | High | Quantum Vulnerable |
| Blowfish-128 | Not Approved / Legacy | Critical | Quantum Vulnerable |
| Blowfish-192 | Not Approved / Legacy | Critical | Quantum Vulnerable |
| Blowfish-256 | Not Approved / Legacy | Critical | Quantum Vulnerable |
| Twofish-128 | Not Approved / Legacy | High | Quantum Vulnerable |
| Twofish-192 | Not Approved / Legacy | High | Quantum Vulnerable |
| Twofish-256 | Not Approved / Legacy | High | Quantum Vulnerable |
| Threefish-256 | Not Approved / Legacy | High | Quantum Vulnerable |
| Threefish-512 | Not Approved / Legacy | Low (Quantum Safe) | Quantum Resistant |
| THREEFISH-1024 | Not Approved / Legacy | Low (Quantum Safe) | Quantum Resistant |
| Serpent -128 | Not Approved / Legacy | High | Quantum Vulnerable |
| Serpent -192 | Not Approved / Legacy | High | Quantum Vulnerable |
| Serpent -256 | Not Approved / Legacy | Low (Quantum Safe) | Quantum Resistant |
| ChaCha20 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| XChaCha20 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ChaCha20-Poly1305 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| XChaCha20-Poly1305 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| AES-128-POLY1305 | Approved / FIPS 197, SP 800-38D | High | Quantum Vulnerable |
| AES-192-POLY1305 | Approved / FIPS 197, SP 800-38D | High | Quantum Vulnerable |
| AES-256-POLY1305 | Approved / FIPS 197, SP 800-38D | Low (Quantum Safe) | Quantum Resistant |
| DES-56 | Deprecated (FIPS 46-3) | Critical | Quantum Vulnerable |
| RC2-40 | Deprecated (SP 800-38 / Legacy) | Critical | Quantum Vulnerable |
| RC2-64 | Deprecated (SP 800-38 / Legacy) | Critical | Quantum Vulnerable |
| RC2-128 | Deprecated (SP 800-38 / Legacy) | Critical | Quantum Vulnerable |
| RC4-40 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC2-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-40 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-64 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC4-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-32-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-32-192 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-32-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-64-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-64-192 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-64-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-128-128 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-128-192 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC5-128-256 | Deprecated / Weak | Critical | Quantum Vulnerable |
| RC6-128 | Not FIPS-approved | High | Quantum Vulnerable |
| RC6-192 | Not FIPS-approved | High | Quantum Vulnerable |
| RC6-256 | Not FIPS-approved | High | Quantum Vulnerable |
| RC6-512 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| RC6-1024 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| Rijndael-128 | Not FIPS-approved | High | Quantum Vulnerable |
| Rijndael-192 | Not FIPS-approved | High | Quantum Vulnerable |
| Rijndael-256 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| IDEA-128 | Not NIST-approved / Obsolete | Critical | Quantum Vulnerable |
| ARIA-128 | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192 | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ARIA-128-CBC | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192-CBC | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256-CBC | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ARIA-128-CTR | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192-CTR | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256-CTR | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ARIA-128-GCM | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192-GCM | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256-GCM | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| ARIA-128-CCM | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-192-CCM | Not FIPS-approved | High | Quantum Vulnerable |
| ARIA-256-CCM | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| RC6-128 | Not FIPS-approved | Critical | Quantum Vulnerable |
| RC6-192 | Not FIPS-approved | High | Quantum Vulnerable |
| RC6-256 | Not FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| Algorithm | NIST Status | Severity based on Grovers/Shor Analysis | PQC readiness |
|---|---|---|---|
| RSA-512 | Approved (Deprecated, FIPS 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| RSA-768 | Approved (Deprecated, FIPS 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| RSA-1024 | Approved (Deprecated, FIPS 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| RSA-1536 | Approved (Deprecated, FIPS 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| RSA-2048 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-3072 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-4096 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-6144 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-7680 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-8192 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-12288 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-15360 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-2048 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-3072 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-4096 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-7680 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| RSA-PSS-15360 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| DSA-1024 | Approved (Deprecated, FIPS 186-3 / 186-4 / SP 800-131A) | Critical | Quantum Vulnerable |
| DSA-2048 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| DSA-3072 | Approved (FIPS 186-4 / SP 800-131A) | High | Quantum Vulnerable |
| DSA-4096 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| DSA-8192 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| DH-1024 | Approved (Deprecated, FIPS 186-4 / SP 800-56A Rev. 3) | Critical | Quantum Vulnerable |
| DH-2048 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| DH-3072 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| DHE-2048 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| DHE-3072 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| DHE-4096 | Approved (FIPS 186-4 / SP 800-56A Rev. 3) | High | Quantum Vulnerable |
| ECDSA-P192 | Approved (Deprecated, FIPS 186-4 / SP 800-186) | Critical | Quantum Vulnerable |
| ECDSA-P224 | Approved (FIPS 186-4 / SP 800-186) | High | Quantum Vulnerable |
| ECDSA-P256 | Approved (FIPS 186-4 / SP 800-186) | High | Quantum Vulnerable |
| ECDSA-P384 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDSA-P521 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDSA-brainpoolP256r1 | Not Approved | High | Quantum Vulnerable |
| ECDSA-brainpoolP384r1 | Not Approved | High | Quantum Vulnerable |
| ECDSA-brainpoolP512r1 | Not Approved | High | Quantum Vulnerable |
| ECDSA-secp256k1 | Not Approved | High | Quantum Vulnerable |
| ECDH-P192 | Approved (Deprecated, FIPS 186-4) | Critical | Quantum Vulnerable |
| ECDH-P224 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDH-P256 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDH-P384 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDH-P521 | Approved (FIPS 186-4) | High | Quantum Vulnerable |
| ECDH-brainpoolP256r1 | Not Approved | High | Quantum Vulnerable |
| ECDH-brainpoolP384r1 | Not Approved | High | Quantum Vulnerable |
| ECDH-brainpoolP512r1 | Not Approved | High | Quantum Vulnerable |
| ECDH-secp256k1 | Not Approved | High | Quantum Vulnerable |
| Ed25519 | Not Approved (draft RFC / NIST not yet standardized) | High | Quantum Vulnerable |
| Ed448 | Not Approved (draft RFC / NIST not yet standardized) | High | Quantum Vulnerable |
| X25519 | Not Approved (draft RFC / NIST not yet standardized) | High | Quantum Vulnerable |
| X448 | Not Approved (draft RFC / NIST not yet standardized) | High | Quantum Vulnerable |
| ML-DSA-44 | FIPS 204 | Low (Quantum Safe) | Quantum Resistant |
| ML-DSA-65 | FIPS 204 | Low (Quantum Safe) | Quantum Resistant |
| ML-DSA-87 | FIPS 204 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-128s | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-128f | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-192s | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-192f | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-256s | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| SLH-DSA-SHA2-256f | FIPS 205 | Low (Quantum Safe) | Quantum Resistant |
| FALCON-512 | Draft FIPS 206 | Low (Quantum Safe) | Quantum Resistant |
| FALCON-1024 | Draft FIPS 206 | Low (Quantum Safe) | Quantum Resistant |
| Algorithm | NIST/FIPS Status (FIPS/SP) | Severity based on Grovers/Shor Analysis | Quantum Readiness |
|---|---|---|---|
| MD5 | Deprecated / Legacy (FIPS 180-4) | Critical | Quantum Vulnerable |
| MD4 | Deprecated / Legacy (FIPS 180-4) | Critical | Quantum Vulnerable |
| MD2 | Deprecated / Legacy (FIPS 180-4) | Critical | Quantum Vulnerable |
| SHA-0 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| SHA-1 | Deprecated / Legacy (FIPS 180-4) | Critical | Quantum Vulnerable |
| SHA-224 | Approved (FIPS 180-4) | High | Quantum Vulnerable |
| SHA-256 | Approved (FIPS 180-4) | Low (Quantum Safe) | Quantum Resistant |
| SHA-384 | Approved (FIPS 180-4) | Low (Quantum Safe) | Quantum Resistant |
| SHA-512 | Approved (FIPS 180-4) | Low (Quantum Safe) | Quantum Resistant |
| SHA-512/224 | Approved (FIPS 180-4) | High | Quantum Vulnerable |
| SHA-512/256 | Approved (FIPS 180-4) | Low (Quantum Safe) | Quantum Resistant |
| SHA3-224 | Approved (FIPS 202 / SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| SHA3-256 | Approved (FIPS 202 / SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| SHA3-384 | Approved (FIPS 202 / SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| SHA3-512 | Approved (FIPS 202 / SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| RIPEMD-128 | Not FIPS-approved | Critical | Quantum Vulnerable |
| RIPEMD-160 | Not FIPS-approved | Critical | Quantum Vulnerable |
| RIPEMD-256 | Not FIPS-approved | High | Quantum Vulnerable |
| RIPEMD-320 | Not FIPS-approved | High | Quantum Vulnerable |
| Whirlpool | Not FIPS-approved | High | Quantum Vulnerable |
| Tiger | Not FIPS-approved | High | Quantum Vulnerable |
| BLAKE-224 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| BLAKE-256 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| BLAKE-384 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| BLAKE-512 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| BLAKE2s-128 | Standardized (RFC 7693, not NIST-approved) | Critical | Quantum Vulnerable |
| BLAKE2s-160 | Standardized (RFC 7693, not NIST-approved) | Critical | Quantum Vulnerable |
| BLAKE2s-224 | Standardized (RFC 7693, not NIST-approved) | High | Quantum Vulnerable |
| BLAKE2s-256 | Standardized (RFC 7693, not NIST-approved) | High | Quantum Vulnerable |
| BLAKE2b-224 | Standardized (RFC 7693, not NIST-approved) | High | Quantum Vulnerable |
| BLAKE2b-256 | Standardized (RFC 7693, not NIST-approved) | High | Quantum Vulnerable |
| BLAKE2b-384 | Standardized (RFC 7693, not NIST-approved) | Low (Quantum Safe) | Quantum Resistant |
| BLAKE2b-512 | Standardized (RFC 7693, not NIST-approved) | Low (Quantum Safe) | Quantum Resistant |
| BLAKE3 | Not Approved (IETF draft, not standardized by NIST) | High | Quantum Vulnerable |
| KMAC128 | Approved (SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| KMAC256 | Approved (SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| Skein-256-128 | Not Approved (SHA-3 competition finalist, not standardized) | Critical | Quantum Vulnerable |
| Skein-256-160 | Not Approved (SHA-3 competition finalist, not standardized) | Critical | Quantum Vulnerable |
| Skein-256-224 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| Skein-256-256 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| Skein-512-224 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| Skein-512-256 | Not Approved (SHA-3 competition finalist, not standardized) | High | Quantum Vulnerable |
| Skein-512-384 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Skein-512-512 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Skein-1024-384 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Skein-1024-512 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Skein-1024-1024 | Not Approved (SHA-3 competition finalist, not standardized) | Low (Quantum Safe) | Quantum Resistant |
| Algorithm | NIST/FIPS Status (FIPS/SP) | Severity based on Grovers/Shor Analysis | Quantum Readiness |
|---|---|---|---|
| HMAC-SHA1 | Approved (FIPS 198-1) | Critical | Quantum Vulnerable |
| HMAC-SHA224 | Approved (FIPS 198-1) | High | Quantum Vulnerable |
| HMAC-SHA256 | Approved (FIPS 198-1) | Low (Quantum Safe) | Quantum Resistant |
| HMAC-SHA384 | Approved (FIPS 198-1) | Low (Quantum Safe) | Quantum Resistant |
| HMAC-SHA512 | Approved (FIPS 198-1) | Low (Quantum Safe) | Quantum Resistant |
| CMAC-AES-128 | Approved (FIPS 197 / SP 800-38B) | High | Quantum Vulnerable |
| CMAC-AES-192 | Approved (FIPS 197 / SP 800-38B) | High | Quantum Vulnerable |
| CMAC-AES-256 | Approved (FIPS 197 / SP 800-38B) | Low (Quantum Safe) | Quantum Resistant |
| GMAC-AES-128 | Approved (FIPS 197 / SP 800-38D) | High | Quantum Vulnerable |
| GMAC-AES-192 | Approved (FIPS 197 / SP 800-38D) | High | Quantum Vulnerable |
| GMAC-AES-256 | Approved (FIPS 197 / SP 800-38D) | Low (Quantum Safe) | Quantum Resistant |
| Poly1305-128 (ChaCha20-Poly1305) | Not explicitly FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| Poly1305-XChaCha20-128 | Not explicitly FIPS-approved | Low (Quantum Safe) | Quantum Resistant |
| KMAC128 | Approved (SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| KMAC256 | Approved (SP 800-185) | Low (Quantum Safe) | Quantum Resistant |
| DES-CBC-MAC-56 | Deprecated / Legacy (FIPS 46-3) | Critical | Quantum Vulnerable |
| 3DES-CBC-MAC-112 | Deprecated / Legacy (FIPS 46-3) | Critical | Quantum Vulnerable |
| 3DES-CBC-MAC-168 | Deprecated / Legacy (FIPS 46-3) | Critical | Quantum Vulnerable |
| HMAC-MD5 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| MD5-CBC-MAC-56 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| MD5-CBC-MAC-128 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| Algorithm | NIST Status | Severity based on Grovers/Shor Analysis | Quantum Readiness |
|---|---|---|---|
| PBKDF1-HMAC-MD5 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| PBKDF1-HMAC-SHA1 | Deprecated / Legacy (FIPS 180-1 / PKCS #5) | Critical | Quantum Vulnerable |
| PBKDF2-HMAC-MD5 | Deprecated / Legacy | Critical | Quantum Vulnerable |
| PBKDF2-HMAC-SHA1 | Approved (PKCS #5 / SP 800-132) | Critical | Quantum Vulnerable |
| PBKDF2-HMAC-SHA224 | Approved (PKCS #5 / SP 800-132) | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| PBKDF2-HMAC-SHA256 | Approved (PKCS #5 / SP 800-132) | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| PBKDF2-HMAC-SHA384 | Approved (PKCS #5 / SP 800-132) | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| PBKDF2-HMAC-SHA512 | Approved (PKCS #5 / SP 800-132) | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| HKDF-HMAC-SHA1 | Not explicitly FIPS-approved, widely used | Critical | Quantum Vulnerable |
| HKDF-HMAC-SHA224 | Not explicitly FIPS-approved, widely used | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| HKDF-HMAC-SHA256 | Not explicitly FIPS-approved, widely used | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| HKDF-HMAC-SHA384 | Not explicitly FIPS-approved, widely used | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| HKDF-HMAC-SHA512 | Not explicitly FIPS-approved, widely used | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| Argon2d | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| Argon2i | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| Argon2id | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| bcrypt-HMAC-SHA1 | Not FIPS-approved | High | Quantum Vulnerable |
| bcrypt-HMAC-SHA224 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| bcrypt-HMAC-SHA256 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| bcrypt-HMAC-SHA384 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| bcrypt-HMAC-SHA512 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| scrypt-HMAC-SHA1 | Not FIPS-approved | High | Quantum Vulnerable |
| scrypt-HMAC-SHA224 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| scrypt-HMAC-SHA256 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| scrypt-HMAC-SHA384 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
| scrypt-HMAC-SHA512 | Not FIPS-approved | Low (Quantum Safe) (Quantum Safe) | Quantum Resistant |
Why it matters:
- Provides a prioritized list of risks for remediation.
Action:
- Focus on replacing Critical and High algorithms first.
Certificates in Code
What it shows:
- Discovery of hardcoded or embedded certificates in application code, configs, or keystores.
- Classification: internal vs public-facing certificates.
- PQC readiness of certificate algorithms and signature schemes.
Why it matters:
- Hardcoded certificates are often forgotten but may secure APIs or internal services.
- These certs must follow the same PQC migration plan as server certs.
Action:
- Replace vulnerable embedded certs with PQC-ready or hybrid certs.
Crypto Libraries
What it shows:
- Detection of standard crypto libraries (e.g., OpenSSL, BouncyCastle, WolfSSL).
- Detection of custom libraries uploaded by the user for PQC evaluation.
- Library PQC readiness (support for hybrid or PQC algorithms).
Why it matters:
- Applications inherit the cryptographic strength of their libraries.
- Non-standard/custom libraries may hide risks if not reviewed.
Action:
- Upgrade libraries to PQC-ready versions.
- Submit custom/internal libraries for analysis to ensure coverage.
Quantum Readiness Classification
What it shows:
Algorithms, certificates, and
libraries are classified as:
- Classical → Quantum-vulnerable
- Hybrid → Transitional (RSA/ECC + PQC)
- PQC-only → Quantum-safe
Why it matters:
- Gives a single maturity snapshot of application crypto posture.
Action:
- Track transition progress from Classical → Hybrid → PQC only.
High-Risk Findings
What it shows:
- Algorithms or certs using deprecated schemes (MD5, SHA-1, DES, 3DES, weak RSA/ECC).
- Libraries that are outdated or lack PQC support.
Why it matters:
- High-risk findings can lead to application-level compromise or regulatory non-compliance.
Action:
- Prioritize replacing or upgrading high-risk crypto usage.
Dashboards
What it shows:
- PQC Readiness Score: % PQC-ready vs vulnerable algorithms/libraries
- Readiness by Language: Crypto usage breakdown by programming language
- Readiness by Repository: PQC maturity per repo/project
- Library Readiness: Standard and custom libraries by PQC support level
- Algorithm Summary: Symmetric, asymmetric, hash, KDF usage trends
- Certificates in Code: PQC readiness of embedded certificates
- Quantum Readiness Trend: Migration progress over time.
Why it matters:
- Provides both developer and leadership visibility into PQC migration status.
Action:
- Use dashboards to track and report migration progress across teams.
Migration Guidance
What it shows:
- Recommended steps to transition to PQC ready code:
- Replace vulnerable algorithms with NIST-approved PQC or hybrid alternatives.
- Upgrade crypto libraries to PQC-supported versions.
- Re-issue embedded certificates with PQC or hybrid certs.
- Enforce minimum key sizes and secure KDFs.
Why it matters:
- Prevents sudden breakage or compliance failures when PQC adoption becomes mandatory.
Action:
- Follow a phased approach: Classical → Hybrid → PQC-only.
