{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:24d63c61-afbf-86e7-9f17-5c4a59aca044",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-07T16:40:11Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "Q-Shield",
          "publisher": "EpochCore"
        }
      ]
    },
    "properties": [
      {
        "name": "qshield:report_digest",
        "value": "24d63c61afbff6e75f175c4a59aca0444afe94308f07227464dea17946ddb89c"
      },
      {
        "name": "qshield:engagement_id",
        "value": "example-alder-2026-11-03"
      },
      {
        "name": "qshield:profile",
        "value": "mid_market"
      },
      {
        "name": "qshield:note",
        "value": "Made from the signed Q-Shield report with this digest. Check that report's signatures; this file is not signed itself."
      }
    ]
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/x25519mlkem768",
      "name": "X25519MLKEM768",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kem",
          "nistQuantumSecurityLevel": 3
        }
      },
      "properties": [
        {
          "name": "qshield:hybrid",
          "value": "Hybrid key exchange: quantum-resistant through its ML-KEM part; its classical part (an elliptic-curve exchange) is not."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/ec-secp256r1",
      "name": "EC-secp256r1",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "curve": "secp256r1",
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/ecdsa-with-sha256",
      "name": "ecdsa-with-SHA256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/x25519",
      "name": "X25519",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "key-agree",
          "curve": "x25519",
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/rsa-2048",
      "name": "RSA-2048",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "parameterSetIdentifier": "2048",
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/sha256withrsaencryption",
      "name": "sha256WithRSAEncryption",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/ec-secp384r1",
      "name": "EC-secp384r1",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "curve": "secp384r1",
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/ecdsa-with-sha384",
      "name": "ecdsa-with-SHA384",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/secp256r1",
      "name": "secp256r1",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "key-agree",
          "curve": "secp256r1",
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/algorithm/mlkem768x25519-sha256",
      "name": "mlkem768x25519-sha256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "kem",
          "nistQuantumSecurityLevel": 3
        }
      },
      "properties": [
        {
          "name": "qshield:hybrid",
          "value": "Hybrid key exchange: quantum-resistant through its ML-KEM part; its classical part (an elliptic-curve exchange) is not."
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls-kex/e7754d4b40f087d0",
      "name": "TLS key exchange on www.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cryptoRefArray": [
            "crypto/algorithm/x25519mlkem768"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "e7754d4b40f087d0"
        },
        {
          "name": "qshield:check",
          "value": "tls_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "pass"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/certificate/631287b5f3b0bd61",
      "name": "Certificate on www.alder.example:443",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "certificateFormat": "X.509",
          "subjectPublicKeyRef": "crypto/algorithm/ec-secp256r1",
          "signatureAlgorithmRef": "crypto/algorithm/ecdsa-with-sha256",
          "notValidAfter": "2027-01-29T08:15:42+00:00"
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "631287b5f3b0bd61"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls/631287b5f3b0bd61",
      "name": "TLS on www.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384"
            }
          ],
          "cryptoRefArray": [
            "crypto/algorithm/ec-secp256r1",
            "crypto/algorithm/ecdsa-with-sha256"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "631287b5f3b0bd61"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls-kex/4624df589e2001cc",
      "name": "TLS key exchange on mail.alder.example:587",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cryptoRefArray": [
            "crypto/algorithm/x25519"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "4624df589e2001cc"
        },
        {
          "name": "qshield:check",
          "value": "tls_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "fail"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "key exchange X25519 can be broken by a quantum computer; recorded traffic is exposed"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/certificate/960ede7bb12be61e",
      "name": "Certificate on mail.alder.example:587",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "certificateFormat": "X.509",
          "subjectPublicKeyRef": "crypto/algorithm/rsa-2048",
          "signatureAlgorithmRef": "crypto/algorithm/sha256withrsaencryption",
          "notValidAfter": "2027-02-14T23:59:59+00:00"
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "960ede7bb12be61e"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls/960ede7bb12be61e",
      "name": "TLS on mail.alder.example:587",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384"
            }
          ],
          "cryptoRefArray": [
            "crypto/algorithm/rsa-2048",
            "crypto/algorithm/sha256withrsaencryption"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "960ede7bb12be61e"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls-kex/0a37c631b091d55f",
      "name": "TLS key exchange on vpn.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cryptoRefArray": [
            "crypto/algorithm/x25519"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "0a37c631b091d55f"
        },
        {
          "name": "qshield:check",
          "value": "tls_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "fail"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "key exchange X25519 can be broken by a quantum computer; recorded traffic is exposed"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/certificate/6eff025f2d137367",
      "name": "Certificate on vpn.alder.example:443",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "certificateFormat": "X.509",
          "subjectPublicKeyRef": "crypto/algorithm/ec-secp384r1",
          "signatureAlgorithmRef": "crypto/algorithm/ecdsa-with-sha384",
          "notValidAfter": "2027-03-02T12:00:00+00:00"
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "6eff025f2d137367"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp384r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls/6eff025f2d137367",
      "name": "TLS on vpn.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384"
            }
          ],
          "cryptoRefArray": [
            "crypto/algorithm/ec-secp384r1",
            "crypto/algorithm/ecdsa-with-sha384"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "6eff025f2d137367"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp384r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls-kex/be56eb04bbdd082b",
      "name": "TLS key exchange on db.alder.example:5432",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cryptoRefArray": [
            "crypto/algorithm/secp256r1"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "be56eb04bbdd082b"
        },
        {
          "name": "qshield:check",
          "value": "tls_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "fail"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "key exchange secp256r1 can be broken by a quantum computer; recorded traffic is exposed"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/certificate/cc1244d00662b68e",
      "name": "Certificate on db.alder.example:5432",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "certificateFormat": "X.509",
          "subjectPublicKeyRef": "crypto/algorithm/rsa-2048",
          "signatureAlgorithmRef": "crypto/algorithm/sha256withrsaencryption",
          "notValidAfter": "2027-05-20T23:59:59+00:00"
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "cc1244d00662b68e"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls/cc1244d00662b68e",
      "name": "TLS on db.alder.example:5432",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384"
            }
          ],
          "cryptoRefArray": [
            "crypto/algorithm/rsa-2048",
            "crypto/algorithm/sha256withrsaencryption"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "cc1244d00662b68e"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/ssh-kex/c812086bb03f2db5",
      "name": "SSH key exchange on git.alder.example:22",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "ssh",
          "cryptoRefArray": [
            "crypto/algorithm/mlkem768x25519-sha256"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "c812086bb03f2db5"
        },
        {
          "name": "qshield:check",
          "value": "ssh_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "pass"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "post-quantum SSH key exchange mlkem768x25519-sha256; recorded sessions are protected"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls-kex/b9d269604b144ee9",
      "name": "TLS key exchange on portal.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cryptoRefArray": [
            "crypto/algorithm/x25519mlkem768"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "b9d269604b144ee9"
        },
        {
          "name": "qshield:check",
          "value": "tls_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "pass"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/certificate/cb88e7769c8f8f6a",
      "name": "Certificate on portal.alder.example:443",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "certificateFormat": "X.509",
          "subjectPublicKeyRef": "crypto/algorithm/rsa-2048",
          "signatureAlgorithmRef": "crypto/algorithm/sha256withrsaencryption",
          "notValidAfter": "2027-04-11T23:59:59+00:00"
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "cb88e7769c8f8f6a"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls/cb88e7769c8f8f6a",
      "name": "TLS on portal.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_128_GCM_SHA256"
            }
          ],
          "cryptoRefArray": [
            "crypto/algorithm/rsa-2048",
            "crypto/algorithm/sha256withrsaencryption"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "cb88e7769c8f8f6a"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls-kex/0d15faf7727c68c6",
      "name": "TLS key exchange on intranet.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cryptoRefArray": [
            "crypto/algorithm/x25519mlkem768"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "0d15faf7727c68c6"
        },
        {
          "name": "qshield:check",
          "value": "tls_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "pass"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/certificate/c5835163b9446e51",
      "name": "Certificate on intranet.alder.example:443",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "certificateFormat": "X.509",
          "subjectPublicKeyRef": "crypto/algorithm/ec-secp256r1",
          "signatureAlgorithmRef": "crypto/algorithm/ecdsa-with-sha256",
          "notValidAfter": "2027-01-08T10:30:00+00:00"
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "c5835163b9446e51"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls/c5835163b9446e51",
      "name": "TLS on intranet.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384"
            }
          ],
          "cryptoRefArray": [
            "crypto/algorithm/ec-secp256r1",
            "crypto/algorithm/ecdsa-with-sha256"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "c5835163b9446e51"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls-kex/96a14f808dc30345",
      "name": "TLS key exchange on sso.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cryptoRefArray": [
            "crypto/algorithm/x25519mlkem768"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "96a14f808dc30345"
        },
        {
          "name": "qshield:check",
          "value": "tls_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "pass"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/certificate/0a240566cb21808e",
      "name": "Certificate on sso.alder.example:443",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "certificateFormat": "X.509",
          "subjectPublicKeyRef": "crypto/algorithm/ec-secp256r1",
          "signatureAlgorithmRef": "crypto/algorithm/ecdsa-with-sha256",
          "notValidAfter": "2027-02-27T09:00:00+00:00"
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "0a240566cb21808e"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls/0a240566cb21808e",
      "name": "TLS on sso.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384"
            }
          ],
          "cryptoRefArray": [
            "crypto/algorithm/ec-secp256r1",
            "crypto/algorithm/ecdsa-with-sha256"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "0a240566cb21808e"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls-kex/5b99bf7f90c4018b",
      "name": "TLS key exchange on api.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cryptoRefArray": [
            "crypto/algorithm/x25519mlkem768"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "5b99bf7f90c4018b"
        },
        {
          "name": "qshield:check",
          "value": "tls_kex"
        },
        {
          "name": "qshield:verdict",
          "value": "pass"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/certificate/0ad7771439e55277",
      "name": "Certificate on api.alder.example:443",
      "cryptoProperties": {
        "assetType": "certificate",
        "certificateProperties": {
          "certificateFormat": "X.509",
          "subjectPublicKeyRef": "crypto/algorithm/ec-secp256r1",
          "signatureAlgorithmRef": "crypto/algorithm/ecdsa-with-sha256",
          "notValidAfter": "2027-03-19T16:45:00+00:00"
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "0ad7771439e55277"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto/protocol/tls/0ad7771439e55277",
      "name": "TLS on api.alder.example:443",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_128_GCM_SHA256"
            }
          ],
          "cryptoRefArray": [
            "crypto/algorithm/ec-secp256r1",
            "crypto/algorithm/ecdsa-with-sha256"
          ]
        }
      },
      "properties": [
        {
          "name": "qshield:finding_id",
          "value": "0ad7771439e55277"
        },
        {
          "name": "qshield:check",
          "value": "tls_cert"
        },
        {
          "name": "qshield:verdict",
          "value": "due"
        },
        {
          "name": "qshield:verdict_reason",
          "value": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035"
        },
        {
          "name": "qshield:observed_at",
          "value": "2026-11-03T14:12:00Z"
        }
      ]
    }
  ]
}