The impending arrival of cryptographically relevant quantum computers (CRQCs) threatens the security foundations of modern software: Shor's algorithm breaks RSA, ECDSA, ECDH, and Diffie-Hellman, while Grover's algorithm reduces the effective security of symmetric and hash-based schemes. Despite NIST standardising post-quantum cryptography (PQC) in 2024 (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA), most codebases lack automated tooling to inventory classical cryptographic usage and prioritise migration based on quantum risk. We present Quantum-Safe Code Auditor, a quantum-aware static analysis framework that combines (i) regex-based detection of 15 classes of quantum-vulnerable primitives, (ii) LLM-assisted contextual enrichment to classify usage and severity, and (iii) risk scoring via a Variational Quantum Eigensolver (VQE) model implemented in Qiskit 2.x, incorporating qubit-cost estimates to prioritise findings. We evaluate the system across five open-source libraries -- python-rsa, python-ecdsa, python-jose, node-jsonwebtoken, and Bouncy Castle Java -- covering 5,775 findings. On a stratified sample of 602 labelled instances, we achieve 71.98% precision, 100% recall, and an F1 score of 83.71%. All code, data, and reproduction scripts are released as open-source.
Comments
13 pages, 2 figures. Code and evaluation data: https://github.com/AnimeshShaw/quantum-safe-auditor
The impending arrival of cryptographically relevant quantum computers (CRQCs) threatens the security foundations of modern software: Shor's algorithm breaks RSA, ECDSA, ECDH, and Diffie-Hellman, while Grover's algorithm reduces the effective security of symmetric and hash-based schemes. Despite NIST standardising post-quantum cryptography (PQC) in 2024 (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA), most codebases lack automated tooling to inventory classical cryptographic usage and prioritise migration based on quantum risk. We present Quantum-Safe Code Auditor, a quantum-aware static analysis framework that combines (i) regex-based detection of 15 classes of quantum-vulnerable primitives, (ii) LLM-assisted contextual enrichment to classify usage and severity, and (iii) risk scoring via a Variational Quantum Eigensolver (VQE) model implemented in Qiskit 2.x, incorporating qubit-cost estimates to prioritise findings. We evaluate the system across five open-source libraries -- python-rsa, python-ecdsa, python-jose, node-jsonwebtoken, and Bouncy Castle Java -- covering 5,775 findings. On a stratified sample of 602 labelled instances, we achieve 71.98% precision, 100% recall, and an F1 score of 83.71%. All code, data, and reproduction scripts are released as open-source.
FIPS 203, 204 and 205 closed the algorithmic gap in post-quantum cryptography (PQC); the production gap -- hybrid combiners, conformance evidence, migration tooling, stateful signing, protocol helpers -- remains open. A methodology that scores it must not choose its own dimensions, so we anchor nine to external requirements (CNSA 2.0, CMVP, the TNO CADI survey, the IETF hybrid draft). We present quantum-safe, a hybrid-by-default Python library built against this rubric, and an audit of nine PQC libraries (September 2026). The exercise can lower our own score, and it does.
Hybrid combiners exist in three of six verifiable libraries, not the one a March-2026 snapshot found. Discovery and inventory tooling is the sharper gap: none of seven audited libraries has it; quantum-safe adds a CycloneDX CBOM. Only Bouncy Castle holds a CMVP FIPS 140-3 certificate; quantum-safe reports 225/225 runnable ACVP known-answer cases, which is conformance evidence, not validation. Bouncy Castle also supports LMS and XMSS where quantum-safe has LMS only, and quantum-safe's defaults sit below the CNSA 2.0 parameter sets; we score both against ourselves.
Every benchmark figure is computed from archived raw runs (bootstrap intervals over 15 runs). A full X25519 + ML-KEM-768 handshake takes a median of 231 microseconds under Docker/Linux (95% interval 218-250), 5.3x an X25519-only handshake and 0.46-2.3% of a typical TLS 1.3 budget. Throughput is flat from 100 to 5,000 threads but below the single-thread rate: threads do not speed up the hybrid path, although liboqs does release the GIL in longer calls (ML-DSA-65 signing scales 2.6x on four threads). Timing side channels are treated in a companion paper.
Abstract: This study investigates quantum-safe modernization strategies for critical infrastructure by proposing a rigorous post-quantum (PQ) migration and verification framework that treats cryptographic transition as a safety-critical, multi-system engineering program rather than a routine software upgrade. The core argument is that infrastructure operators face two coupled risks: (i) cryptanalytic obsolescence of classical public-key systems under cryptographically relevant quantum computing and (ii) operational fragility introduced by large-scale cryptographic refactoring across heterogeneous assets such as industrial control systems, substation automation, telecommunications backhaul, and safety instrumentation. To address both, the framework integrates inventory-driven migration planning, hybrid-mode interoperability controls, and verification evidence that is continuously auditable across the asset lifecycle. The manuscript operationalizes verification as a chain of assurance spanning algorithm selection, protocol composition, implementation conformance, and deployment governance. Standardized PQ primitives (e.g., ML‑KEM for key establishment and ML‑DSA/SLH‑DSA for signa-tures) are used as reference baselines, with explicit attention to size and performance implications that alter network and device constraints. Real-data collection is defined as standards-backed parameter extraction, vendor/firmware artifact inspection, and protocol telemetry capture in representative environments. Results are reported as decision-facing tables and figures that quantify payload expansion, transition milestones, and published performance overheads, alongside interpretation of their operational significance for safety and resilience. Keywords: post-quantum cryptography; ML-KEM; ML-DSA; SLH-DSA; CNSA 2.0; critical infrastructure; migration governance; protocol verification; conformance testing; cryptographic agility
Quantum computing offers major computational advances but threatens modern public-key cryptography. Classical algorithms such as RSA, Diffie–Hellman (DH), and Elliptic Curve Cryptography (ECC) are vulnerable to quantum attacks, particularly Shor’s algorithm. As large-scale quantum capabilities emerge, post-quantum cryptography (PQC) has become essential to ensure future data confidentiality, integrity, and authentication. This paper discusses the need to replace classical cryptography, explores quantum-safe solutions, and examines challenges in large-scale migration. PQC is critical across government, critical infrastructure, finance, healthcare, telecommunications, IoT, autonomous vehicles, and 6G networks. A key concern is “harvest-now, decrypt-later” attacks, where encrypted data is stored today for future quantum decryption. The study analyzes classical cryptographic vulnerabilities and reviews major PQC families: lattice-based, hash-based, code-based, multivariate-based, and isogeny-based schemes, highlighting the ongoing NIST standardization efforts. It proposes a migration framework including quantum-readiness assessment, algorithm selection, hybrid implementation, and performance evaluation. Results show that although PQC introduces higher computational complexity, optimized implementations can support real-time applications with reasonable overhead. Among PQC approaches, lattice-based schemes appear most mature and balanced in terms of security and key size. The paper concludes that quantum-safe cryptography is a necessary evolution requiring continuous monitoring, adaptable systems, and alignment with emerging standards.
With the arrival of fault-tolerant quantum computers, an existential threat has come to the cryptographic underpinnings of the security infrastructure in place for modern information technologies. Virtually all secure digital communication protocols used today are based on classical public-key cryptographic systems – RSA, Elliptic Curve Cryptography (ECC) and Diffie-Hellman key exchange – that are susceptible to polynomial-time quantum attacks using Shor's algorithm. Symmetric cryptographic algorithms that are not broken are being effectively halved by Grover's algorithm, for example, AES. In this article, a complete and journal-standard systematic review of quantum computing and its implications in the field of information technology security is presented which includes 22 peer-reviewed publications from 2023-2025. The study covers the basics of quantum computing (qubits, superposition, entanglement and quantum gates), and how quantum computing specifically poses a threat to classical cryptography via algorithmic mechanisms. The three post-quantum cryptographic algorithms that were standardised by the National Institute of Standards and Technology (NIST) in August 2024 (ML-KEM, FIPS 203; ML-DSA, FIPS 204; and SLH-DSA, FIPS 205) are compared based on their security assumptions, performance, and readiness for deployment. The practical limitations and the use of Quantum Key Distribution, (QKD), as a physics based alternative to the computational security assumptions are discussed. Results show that although mature PQ solutions are now available for most cryptographic applications, the migration challenge, including legacy system transitions, migration architecture, and governance, is significant and pressing as the ‘harvest now, decrypt later’ threat model is relevant and adversaries might be collecting encrypted data for quantum decryption. The impact for financial services, health care, government, cloud infrastructure and critical national infrastructure is discussed. Lastly, the researchers list key research areas: standardisation of quantum-safe protocols, hybrid PQC-QKD designs, light-weight PQC for constrained devices, and quantum-safe blockchain.
This paper evaluates quantum and AI-accelerated risks to TLS 1.3 cryptographic dependencies under an evidence-tiered model, distinguishing mechanism-backed threats (Shor algorithm against RSA and ECC) from contingency-backed risks to lattice-based post-quantum cryptography (PQC) and hypothesis-only risks to hash-based and symmetric primitives. We do not identify any known breaks of ML-KEM, ML-DSA, SLH-DSA, or AES-256. Instead, we use explicit scenario assumptions, organized as a four-scenario capability model with parameters and pseudocode for reproducibility, to stress-test migration timelines accompanied by parameter sensitivity analysis and explicit falsification analysis. The primary methodological contribution is a reproducible scenario-estimation instrument together with its explicit update mechanics: every parameter is a named, anchored quantity that can be varied and the model rerun; a stated protocol maps observed conformance to, or deviation from, the modeled curves onto revisions of specific parameters, so progressive refinements can be tested against accumulating historical data. The paper is a methodological companion to quantum resource-estimation studies and to expert-elicitation timeline surveys such as the Global Risk Institute quantum threat reports, with its revision rules stated explicitly. As of mid-2026, the model does not show any NIST-approved algorithms as broken. Instead, the vulnerability spectrum under different scenarios shows RSA risk crossing the 50% threshold between 2030-2032 and the PQC risk becoming a non-zero risk after 2032-2035 under contingency scenarios conditional on the unproven dimension-collapse. We urge PQC migration as mandatory per the 2030 and 2031 federal deadlines and by Mosca HNDL reasoning, and that crypto-agility and hybrid cryptographic deployment be considered necessary complements to any PQC migration efforts.
The accelerating development of large-scale quantum computers poses an existential threat to the public-key cryptographic infrastructure that underpins modern digital communication. Algorithms such as RSA and Elliptic Curve Cryptography (ECC), which currently secure internet traffic, digital signatures, and data-at-rest, are vulnerable to Shor's algorithm running on a sufficiently powerful quantum processor. In response, the U.S. National Institute of Standards and Technology (NIST) finalized the first post-quantum cryptography (PQC) standards in August 2024—FIPS 203 (ML-KEM/Kyber), FIPS 204 (ML-DSA/Dilithium), and FIPS 205 (SLH-DSA/SPHINCS+)—marking the beginning of a global migration toward quantum-resistant cryptography. This paper presents a hybrid C++/Python secure storage and communication platform (source code available at https://github.com/Sujithb128989/Quantum-Safe-Backend) that implements NIST-selected PQC algorithms in a production-oriented architecture. The backend employs CRYSTALS-Dilithium5 for quantum-resistant transport authentication, Kyber for key encapsulation, and AES-256-GCM for symmetric encryption-at-rest, delivered through a dual-stack gRPC/HTTP architecture containerized with Docker. We describe the system's design rationale, detail the cryptographic pipeline from certificate generation to atomic key rotation, and discuss the engineering challenges of integrating post-quantum primitives into real-world software systems.