Quantum Guard — Post-Quantum Cryptography Assessment & Migration Platform

● Supabase Cloud ⬇ CBOM

❂

Agent Execution Graph (DAG with Feedback Loop)

Agent Ready — Click "Launch Live Agent" to stream live PQC discovery & migration

Completed Active Working Feedback Loop HNDL / Vulnerable Pending

Selected
Node:

03. Reflect Gate

Self-healing gate: detects classical RSA/ECDHE handshakes & 17 AST rules. Loops back to trigger targeted PQC probe.

Kind: DECISION

legacy-web (:9441) IDLE

legacy_tls12_rsa

customer-api (:9442) IDLE

tls13_ecdhe_ecdsa

payments-core (:9443) IDLE

tls13_ecdhe_rsa (15y)

hr-records (:9444) IDLE

tls13_ecdhe_ecdsa (25y)

pqc-pilot (:9445) IDLE

hybrid_mlkem_ecdsa

Live Agent Activity Stream Hover or click any DAG node above to inspect

[READY] Click "Launch Live Agent" above to watch each stage light up in real time. IDLE

Executive Command Center

Organization quantum readiness posture, cryptographic risk matrix, and NIST IR 8547 transition milestones.

Readiness Score (Before → After)

Network TLS: 0%

Critical Findings

Broken or vulnerable classical KEX

HNDL-Urgent Assets

Secrecy + Migration > CRQC years

Auto-Fix Network Progress

0 / 0 plan items

PQC Certificates Issued

ML-DSA-87 / ML-DSA-65 / SLH-DSA

Encrypted Vault Keys

AES-256-GCM (.enc) at rest

Asset Risk Matrix (Key Exchange · Signature · Symmetric · Protocol)

Asset / Endpoint	Key Exchange	Signature / Auth	Symmetric / Hash	Protocol
Click "Launch Live Agent" to populate the matrix.

3-Wave Migration Progress & NIST IR 8547 Timeline

Aug 2024 — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) Published

TODAY (2026) — Active Hybrid Rollout & CBOM Window

After 2030 — Classical RSA / ECDSA / ECDH Deprecated (NIST IR 8547)

After 2035 — Classical Public-Key Algorithms Disallowed

Cryptographic Discovery, CBOM & Mosca Risk Assessment

Scan live TLS endpoints, source code, and X.509 certificates; evaluate HNDL urgency under NIST IR 8547.

Simulated Enterprise TLS Services (openssl s_server)

Service Name	Port	Exposure	Data Secrecy Shelf-Life	Active TLS / PQC Profile	State

Discovered Cryptographic Inventory

ID	Source	Location	Algorithm	Family	Usage	Protocol	Details

Mosca Shelf-Life Assumptions (X + Y > Z ⇒ HNDL Urgent)

Key-exchange assets are flagged HNDL Urgent when data_secrecy_years + migration_years > years_to_crqc.

Estimated Years to Quantum Computer (Z): 10 years

Enterprise Migration Duration (Y): 3 years

Severity Distribution

Vulnerability Findings & NIST IR 8547 Status

Asset Location	Source / Usage	Algorithm	Score & Severity	HNDL Status	NIST IR 8547 Status	Assessment Rationale

Is This Website Quantum-Ready? (Live Internet TLS 1.3 PQC Scanner)

Only public hostnames on port 443 are accepted. Verified against the Mozilla trust store; detects TLS interception proxies.

Scanned Public Websites This Session

Website	Verdict	Key Exchange (PQC Client)	Certificate	TLS 1.2 Accepted	Measured (UTC)
No public websites scanned yet.

Post-Quantum Migration Planner, PKI & Key Vault

Execute 3-wave migration plans, manage Classical/ML-DSA/SLH-DSA CAs, demonstrate dual-cert serving, and inspect AES-256-GCM encrypted keys.

Auto-Applicable Network Migration Progress (0%)

Before vs. After Migration Verification

Asset Location	Usage	Before Algorithm	After Algorithm	Severity Change	Score Change
Click "Apply Auto-Fixable Network Items" to reconfigure services and verify improvement.

Prioritized Migration Roadmap (Waves 1, 2 & 3)

Rank / Wave	Location	Current	Recommended Target & Standard	Effort	Rationale & Crypto-Agility Guidance	Status

Dual-Certificate Serving Proof (Same Server, Legacy vs. PQC Client)

Server runs openssl s_server -cert classical.crt -dcert pqc_mldsa65.crt -groups X25519MLKEM768:X25519.

Client A: Classical Restricted

Click "Run Demo"

Client B: PQC-Capable Default

Click "Run Demo"

Issue Leaf Certificate & Rotate Services

Certificate Inventory & Chain Verification

ID	Name	Issuing CA	Key Algorithm	Signature Algorithm	DER Size	Valid Until	Status	Verify Chain

All private keys live on disk exclusively as AES-256-GCM ciphertext (.key.enc, chmod 600). Plaintext keys are materialized only for active OpenSSL operations and immediately wiped.

Encrypted Key Inventory

ID	Key Name	Algorithm	Purpose	Created At	Rotate By	At-Rest Encryption	Status	Action

Immutable Cryptographic Audit Log

ID	Timestamp (UTC)	Actor	Action	Target	Detail

Hybrid Encryption Lab, TLS Policy Tests & Empirical Benchmarks

Interactive X25519 + ML-KEM-768 combiner, live TLS 1.3 policy probes, and fair in-process openssl speed benchmarks.

Application-Level Hybrid KEM Demo (X25519 + ML-KEM-768 → HKDF → AES-256-GCM)

Plaintext Payload:

Tamper ciphertext (test GCM auth)

TLS 1.3 Policy Verification (Fallback · Strict PQC · Hybrid)

Click "Run 3 Policy Tests" to verify Classical Fallback, Strict PQC-Only Rejection, and Hybrid Negotiation.

Why Hybrid Combiners Defeat "Harvest Now, Decrypt Later"

Run the Hybrid KEM demo on the left to inspect transcript overhead and SHA-256 shared-secret fingerprints.

⏰ Q-Day Replay: Harvest Now, Decrypt Later Simulation

An eavesdropper records both a classical X25519 session and a hybrid X25519 + ML-KEM-768 session today. At Q-Day, a quantum computer recovers the X25519 secret key via Shor’s algorithm. Which recording can it read?

Computed Key Takeaways & Host Specifications
⬇ CSV

Primary Fair Latency: In-Process `openssl speed` (ms/op — Log Scale)

Exact Public Key vs. Ciphertext / Signature Size (Bytes — Log Scale)

Primary Table: In-Process `openssl speed` (Same C Engine)

Algorithm & Operation	Category	Throughput	Latency	p95	CPU	PubKey	CT / Sig	Method

Secondary Table: End-to-End TLS 1.3 & Python `cryptography`

Operation / Profile	Category	N	Median	p95	CPU	PubKey	Wire	Notes