{ "schema": "qshield/proof-report/v1", "engagement_id": "example-alder-2026-11-03", "generated_at": "2026-11-07T16:40:11Z", "profile": "mid_market", "findings": [ { "finding_id": "e7754d4b40f087d0", "asset": { "host": "www.alder.example", "port": 443 }, "check": "tls_kex", "observed": { "tls13": true, "negotiated_group": "X25519MLKEM768", "pq_supported": true, "hello_retry": false, "cnsa2_group": null, "cnsa2_supported": false }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.kex_probe", "tool_version": "0.2.1" }, { "finding_id": "631287b5f3b0bd61", "asset": { "host": "www.alder.example", "port": 443 }, "check": "tls_cert", "observed": { "tls_version": "TLSv1.3", "cipher": "TLS_AES_256_GCM_SHA384", "cert_key": "EC-secp256r1", "cert_signature_algorithm": "ecdsa-with-SHA256", "rsa_key_transport": false, "not_after": "2027-01-29T08:15:42+00:00", "issuer": "CN=Example Edge CA E1,O=Example Trust,C=US", "issuer_key_id": "5a1b9c0e7d2f4a6b8c3d1e0f9a7b5c4d3e2f1a0b", "distrusted_issuer": null }, "hndl_exposed": false, "quantum_vulnerable": true, "reason": "certificate (key EC-secp256r1, signed with ecdsa-with-SHA256) can be forged with a quantum computer: an impersonation risk once one exists, not a risk to recorded traffic", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.tls_cert", "tool_version": "0.2.1" }, { "finding_id": "be52d1db40da4360", "asset": { "host": "www.alder.example", "port": 443 }, "check": "web_software", "observed": { "status": 200, "server": "cloudflare", "x_powered_by": null, "software": [], "known_exploited": [] }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "the response headers name no software version", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.web_software", "tool_version": "0.2.1" }, { "finding_id": "4624df589e2001cc", "asset": { "host": "mail.alder.example", "port": 587 }, "check": "tls_kex", "observed": { "tls13": true, "negotiated_group": "X25519", "pq_supported": false, "hello_retry": false, "cnsa2_group": null, "cnsa2_supported": false, "starttls": "smtp" }, "hndl_exposed": true, "quantum_vulnerable": true, "reason": "key exchange X25519 can be broken by a quantum computer; recorded traffic is exposed", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.kex_probe", "tool_version": "0.2.1" }, { "finding_id": "960ede7bb12be61e", "asset": { "host": "mail.alder.example", "port": 587 }, "check": "tls_cert", "observed": { "tls_version": "TLSv1.3", "cipher": "TLS_AES_256_GCM_SHA384", "cert_key": "RSA-2048", "cert_signature_algorithm": "sha256WithRSAEncryption", "rsa_key_transport": false, "not_after": "2027-02-14T23:59:59+00:00", "starttls": "smtp", "issuer": "CN=Example Issuing CA R3,O=Example Trust,C=US", "issuer_key_id": "c47e2a9b1d0f8e6c5b4a3928170615f4e3d2c1b0", "distrusted_issuer": null }, "hndl_exposed": false, "quantum_vulnerable": true, "reason": "certificate (key RSA-2048, signed with sha256WithRSAEncryption) can be forged with a quantum computer: an impersonation risk once one exists, not a risk to recorded traffic", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.tls_cert", "tool_version": "0.2.1" }, { "finding_id": "0a37c631b091d55f", "asset": { "host": "vpn.alder.example", "port": 443 }, "check": "tls_kex", "observed": { "tls13": true, "negotiated_group": "X25519", "pq_supported": false, "hello_retry": false, "cnsa2_group": null, "cnsa2_supported": false }, "hndl_exposed": true, "quantum_vulnerable": true, "reason": "key exchange X25519 can be broken by a quantum computer; recorded traffic is exposed", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.kex_probe", "tool_version": "0.2.1" }, { "finding_id": "6eff025f2d137367", "asset": { "host": "vpn.alder.example", "port": 443 }, "check": "tls_cert", "observed": { "tls_version": "TLSv1.3", "cipher": "TLS_AES_256_GCM_SHA384", "cert_key": "EC-secp384r1", "cert_signature_algorithm": "ecdsa-with-SHA384", "rsa_key_transport": false, "not_after": "2027-03-02T12:00:00+00:00", "issuer": "CN=Example Edge CA E1,O=Example Trust,C=US", "issuer_key_id": "5a1b9c0e7d2f4a6b8c3d1e0f9a7b5c4d3e2f1a0b", "distrusted_issuer": null }, "hndl_exposed": false, "quantum_vulnerable": true, "reason": "certificate (key EC-secp384r1, signed with ecdsa-with-SHA384) can be forged with a quantum computer: an impersonation risk once one exists, not a risk to recorded traffic", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.tls_cert", "tool_version": "0.2.1" }, { "finding_id": "8b355136cdee0563", "asset": { "host": "vpn.alder.example", "port": 443 }, "check": "web_software", "observed": { "status": 200, "server": null, "x_powered_by": null, "software": [], "known_exploited": [] }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "the response headers name no software version", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.web_software", "tool_version": "0.2.1" }, { "finding_id": "be56eb04bbdd082b", "asset": { "host": "db.alder.example", "port": 5432, "protocol": "postgresql" }, "check": "tls_kex", "observed": { "tls13": true, "negotiated_group": "secp256r1", "pq_supported": false, "hello_retry": false, "cnsa2_group": null, "cnsa2_supported": false, "starttls": "postgresql" }, "hndl_exposed": true, "quantum_vulnerable": true, "reason": "key exchange secp256r1 can be broken by a quantum computer; recorded traffic is exposed", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.kex_probe", "tool_version": "0.2.1" }, { "finding_id": "cc1244d00662b68e", "asset": { "host": "db.alder.example", "port": 5432, "protocol": "postgresql" }, "check": "tls_cert", "observed": { "tls_version": "TLSv1.3", "cipher": "TLS_AES_256_GCM_SHA384", "cert_key": "RSA-2048", "cert_signature_algorithm": "sha256WithRSAEncryption", "rsa_key_transport": false, "not_after": "2027-05-20T23:59:59+00:00", "starttls": "postgresql", "issuer": "CN=Example Issuing CA R3,O=Example Trust,C=US", "issuer_key_id": "c47e2a9b1d0f8e6c5b4a3928170615f4e3d2c1b0", "distrusted_issuer": null }, "hndl_exposed": false, "quantum_vulnerable": true, "reason": "certificate (key RSA-2048, signed with sha256WithRSAEncryption) can be forged with a quantum computer: an impersonation risk once one exists, not a risk to recorded traffic", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.tls_cert", "tool_version": "0.2.1" }, { "finding_id": "c812086bb03f2db5", "asset": { "host": "git.alder.example", "port": 22 }, "check": "ssh_kex", "observed": { "banner": "SSH-2.0-OpenSSH_9.9", "negotiated_kex": "mlkem768x25519-sha256", "pq_supported": true, "kex_algorithms": [ "mlkem768x25519-sha256", "sntrup761x25519-sha512", "sntrup761x25519-sha512@openssh.com", "curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256", "ext-info-s", "kex-strict-s-v00@openssh.com" ] }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "post-quantum SSH key exchange mlkem768x25519-sha256; recorded sessions are protected", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.ssh_kex", "tool_version": "0.2.1" }, { "finding_id": "b9d269604b144ee9", "asset": { "host": "portal.alder.example", "port": 443 }, "check": "tls_kex", "observed": { "tls13": true, "negotiated_group": "X25519MLKEM768", "pq_supported": true, "hello_retry": false, "cnsa2_group": null, "cnsa2_supported": false }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.kex_probe", "tool_version": "0.2.1" }, { "finding_id": "cb88e7769c8f8f6a", "asset": { "host": "portal.alder.example", "port": 443 }, "check": "tls_cert", "observed": { "tls_version": "TLSv1.3", "cipher": "TLS_AES_128_GCM_SHA256", "cert_key": "RSA-2048", "cert_signature_algorithm": "sha256WithRSAEncryption", "rsa_key_transport": false, "not_after": "2027-04-11T23:59:59+00:00", "issuer": "CN=Example Issuing CA R3,O=Example Trust,C=US", "issuer_key_id": "c47e2a9b1d0f8e6c5b4a3928170615f4e3d2c1b0", "distrusted_issuer": null }, "hndl_exposed": false, "quantum_vulnerable": true, "reason": "certificate (key RSA-2048, signed with sha256WithRSAEncryption) can be forged with a quantum computer: an impersonation risk once one exists, not a risk to recorded traffic", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.tls_cert", "tool_version": "0.2.1" }, { "finding_id": "c72e5cb75b3356ca", "asset": { "host": "portal.alder.example", "port": 443 }, "check": "web_software", "observed": { "status": 200, "server": "nginx", "x_powered_by": null, "software": [], "known_exploited": [] }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "the response headers name no software version", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.web_software", "tool_version": "0.2.1" }, { "finding_id": "0d15faf7727c68c6", "asset": { "host": "intranet.alder.example", "port": 443 }, "check": "tls_kex", "observed": { "tls13": true, "negotiated_group": "X25519MLKEM768", "pq_supported": true, "hello_retry": false, "cnsa2_group": null, "cnsa2_supported": false }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.kex_probe", "tool_version": "0.2.1" }, { "finding_id": "c5835163b9446e51", "asset": { "host": "intranet.alder.example", "port": 443 }, "check": "tls_cert", "observed": { "tls_version": "TLSv1.3", "cipher": "TLS_AES_256_GCM_SHA384", "cert_key": "EC-secp256r1", "cert_signature_algorithm": "ecdsa-with-SHA256", "rsa_key_transport": false, "not_after": "2027-01-08T10:30:00+00:00", "issuer": "CN=Example Edge CA E1,O=Example Trust,C=US", "issuer_key_id": "5a1b9c0e7d2f4a6b8c3d1e0f9a7b5c4d3e2f1a0b", "distrusted_issuer": null }, "hndl_exposed": false, "quantum_vulnerable": true, "reason": "certificate (key EC-secp256r1, signed with ecdsa-with-SHA256) can be forged with a quantum computer: an impersonation risk once one exists, not a risk to recorded traffic", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.tls_cert", "tool_version": "0.2.1" }, { "finding_id": "bb4f87dc584f8d9a", "asset": { "host": "intranet.alder.example", "port": 443 }, "check": "web_software", "observed": { "status": 200, "server": "Apache/2.4.49", "x_powered_by": null, "software": [ { "product": "Apache", "version": "2.4.49", "header": "server" } ], "known_exploited": [ { "product": "Apache HTTP Server", "cve": "CVE-2021-41773", "name": "path traversal and file disclosure", "affected": [ [ "2.4.49", "2.4.49" ] ], "fixed": "2.4.50", "kev_date_added": "2021-11-03", "condition": "files outside the document root not protected by \"Require all denied\"", "source": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773", "version": "2.4.49" }, { "product": "Apache HTTP Server", "cve": "CVE-2021-42013", "name": "path traversal and remote code execution", "affected": [ [ "2.4.49", "2.4.50" ] ], "fixed": "2.4.51", "kev_date_added": "2021-11-03", "condition": "files outside the document root not protected by \"Require all denied\"", "source": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013", "version": "2.4.49" }, { "product": "Apache HTTP Server", "cve": "CVE-2024-38475", "name": "mod_rewrite improper escaping of output", "affected": [ [ "2.4.0", "2.4.59" ] ], "fixed": "2.4.60", "kev_date_added": "2025-05-01", "condition": "mod_rewrite rules whose substitution starts with a path on the server", "source": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38475", "version": "2.4.49" } ] }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "announces Apache 2.4.49: a version in the range of 3 known-exploited vulnerabilities on CISA's KEV list (CVE-2021-41773, CVE-2021-42013, CVE-2024-38475)", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.web_software", "tool_version": "0.2.1" }, { "finding_id": "96a14f808dc30345", "asset": { "host": "sso.alder.example", "port": 443 }, "check": "tls_kex", "observed": { "tls13": true, "negotiated_group": "X25519MLKEM768", "pq_supported": true, "hello_retry": false, "cnsa2_group": null, "cnsa2_supported": false }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.kex_probe", "tool_version": "0.2.1" }, { "finding_id": "0a240566cb21808e", "asset": { "host": "sso.alder.example", "port": 443 }, "check": "tls_cert", "observed": { "tls_version": "TLSv1.3", "cipher": "TLS_AES_256_GCM_SHA384", "cert_key": "EC-secp256r1", "cert_signature_algorithm": "ecdsa-with-SHA256", "rsa_key_transport": false, "not_after": "2027-02-27T09:00:00+00:00", "issuer": "CN=Example Edge CA E1,O=Example Trust,C=US", "issuer_key_id": "5a1b9c0e7d2f4a6b8c3d1e0f9a7b5c4d3e2f1a0b", "distrusted_issuer": null }, "hndl_exposed": false, "quantum_vulnerable": true, "reason": "certificate (key EC-secp256r1, signed with ecdsa-with-SHA256) can be forged with a quantum computer: an impersonation risk once one exists, not a risk to recorded traffic", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.tls_cert", "tool_version": "0.2.1" }, { "finding_id": "45955d5b225cd232", "asset": { "host": "sso.alder.example", "port": 443 }, "check": "web_software", "observed": { "status": 200, "server": null, "x_powered_by": null, "software": [], "known_exploited": [] }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "the response headers name no software version", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.web_software", "tool_version": "0.2.1" }, { "finding_id": "5b99bf7f90c4018b", "asset": { "host": "api.alder.example", "port": 443 }, "check": "tls_kex", "observed": { "tls13": true, "negotiated_group": "X25519MLKEM768", "pq_supported": true, "hello_retry": false, "cnsa2_group": null, "cnsa2_supported": false }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.kex_probe", "tool_version": "0.2.1" }, { "finding_id": "0ad7771439e55277", "asset": { "host": "api.alder.example", "port": 443 }, "check": "tls_cert", "observed": { "tls_version": "TLSv1.3", "cipher": "TLS_AES_128_GCM_SHA256", "cert_key": "EC-secp256r1", "cert_signature_algorithm": "ecdsa-with-SHA256", "rsa_key_transport": false, "not_after": "2027-03-19T16:45:00+00:00", "issuer": "CN=Example Edge CA E1,O=Example Trust,C=US", "issuer_key_id": "5a1b9c0e7d2f4a6b8c3d1e0f9a7b5c4d3e2f1a0b", "distrusted_issuer": null }, "hndl_exposed": false, "quantum_vulnerable": true, "reason": "certificate (key EC-secp256r1, signed with ecdsa-with-SHA256) can be forged with a quantum computer: an impersonation risk once one exists, not a risk to recorded traffic", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.tls_cert", "tool_version": "0.2.1" }, { "finding_id": "c9abfe10805873d9", "asset": { "host": "api.alder.example", "port": 443 }, "check": "web_software", "observed": { "status": 200, "server": "nginx", "x_powered_by": null, "software": [], "known_exploited": [] }, "hndl_exposed": false, "quantum_vulnerable": false, "reason": "the response headers name no software version", "error": null, "observed_at": "2026-11-03T14:12:00Z", "tool": "qshield.find.web_software", "tool_version": "0.2.1" } ], "audit": { "profile": "mid_market", "source": "NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035", "passed": false, "counts": { "pass": 6, "fail": 4, "due": 8, "unknown": 0 }, "kex_coverage_pct": 66.7, "results": [ { "finding_id": "e7754d4b40f087d0", "asset": { "host": "www.alder.example", "port": 443 }, "check": "tls_kex", "verdict": "pass", "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected" }, { "finding_id": "631287b5f3b0bd61", "asset": { "host": "www.alder.example", "port": 443 }, "check": "tls_cert", "verdict": "due", "reason": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035" }, { "finding_id": "4624df589e2001cc", "asset": { "host": "mail.alder.example", "port": 587 }, "check": "tls_kex", "verdict": "fail", "reason": "key exchange X25519 can be broken by a quantum computer; recorded traffic is exposed" }, { "finding_id": "960ede7bb12be61e", "asset": { "host": "mail.alder.example", "port": 587 }, "check": "tls_cert", "verdict": "due", "reason": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035" }, { "finding_id": "0a37c631b091d55f", "asset": { "host": "vpn.alder.example", "port": 443 }, "check": "tls_kex", "verdict": "fail", "reason": "key exchange X25519 can be broken by a quantum computer; recorded traffic is exposed" }, { "finding_id": "6eff025f2d137367", "asset": { "host": "vpn.alder.example", "port": 443 }, "check": "tls_cert", "verdict": "due", "reason": "certificate key EC-secp384r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035" }, { "finding_id": "be56eb04bbdd082b", "asset": { "host": "db.alder.example", "port": 5432, "protocol": "postgresql" }, "check": "tls_kex", "verdict": "fail", "reason": "key exchange secp256r1 can be broken by a quantum computer; recorded traffic is exposed" }, { "finding_id": "cc1244d00662b68e", "asset": { "host": "db.alder.example", "port": 5432, "protocol": "postgresql" }, "check": "tls_cert", "verdict": "due", "reason": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035" }, { "finding_id": "c812086bb03f2db5", "asset": { "host": "git.alder.example", "port": 22 }, "check": "ssh_kex", "verdict": "pass", "reason": "post-quantum SSH key exchange mlkem768x25519-sha256; recorded sessions are protected" }, { "finding_id": "b9d269604b144ee9", "asset": { "host": "portal.alder.example", "port": 443 }, "check": "tls_kex", "verdict": "pass", "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected" }, { "finding_id": "cb88e7769c8f8f6a", "asset": { "host": "portal.alder.example", "port": 443 }, "check": "tls_cert", "verdict": "due", "reason": "certificate key RSA-2048: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035" }, { "finding_id": "0d15faf7727c68c6", "asset": { "host": "intranet.alder.example", "port": 443 }, "check": "tls_kex", "verdict": "pass", "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected" }, { "finding_id": "c5835163b9446e51", "asset": { "host": "intranet.alder.example", "port": 443 }, "check": "tls_cert", "verdict": "due", "reason": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035" }, { "finding_id": "bb4f87dc584f8d9a", "asset": { "host": "intranet.alder.example", "port": 443 }, "check": "web_software", "verdict": "fail", "reason": "announces Apache 2.4.49: a version in the range of 3 known-exploited vulnerabilities on CISA's KEV list (CVE-2021-41773, CVE-2021-42013, CVE-2024-38475)" }, { "finding_id": "96a14f808dc30345", "asset": { "host": "sso.alder.example", "port": 443 }, "check": "tls_kex", "verdict": "pass", "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected" }, { "finding_id": "0a240566cb21808e", "asset": { "host": "sso.alder.example", "port": 443 }, "check": "tls_cert", "verdict": "due", "reason": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035" }, { "finding_id": "5b99bf7f90c4018b", "asset": { "host": "api.alder.example", "port": 443 }, "check": "tls_kex", "verdict": "pass", "reason": "post-quantum hybrid key exchange X25519MLKEM768; recorded traffic is protected" }, { "finding_id": "0ad7771439e55277", "asset": { "host": "api.alder.example", "port": 443 }, "check": "tls_cert", "verdict": "due", "reason": "certificate key EC-secp256r1: NIST IR 8547 (final, October 2026): RSA and ECC deprecated after 2030, disallowed after 2035" } ] }, "triage": { "profile": "mid_market", "ranked": [ { "finding_id": "bb4f87dc584f8d9a", "rank": 1, "score": 0.48, "asset": { "host": "intranet.alder.example", "port": 443 }, "check": "web_software", "why": "intranet wiki: announces Apache HTTP Server 2.4.49, in the range of known-exploited CVE-2021-41773, CVE-2021-42013, CVE-2024-38475 (CISA KEV); internal data kept 5 years.", "plan": { "steps": [ "Upgrade Apache HTTP Server from 2.4.49: CVE-2021-41773 is fixed in 2.4.50; CVE-2021-42013 is fixed in 2.4.51; CVE-2024-38475 is fixed in 2.4.60", "If it is a distribution build, check its changelog first: distributions often backport a fix without changing the version shown", "Re-scan to confirm the version the server announces" ], "target": [ "Apache HTTP Server 2.4.60" ], "deadline": "2026-11-03", "deadline_source": "on CISA's Known Exploited Vulnerabilities list: CVE-2021-41773 since 2021-11-03, CVE-2021-42013 since 2021-11-03, CVE-2024-38475 since 2025-05-01" }, "controller": { "name": "Apache HTTP Server", "kind": "server", "evidence": "Server header: Apache/2.4.49" }, "quantum_timeline": null, "symmetric": null, "known_exploited": true }, { "finding_id": "be56eb04bbdd082b", "rank": 2, "score": 0.88, "asset": { "host": "db.alder.example", "port": 5432, "protocol": "postgresql" }, "check": "tls_kex", "why": "clinical records (PostgreSQL): traffic recorded today is exposed; regulated data kept 25 years, still secret at 3 of 3 plausible quantum break years.", "plan": { "steps": [ "Enable X25519MLKEM768 on the TLS terminator (OpenSSL 3.5+, BoringSSL or Go 1.24+ builds)", "Re-scan to confirm the negotiated group" ], "target": [ "X25519MLKEM768" ], "deadline": "2027-11-03", "deadline_source": "if a quantum break came as early as 2029, traffic recorded today would still need to be secret then; policy date: NIST IR 8547 (final, October 2026): quantum-vulnerable key establishment deprecated after 2030" }, "controller": null, "quantum_timeline": { "algorithm": "ECC-256", "logical_qubits": 2330, "toffoli": 129000000000, "source": "Roetteler, Naehrig, Svore & Lauter 2017, 'Quantum resource estimates for computing elliptic curve discrete logarithms' (arXiv:1706.06752): at most 9n + 2 ceil(log2 n) + 10 logical qubits and 448 n^3 log2 n + 4090 n^3 Toffolis for an n-bit prime field", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)", "secret_until": 2051 }, "symmetric": null }, { "finding_id": "4624df589e2001cc", "rank": 3, "score": 0.68, "asset": { "host": "mail.alder.example", "port": 587 }, "check": "tls_kex", "why": "mail (SMTP): traffic recorded today is exposed; confidential data kept 10 years, still secret at 3 of 3 plausible quantum break years.", "plan": { "steps": [ "Enable X25519MLKEM768 on the TLS terminator (OpenSSL 3.5+, BoringSSL or Go 1.24+ builds)", "Re-scan to confirm the negotiated group" ], "target": [ "X25519MLKEM768" ], "deadline": "2027-11-03", "deadline_source": "if a quantum break came as early as 2029, traffic recorded today would still need to be secret then; policy date: NIST IR 8547 (final, October 2026): quantum-vulnerable key establishment deprecated after 2030" }, "controller": null, "quantum_timeline": { "algorithm": "ECC-255", "logical_qubits": 2321, "toffoli": 127000000000, "source": "Roetteler, Naehrig, Svore & Lauter 2017, 'Quantum resource estimates for computing elliptic curve discrete logarithms' (arXiv:1706.06752): at most 9n + 2 ceil(log2 n) + 10 logical qubits and 448 n^3 log2 n + 4090 n^3 Toffolis for an n-bit prime field", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)", "secret_until": 2036 }, "symmetric": null }, { "finding_id": "0a37c631b091d55f", "rank": 4, "score": 0.68, "asset": { "host": "vpn.alder.example", "port": 443 }, "check": "tls_kex", "why": "remote access (VPN): traffic recorded today is exposed; confidential data kept 10 years, still secret at 3 of 3 plausible quantum break years.", "plan": { "steps": [ "Enable X25519MLKEM768 on the TLS terminator (OpenSSL 3.5+, BoringSSL or Go 1.24+ builds)", "Re-scan to confirm the negotiated group" ], "target": [ "X25519MLKEM768" ], "deadline": "2027-11-03", "deadline_source": "if a quantum break came as early as 2029, traffic recorded today would still need to be secret then; policy date: NIST IR 8547 (final, October 2026): quantum-vulnerable key establishment deprecated after 2030" }, "controller": { "name": null, "kind": null, "evidence": "no Server header in the front page's response" }, "quantum_timeline": { "algorithm": "ECC-255", "logical_qubits": 2321, "toffoli": 127000000000, "source": "Roetteler, Naehrig, Svore & Lauter 2017, 'Quantum resource estimates for computing elliptic curve discrete logarithms' (arXiv:1706.06752): at most 9n + 2 ceil(log2 n) + 10 logical qubits and 448 n^3 log2 n + 4090 n^3 Toffolis for an n-bit prime field", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)", "secret_until": 2036 }, "symmetric": null }, { "finding_id": "0ad7771439e55277", "rank": 5, "score": 0.1716, "asset": { "host": "api.alder.example", "port": 443 }, "check": "tls_cert", "why": "lab-results API: certificate can be forged once a quantum computer exists (not a risk to recorded traffic); regulated data kept 25 years.", "plan": { "steps": [ "Inventory which clients must accept a post-quantum certificate on this endpoint", "The CA/Browser Forum's rules for publicly trusted certificates do not allow ML-DSA yet (its ML-DSA ballot was still in draft at the 2026-07-30 Server Certificate Working Group meeting, cabforum.org), and Chrome said on 2026-02-27 it has no immediate plan to trust post-quantum X.509 certificates (blog.google/security, 'Cultivating a robust and efficient quantum-safe HTTPS')", "Move to an ML-DSA-65 certificate once a CA can issue it and those clients accept it; keep the classical one until then", "Re-scan to confirm the certificate's key and signature" ], "target": [ "ML-DSA-65" ], "deadline": "2035-12-31", "deadline_source": "NIST IR 8547 (final, October 2026): RSA and ECC signatures disallowed after 2035" }, "controller": { "name": "nginx", "kind": "server", "evidence": "Server header: nginx" }, "quantum_timeline": { "algorithm": "ECC-256", "logical_qubits": 2330, "toffoli": 129000000000, "source": "Roetteler, Naehrig, Svore & Lauter 2017, 'Quantum resource estimates for computing elliptic curve discrete logarithms' (arXiv:1706.06752): at most 9n + 2 ceil(log2 n) + 10 logical qubits and 448 n^3 log2 n + 4090 n^3 Toffolis for an n-bit prime field", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)" }, "symmetric": { "cipher": "TLS_AES_128_GCM_SHA256", "bulk": "AES-128", "hash": "SHA-256", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 128, "classical_security_bits": 128, "grover_bits": 64, "cnsa2": false, "logical_qubits": 2953, "note": "AES-128: 64 bits against Grover's search on paper; the search is serial (about 2^64 cipher evaluations in sequence), so NIST still approves it. CNSA 2.0 requires AES-256." } }, { "finding_id": "cc1244d00662b68e", "rank": 6, "score": 0.1716, "asset": { "host": "db.alder.example", "port": 5432, "protocol": "postgresql" }, "check": "tls_cert", "why": "clinical records (PostgreSQL): certificate can be forged once a quantum computer exists (not a risk to recorded traffic); regulated data kept 25 years.", "plan": { "steps": [ "Inventory which clients must accept a post-quantum certificate on this endpoint", "The CA/Browser Forum's rules for publicly trusted certificates do not allow ML-DSA yet (its ML-DSA ballot was still in draft at the 2026-07-30 Server Certificate Working Group meeting, cabforum.org), and Chrome said on 2026-02-27 it has no immediate plan to trust post-quantum X.509 certificates (blog.google/security, 'Cultivating a robust and efficient quantum-safe HTTPS')", "Move to an ML-DSA-65 certificate once a CA can issue it and those clients accept it; keep the classical one until then", "Re-scan to confirm the certificate's key and signature" ], "target": [ "ML-DSA-65" ], "deadline": "2035-12-31", "deadline_source": "NIST IR 8547 (final, October 2026): RSA and ECC signatures disallowed after 2035" }, "controller": null, "quantum_timeline": { "algorithm": "RSA-2048", "logical_qubits": 6189, "toffoli": 2620000000, "source": "Gidney & Ekera 2019, 'How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits' (arXiv:1905.09749): 3n + 0.002 n lg n logical qubits, 0.3 n^3 + 0.0005 n^3 lg n Toffolis", "note": "20 million noisy qubits, 8 hours (physical error rate 0.1%, 1 microsecond surface-code cycle); newer estimate for RSA-2048: fewer than a million noisy qubits, under a week (Gidney 2025, arXiv:2505.15917)", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)" }, "symmetric": { "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" } }, { "finding_id": "960ede7bb12be61e", "rank": 7, "score": 0.1326, "asset": { "host": "mail.alder.example", "port": 587 }, "check": "tls_cert", "why": "mail (SMTP): certificate can be forged once a quantum computer exists (not a risk to recorded traffic); confidential data kept 10 years.", "plan": { "steps": [ "Inventory which clients must accept a post-quantum certificate on this endpoint", "The CA/Browser Forum's rules for publicly trusted certificates do not allow ML-DSA yet (its ML-DSA ballot was still in draft at the 2026-07-30 Server Certificate Working Group meeting, cabforum.org), and Chrome said on 2026-02-27 it has no immediate plan to trust post-quantum X.509 certificates (blog.google/security, 'Cultivating a robust and efficient quantum-safe HTTPS')", "Move to an ML-DSA-65 certificate once a CA can issue it and those clients accept it; keep the classical one until then", "Re-scan to confirm the certificate's key and signature" ], "target": [ "ML-DSA-65" ], "deadline": "2035-12-31", "deadline_source": "NIST IR 8547 (final, October 2026): RSA and ECC signatures disallowed after 2035" }, "controller": null, "quantum_timeline": { "algorithm": "RSA-2048", "logical_qubits": 6189, "toffoli": 2620000000, "source": "Gidney & Ekera 2019, 'How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits' (arXiv:1905.09749): 3n + 0.002 n lg n logical qubits, 0.3 n^3 + 0.0005 n^3 lg n Toffolis", "note": "20 million noisy qubits, 8 hours (physical error rate 0.1%, 1 microsecond surface-code cycle); newer estimate for RSA-2048: fewer than a million noisy qubits, under a week (Gidney 2025, arXiv:2505.15917)", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)" }, "symmetric": { "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" } }, { "finding_id": "cb88e7769c8f8f6a", "rank": 8, "score": 0.1326, "asset": { "host": "portal.alder.example", "port": 443 }, "check": "tls_cert", "why": "partner portal: certificate can be forged once a quantum computer exists (not a risk to recorded traffic); confidential data kept 7 years.", "plan": { "steps": [ "Inventory which clients must accept a post-quantum certificate on this endpoint", "The CA/Browser Forum's rules for publicly trusted certificates do not allow ML-DSA yet (its ML-DSA ballot was still in draft at the 2026-07-30 Server Certificate Working Group meeting, cabforum.org), and Chrome said on 2026-02-27 it has no immediate plan to trust post-quantum X.509 certificates (blog.google/security, 'Cultivating a robust and efficient quantum-safe HTTPS')", "Move to an ML-DSA-65 certificate once a CA can issue it and those clients accept it; keep the classical one until then", "Re-scan to confirm the certificate's key and signature" ], "target": [ "ML-DSA-65" ], "deadline": "2035-12-31", "deadline_source": "NIST IR 8547 (final, October 2026): RSA and ECC signatures disallowed after 2035" }, "controller": { "name": "nginx", "kind": "server", "evidence": "Server header: nginx" }, "quantum_timeline": { "algorithm": "RSA-2048", "logical_qubits": 6189, "toffoli": 2620000000, "source": "Gidney & Ekera 2019, 'How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits' (arXiv:1905.09749): 3n + 0.002 n lg n logical qubits, 0.3 n^3 + 0.0005 n^3 lg n Toffolis", "note": "20 million noisy qubits, 8 hours (physical error rate 0.1%, 1 microsecond surface-code cycle); newer estimate for RSA-2048: fewer than a million noisy qubits, under a week (Gidney 2025, arXiv:2505.15917)", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)" }, "symmetric": { "cipher": "TLS_AES_128_GCM_SHA256", "bulk": "AES-128", "hash": "SHA-256", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 128, "classical_security_bits": 128, "grover_bits": 64, "cnsa2": false, "logical_qubits": 2953, "note": "AES-128: 64 bits against Grover's search on paper; the search is serial (about 2^64 cipher evaluations in sequence), so NIST still approves it. CNSA 2.0 requires AES-256." } }, { "finding_id": "0a240566cb21808e", "rank": 9, "score": 0.1326, "asset": { "host": "sso.alder.example", "port": 443 }, "check": "tls_cert", "why": "single sign-on: certificate can be forged once a quantum computer exists (not a risk to recorded traffic); confidential data kept 7 years.", "plan": { "steps": [ "Inventory which clients must accept a post-quantum certificate on this endpoint", "The CA/Browser Forum's rules for publicly trusted certificates do not allow ML-DSA yet (its ML-DSA ballot was still in draft at the 2026-07-30 Server Certificate Working Group meeting, cabforum.org), and Chrome said on 2026-02-27 it has no immediate plan to trust post-quantum X.509 certificates (blog.google/security, 'Cultivating a robust and efficient quantum-safe HTTPS')", "Move to an ML-DSA-65 certificate once a CA can issue it and those clients accept it; keep the classical one until then", "Re-scan to confirm the certificate's key and signature" ], "target": [ "ML-DSA-65" ], "deadline": "2035-12-31", "deadline_source": "NIST IR 8547 (final, October 2026): RSA and ECC signatures disallowed after 2035" }, "controller": { "name": null, "kind": null, "evidence": "no Server header in the front page's response" }, "quantum_timeline": { "algorithm": "ECC-256", "logical_qubits": 2330, "toffoli": 129000000000, "source": "Roetteler, Naehrig, Svore & Lauter 2017, 'Quantum resource estimates for computing elliptic curve discrete logarithms' (arXiv:1706.06752): at most 9n + 2 ceil(log2 n) + 10 logical qubits and 448 n^3 log2 n + 4090 n^3 Toffolis for an n-bit prime field", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)" }, "symmetric": { "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" } }, { "finding_id": "6eff025f2d137367", "rank": 10, "score": 0.1326, "asset": { "host": "vpn.alder.example", "port": 443 }, "check": "tls_cert", "why": "remote access (VPN): certificate can be forged once a quantum computer exists (not a risk to recorded traffic); confidential data kept 10 years.", "plan": { "steps": [ "Inventory which clients must accept a post-quantum certificate on this endpoint", "The CA/Browser Forum's rules for publicly trusted certificates do not allow ML-DSA yet (its ML-DSA ballot was still in draft at the 2026-07-30 Server Certificate Working Group meeting, cabforum.org), and Chrome said on 2026-02-27 it has no immediate plan to trust post-quantum X.509 certificates (blog.google/security, 'Cultivating a robust and efficient quantum-safe HTTPS')", "Move to an ML-DSA-65 certificate once a CA can issue it and those clients accept it; keep the classical one until then", "Re-scan to confirm the certificate's key and signature" ], "target": [ "ML-DSA-65" ], "deadline": "2035-12-31", "deadline_source": "NIST IR 8547 (final, October 2026): RSA and ECC signatures disallowed after 2035" }, "controller": { "name": null, "kind": null, "evidence": "no Server header in the front page's response" }, "quantum_timeline": { "algorithm": "ECC-384", "logical_qubits": 3484, "toffoli": 449000000000, "source": "Roetteler, Naehrig, Svore & Lauter 2017, 'Quantum resource estimates for computing elliptic curve discrete logarithms' (arXiv:1706.06752): at most 9n + 2 ceil(log2 n) + 10 logical qubits and 448 n^3 log2 n + 4090 n^3 Toffolis for an n-bit prime field", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)" }, "symmetric": { "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" } }, { "finding_id": "c5835163b9446e51", "rank": 11, "score": 0.0936, "asset": { "host": "intranet.alder.example", "port": 443 }, "check": "tls_cert", "why": "intranet wiki: certificate can be forged once a quantum computer exists (not a risk to recorded traffic); internal data kept 5 years.", "plan": { "steps": [ "Inventory which clients must accept a post-quantum certificate on this endpoint", "The CA/Browser Forum's rules for publicly trusted certificates do not allow ML-DSA yet (its ML-DSA ballot was still in draft at the 2026-07-30 Server Certificate Working Group meeting, cabforum.org), and Chrome said on 2026-02-27 it has no immediate plan to trust post-quantum X.509 certificates (blog.google/security, 'Cultivating a robust and efficient quantum-safe HTTPS')", "Move to an ML-DSA-65 certificate once a CA can issue it and those clients accept it; keep the classical one until then", "Re-scan to confirm the certificate's key and signature" ], "target": [ "ML-DSA-65" ], "deadline": "2035-12-31", "deadline_source": "NIST IR 8547 (final, October 2026): RSA and ECC signatures disallowed after 2035" }, "controller": { "name": "Apache HTTP Server", "kind": "server", "evidence": "Server header: Apache/2.4.49" }, "quantum_timeline": { "algorithm": "ECC-256", "logical_qubits": 2330, "toffoli": 129000000000, "source": "Roetteler, Naehrig, Svore & Lauter 2017, 'Quantum resource estimates for computing elliptic curve discrete logarithms' (arXiv:1706.06752): at most 9n + 2 ceil(log2 n) + 10 logical qubits and 448 n^3 log2 n + 4090 n^3 Toffolis for an n-bit prime field", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)" }, "symmetric": { "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" } }, { "finding_id": "631287b5f3b0bd61", "rank": 12, "score": 0.0546, "asset": { "host": "www.alder.example", "port": 443 }, "check": "tls_cert", "why": "public website: certificate can be forged once a quantum computer exists (not a risk to recorded traffic); public data kept 1 year.", "plan": { "steps": [ "This host's front page names Cloudflare in its Server header (Server header: cloudflare). If Cloudflare's edge terminates TLS here, the certificate visitors see is the one on Cloudflare's edge, and Cloudflare lists post-quantum signatures for visitors as planned via Merkle Tree Certificates (developers.cloudflare.com/ssl/post-quantum-cryptography/pqc-cloudflare-products, read 2026-11-03)", "The CA/Browser Forum's rules for publicly trusted certificates do not allow ML-DSA yet (its ML-DSA ballot was still in draft at the 2026-07-30 Server Certificate Working Group meeting, cabforum.org), and Chrome said on 2026-02-27 it has no immediate plan to trust post-quantum X.509 certificates (blog.google/security, 'Cultivating a robust and efficient quantum-safe HTTPS')", "No certificate you could install today changes this: keep the classical certificate and re-scan when Cloudflare offers post-quantum authentication to visitors" ], "target": [ "ML-DSA-65" ], "deadline": "2035-12-31", "deadline_source": "NIST IR 8547 (final, October 2026): RSA and ECC signatures disallowed after 2035" }, "controller": { "name": "Cloudflare", "kind": "cdn", "evidence": "Server header: cloudflare" }, "quantum_timeline": { "algorithm": "ECC-256", "logical_qubits": 2330, "toffoli": 129000000000, "source": "Roetteler, Naehrig, Svore & Lauter 2017, 'Quantum resource estimates for computing elliptic curve discrete logarithms' (arXiv:1706.06752): at most 9n + 2 ceil(log2 n) + 10 logical qubits and 448 n^3 log2 n + 4090 n^3 Toffolis for an n-bit prime field", "roadmap": "IBM Quantum roadmap (June 2025)", "first_milestone": null, "year": null, "beyond": "beyond its largest milestone (Blue Jay, 2033: 2,000 logical qubits, 1e+09 gates)" }, "symmetric": { "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" } } ], "not_ranked": [ "e7754d4b40f087d0", "c812086bb03f2db5", "b9d269604b144ee9", "0d15faf7727c68c6", "96a14f808dc30345", "5b99bf7f90c4018b" ], "symmetric": [ { "finding_id": "631287b5f3b0bd61", "asset": { "host": "www.alder.example", "port": 443 }, "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" }, { "finding_id": "960ede7bb12be61e", "asset": { "host": "mail.alder.example", "port": 587 }, "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" }, { "finding_id": "6eff025f2d137367", "asset": { "host": "vpn.alder.example", "port": 443 }, "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" }, { "finding_id": "cc1244d00662b68e", "asset": { "host": "db.alder.example", "port": 5432, "protocol": "postgresql" }, "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" }, { "finding_id": "cb88e7769c8f8f6a", "asset": { "host": "portal.alder.example", "port": 443 }, "cipher": "TLS_AES_128_GCM_SHA256", "bulk": "AES-128", "hash": "SHA-256", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 128, "classical_security_bits": 128, "grover_bits": 64, "cnsa2": false, "logical_qubits": 2953, "note": "AES-128: 64 bits against Grover's search on paper; the search is serial (about 2^64 cipher evaluations in sequence), so NIST still approves it. CNSA 2.0 requires AES-256." }, { "finding_id": "c5835163b9446e51", "asset": { "host": "intranet.alder.example", "port": 443 }, "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" }, { "finding_id": "0a240566cb21808e", "asset": { "host": "sso.alder.example", "port": 443 }, "cipher": "TLS_AES_256_GCM_SHA384", "bulk": "AES-256", "hash": "SHA-384", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 256, "classical_security_bits": 256, "grover_bits": 128, "cnsa2": true, "logical_qubits": 6681, "note": "AES-256: 128 bits against Grover's search; no Grover-related action needed for the cipher" }, { "finding_id": "0ad7771439e55277", "asset": { "host": "api.alder.example", "port": 443 }, "cipher": "TLS_AES_128_GCM_SHA256", "bulk": "AES-128", "hash": "SHA-256", "source": "Grover 1996, 'A fast quantum mechanical algorithm for database search' (arXiv:quant-ph/9605043): a key search of 2^k keys in about 2^(k/2) sequential steps; Grassl, Langenberg, Roetteler & Steinwandt 2016, 'Applying Grover's algorithm to AES: quantum resource estimates' (arXiv:1512.04965): 2,953 / 4,449 / 6,681 logical qubits for AES-128 / -192 / -256", "key_bits": 128, "classical_security_bits": 128, "grover_bits": 64, "cnsa2": false, "logical_qubits": 2953, "note": "AES-128: 64 bits against Grover's search on paper; the search is serial (about 2^64 cipher evaluations in sequence), so NIST still approves it. CNSA 2.0 requires AES-256." } ], "model": null, "method": "baseline score" }, "migrations": [], "signing_entropy": { "applies_to": "ML-DSA-87", "sources": [ "csprng" ] }, "signatures": [ { "alg": "Ed25519", "key_id": "7B93DFD4897D6E1E", "sig_b64": "GJjdYqcWbcz00fnboNM5ETAHT9fougXxsCuk2ORxvI/fybH4kbJA3uzlpGrjoWj5724ZKl62eADhgmiappBVDQ==" }, { "alg": "ML-DSA-87", "key_id": "31EE547A2E8849B0", "sig_b64": "eg16xh83l6Tvh/hKiM7sg147VZU0mUZ3iJenVaJxP00uKGMCD4MvW/psaDd+JeUoLi3PQn3lQbwkQ1EEoxkBTkiB8sFgI0bP/ry63MkTDcVIIxYnSsw7nEpTGeeDZtkNNNH6XNrNsed95QQZEZjGMhFdJvjQxQb1UFZcMwLzp7XJExj6brs3bzS8+uYv/OTMQOIKoSYSsdHRZT+8+5xU9XVR6Y7ywtABsQOAfODpinO9Rry85rxHfZgNN2w5+m0hbrSk3rrBPfgKald85hVMJv5SIaKXpW23MCBrIiehrUNYpDA2R2Ut5gnCeXSw+JXWLDt059Bf+ciHtiVZfzfIoWlYi5XVA5tg6GvNcIRsFPFVyjM5EY1egSX0eihHEfR4LWGvgzD0yBh4Jdnxbg+gow5itQqbdLAdFL0Xp1Q9Ux7pea0HkZncFLd4x9qMi859lGH2OEeUn2dY5j7cuzXLLJfkI5qhEADEQpL71WZjLdFGv4E+rrAi7D2A3B7jmYKVd0NQjAOmvO6rzMHAO3S/ypBTMjhGBhbFpzNnHZ2DDVf2UnupL81FRKDg21XTeTsUQWe6wDZomNPrFMRxQKES+xPqk0cdT7oEz2obM/vQg/3lAYM+MOVMUTEtG48nbk0KYf1sCYvzJ7AcYLwKKP4B7fI4xL/acdrnbxk2T0aWFVy2zbHGnw3SzWwqPn8R0t08BzU1lxJH+XA8gK1Ls9uEQiIqdYc59UMxx6gkVLhvepJ2yztgpmQZJpAEcxqzU1khsEE4BtMsKZNvGaYab9Y6Dzm0T3KtqjswJ/stBniCostr5m0iI7r+dkOJ9t/eP/bG595uNGeX8lVlERzgv1xIZ0L2h5L7lTnLOSHoB2OwIMfPWxNJigXz55US8hOqwHH9G/TCF8G1UA2800cTZIVaDF1FiEmpagVO4Z67I7vIGi6HDmCuQoi7DkTX/3I56CRAXHmI57F+mK/FKbw4QK93ymvT4XuR37HgXSZSCfRxLO19pcNOBcIJ0kaAq7KDq6kBGXTIopwdobH5EMeSqSbfHwhGb3fn2M3lmm7kFm7qd8cEH7fhAb6JBPPnUeE8+Ry0PbDsZG+Rzwjx5wh8u59lnqtMFCZpoKmhQUIXKH/KBme1Iougb7CbqvIC3fTkjCTwTGJeFDXnmEMUM1IhEQa1lF6vz5jLszIfkS5HBqRPc5o1nK2E9rYlrzKtzDbcC4dCKK3LwJY+BPhMbuhKaRjnP3jlrlilossYjB9Fe1G/iwo9NSdWB8/zpeSBKwISdTyKth001Qsf458P7spRwrisarv1JlUU3XSvVDBJmM+dT0qfHqLn/pYF8AIpganGHT3nOo/wPPpV3W64R3tZYIW1zDxxdZbd9UiZei6ShMTQXkkuRHcbZITxjM1s9pvoIBzQOIQYfRORgJkFdnTCCKa6WinIHD213ohOZXXGOQhkr7BKP4/kMLH1B9kBZU0WkVhadkMhYVnTOkm7bcbGHuakHyx8+dYGvAwdvttfU40X7oSLmk7efnalPgpi8YUSIxMx7qrVbNf+3FUzgzptDOpYdOkF5BtUr5lRvVW1UAjZwbinR0St3ZUXMwauqjutXpGk66RUI4X48mvxim1R1NxiRWajd1Sy3JcDJZuHhQMl8jJAmxqE+BTg3j2+oJNwweZp5tjHb9ormICCVdN3Z3ZG9fVvNIg/ykWLU/2D1G8QGHi8N0HTs1Ondp5Wl+KsrBOndHJUfVd/ZQzyHoaLvQoYTGt3BwAu9vZFXxMec9WfODzHEcyyH8ybqGuUZuD7S7Xnc1/gVp2GWeFsWbXnjO0h1JWdf8Fvqony1sYzwXOjAyMTeXYtJ1MSryqYV/O+xffCoHXewAruN+nWQeDtTnF/IqGXCvYey42ydCavSFv4FMzrX7oi0BZkTYTKqsUjighO6XaiGHYgGoFczB5kUPqE4Twty5bg115TnzC27CjN/5di1kCNOdMByDqqIz/332oB8R4lCwj+po93kCGpcCTzXI4zHVEdcOYqJDmLvvGxC7ifuhM3Fg3pLEmOmeEGCJp57IuzsoW022jH1vDK5sx6O8kcfqDQaNsQC17uMuU3z/RhqO90bC7zltv9upKnjN2QAYrYBMhUGhj3Xi6I6Ulf9jBN297Plf56NbBMhy/Cg0+rowtGGbEzzydpGV+TCYCbBogEPs0HgYGnaafD59pdqUUM+rAVvZJ7Xuug/jjB+x028e2Rpq0eoiY6EL7I25sxE+VewF8l69NBHJkEDYe4137/qmg6eVpjV8zrztC/BqUZk0luVAg6juNSdXTg2LtvaU6gLIibhDXV936BKzyidxojfw/CWK10y/5dwxmZ6hcUxIIt14HTX0G+SIDDiWiIZLiwtIMeK7ti3NAcCDex6ZHo2YONBV73U/VvsczvLwsARLc+o0QVB1AzG0Vtrwn6Y5QqPPBQnwjK6O91WHmRicTCWDFuo2LGBT+6j719VT3SWNcSPmqSutIX/J+b16ydIhTq1btOzJs67ymNH3sXEv9LcviFvtiCq5BLVCHHWA1rArqj61D93i+am2XYIdqdMg6GAtI12u85SSPj6iGefwd8thd1O7U3HfVt1SivXKl/rPlp0+IGqwMO87EXV6waipLEB9zx8armfl2fsmXxPvDFtZej05zsQNFd3LRaqKSKHaSV1XBS1tSjvwV+lbcqVDH+A/tbRW6CA5N+0vtFBSx+4J7jEJrRQcN8LI8GAEYC+UkC2jhu+8hW28mQ2/rCxP/48VUDWT8tun73u0syvZI653S9b05PnCzBF0cGr83O2tTMvTODDu5GSeZKKCNYUtco5eJXr4wBmOGhqJLfq5A7omH0syElAE1AAALpBC+FWmd/GHi4iJed9vxta5CkK/JXWprXBtSBbqtt7EELjBFp+G5skXoSZnrIuLUUXZN571Zm07xupuSj+aX3o+/3ATvn2RrlKkaOiuc7DsYEWHsw3HSBin/TDWdC2So/n4s+eCGYcaBAlwNXLEmWJaQtGeM6GdhHjMQwZcts2x4F8jaK7RccMZiDitqr2GbKE1Fh5MN6pxzgOtxE10lWWVtfPCgXqdkfeU1tgrP3LgFS4yJqfI2zZM+TNeqAw2/4BItBDO48qDbm3JodX+INpV+JphjA44Q/7Ha696nx3W3CPsNZBHe10OwAePv4M4t+kjCj77HeSZMY4dBe0XqZV88CH8rIlx0rEpd1xfnqBDR4Mpkub77TddiMObJc6O9wEMZH5ZZn3nhy6NgD18m0pHs5UK1Rox4VlD6636E/siX812eGGlqh3ExmeKusFuzSZynDNeQjNOpS/92mGCyBRCMxgnJGwp2S3vVxnxaxEV7taoJcDUEyQzuVd+hZ15Qfzkawhj17X1M1QTP4bRGAxTZLPjXzUhYZkelfnYfcGVYJjjUxuXDBIRR2kYxHjGlfMD2PnRTg/Z8jr9rPNHC4QZi3BJhLv/xumsKOyk6ukUtNuVXPOo5lJ5Lit89YZC2UaOXUwoePZGDr40NLpEaiIZo76pc1RU34CDvMrge51bLRu7YSRECHlTkN/OnMW5LHVSNLZTKq0cjKlTRLMz/hGDuQuQGE9Gd2XKIAvnOd6vtJmxMRuwmjQiIi6482PS4Bk/0TF1Ex3UKHfnWJduNAiDMWzW0oAP8LQTENakcfN1rSNt7rD/95DElpHMmvrEebvFFM7fO++04AbynAzSOERGHIYSQY/2Rk7oPMjzHILcYd2Kw3cAzRETBeGDbFjdLAvbQhMMqERcJXAU8PKh9OpL69ajzWD6eII1/2TrRc1RM60F5Kn8W6lpTDOTz0jEqxVuiha94tsFv+NEam7C7FNwa2HMCMZ2czFutygsuOBClVgYxtqaK6uAOnCOMgZu2c/lKt3hkqmP+5g1sb+CtkCJrFof30HdPpzkqlOAPXkDcfoGzxJ6TOitkmkOikqzmrgnYliODX6f6EbxplZHEFJsYBjpT1/NPWyfaCRilhy5LBW9uStiYOpFkM5BxpG4IQPHrrzzlXpFGUVzgvtQ6IY0NDak323oh+hTeWwyc7kB73XO5wH0yBD7RnyhcMnL1IgiljRfFJ+ndFRL9GdM1DbQR20Obs2NX8yrjzl9euSYskDNUhvH+cmff41OYzYaKA0vBTcETcwcIJUJKsR8ioo140prFGvNFy5j7VJGPJP5yEgBGxUcMuYI0gr9VOEZBtnAw5zUskepDIzz8/1E/g6xDQLUrE6lKxSMz7jJORGyS/6oKhCpfHcSstNZNhuaQ0GQBDGHfeQXowcwP2AqE76aBMN9jo93wTmsAoWkWjjrNbixMbttiblZCv4kamOhxg9KNA20lrM4wocMCrtanZe17abU2YJxLmvmU8A8zq83qH4y00U18D7ZA6820cJoxG+4QkcI3TFPPk5BCKy28KoUI7u8pcAnhvbY4AsF0ZdZqUe00In76Wq2sakepuQ+6MBDAxp7Lh3iIRNTe5feyisn5T7ItL/+TZHlYUOueDT3Kth8NXoqcVQsVlMwrRpE6LTs9RWG9/ydEvhR4Y/I1fgO7Tc2klAUCS6imjX4gYvBgAyutJ7gapqIYnnTfZ2JLgFJ5ZFEMrxWidmpelR5k/oBg7mm/gaxF862+DHSBji/GN3T5vF8LP1PDdzM1HM1rVkJVQDk8FDOqdFczIo/7hHVs0Ag9trYnpCzQoQoJHyWCHXon3gCzzfjRqOZZbq/0sBSM0RPGxQipUo8vsgelHe4u4vbkyN2bOLMKWNDhzrUsC5Ma+BLJDN6ZgxkBo5S7MHh2LWayFuv0472cdNXLzcruPvNUIlIjugrbqs9fb/Xyd2TQvildQ0g/g0DWBzTOmXyMMAgtzNYlcH1igRs/t3R+6PtOFlMC5k5Bo6V7aeydH1nhxPILNPJJIOeH0vcj11zbQ4v1t95mUbwbCsejhdTc73NSKN1n6SGKVBoGzQ//TYYprBt7grz7Gn0fDtoarAS6VyCMjb2U+vkN2UMyIIrZfguMfuS0NgIocXJp0Q9ymE/2ms0Mbughbk5Fvji8NEgfqx+PcBn5ataFAIIgRDDrj3v48pNzHtnEe38H5vWiBuwGy+oiBhfjlC77o90jFZgYDU3Dws/OFUFigPrNa1Cz5O07Xaawzu5EaL+bAX9pI1+WxQ7R6bu6bugKG0UZ+ME4rq1rQaD2Ch0gLrPS5VkSyFkd7q0rQqeGWvRAz2z0YjGRx/wRpLPYU2EwBPdlkWR4JCWBk1MtV4lgbeiJQSjZaH/ZAlkKN+ykW2BeA3mEy9cj8tWeE/clkILFKcrW0x4fN4wDO2jLEg1bb77ifuf9+qiLqNBiZBTibf+WvkAqZevwVKOCamz1lehEQR7YHabpUK1EdbR3dmA+StW3SHGPKH7vTRdNhkDAg6DhTxkH64/sDgpGIgYc3Mer+ERCGfNBfHfFXOMIgR4lPH6Qo+bi+JOwpaQOlb9je37uEJM3KjR5H2TJHRW/cELxIxeUyejrsC8v/kQGveQ+hyB224UjVopbTwSh7zyq2G4bqF53h9+MfCcCByKHody+q5En1ET9B70EwUWKT+X8p18nlXNSwOScP3f7jf5QYMSh131lKK08Lkv4Inv5wz0NXSDRGPxLFxdbuhTOncXIzVIp8TjtoN+oy80DxJdQIruhGeKA7TodbiVXfRvCiVfBhAojDYzueTqEawtilQjL/nhnoH9pkoAXlHJvruznlKuBSmuo7KWfFqHnENg7wXMa5aWnVGNidQPj5DpwSrW15U5eQ7SiVdFK/21mB55B0AI1v9p0ZZadmACETXDAeMblIs3lGEX0QAMAbRjlRXlKm4BVTJqIHtK/bg2QWyTjxNmUYV9WHVYxnQahdlMpSNz8dJlAx4mRqprQeHl5RPMc7biJzfmxtse/HQ7l8K03m8Z2r1EIR8hR1vPLK3rNollDNrErkQonb4a3JmFw5FEmu4UD5VEgYGsHLBp/rfoHAl4m+FUsaMpjvmhi8aNuCvwb9o/nrWEMFP5Qx8yUdLLRi9F2uabUjYdGgM93UJMOBpru6AyeRLCrIlq2+/ZcPpqwN6Swv1R8TI1N1sbTKH3mquubx/QkvNFZylKWyxQU0SEt5e7AKm6rE2AtEi56j2eEkhusoQmVzfZGqy/kAAAAAAAAAAAAAAAAAAAAAAAAAAAAHDhceIyotNg==" } ] }