quantakrypto
Loading…
Loading…
A senior cryptographer maps every place asymmetric cryptography lives in your systems, ranks your exposure, and gives you a roadmap — and a certificate you can show investors, customers, and regulators.
Every engagement begins with a paid scoping & discovery call. From there, choose the depth that fits.
For · SMBs, crypto-native startups, consultancies
A focused readiness assessment: self-assessment questionnaire, document review, and a working session to establish your exposure and a crypto-agility baseline.
For · Mid-market, fintech, regulated industries
A full crypto inventory and migration roadmap, with staff training. We map every place asymmetric cryptography is used and order the migration against your threat model.
For · Banks, insurance, telco, government
Everything in the Standard Audit, plus a board-level report and regulatory alignment mapping across ISO 27001, DORA, and NIS2, with quarterly check-ins.
Open, repeatable, and ordered against your threat model — not a checklist.
Always first, always a paid engagement. We agree the scope, map your systems at a high level, and deliver a scope document with indicative pricing before any deeper work begins.
We find every place asymmetric cryptography is used — TLS, PKI, signing pipelines, identity keys, prekeys, backups, multi-device sync. There is no single switch; each location is its own decision.
We assess harvest-now-decrypt-later exposure, select primitives and hybrid constructions, evaluate library fitness, and map findings against the regulatory regimes that apply to you.
A prioritised, threat-model-ordered plan — including a rollout strategy from dark launch through gradual ramp to default-on and hardening, with explicit rollback paths.
A point-in-time quantakrypto certificate you can show investors, customers, and regulators, with an annual renewal that keeps your posture current as the standards and library landscape move.
Recurring post-quantum defects, classified by type — the ones we have found in audits, and the ones we actively watch for but have not yet seen.
15
Classes catalogued
8
Found in audits
23
Total observations
7
Watched (findable)
Operational & key-mgmt
One-time ML-KEM prekeys served from a pool but never retired after use, so the same encapsulation can be replayed — defeating forward secrecy.
prekey = pool.fetch(user) // returns the SAME prekey twiceshared = ML_KEM.decapsulate(sk, ct)// BUG: prekey is never consumed -> attacker replays ct// FIX: pool.consume(user, prekey) // atomic, single-usePrimitive-level
A decapsulation path that branches on a secret-dependent comparison, making accept-vs-reject distinguishable by timing.
for i in 0..n: if poly[i] == bound: // BUG: secret-dependent branch return reject()// timing distinguishes implicit rejection -> KyberSlash// FIX: r = ct_select(mask, a, b) // constant-time, no branchPrimitive-level
ML-KEM/ML-DSA keygen drawing from a non-cryptographic or unseeded RNG. The scheme is correct; the entropy source is not.
seed = prng.bytes(32) // BUG: non-CSPRNG / unseeded(pk, sk) = ML_KEM.keygen(seed)// a working round-trip does NOT prove the RNG is sound// FIX: seed = csprng.bytes(32) // OS CSPRNG, freshly seededLibrary & dependency
Source written to be constant-time but compiled into branchy code by the optimiser. The property must hold in the binary, not the source.
mask = -(a == b) // intended constant-timesel = (a & mask) | (b & ~mask)// BUG: -O2 re-introduces a branch -> timing leak in the binary// FIX: verify with ctgrind / dudect; pin codegen flagsProtocol-integration
An out-of-range encapsulation key accepted without validation, so two peers can derive different shared secrets from the same key.
ek = recv() // BUG: no modulus / length checkct = ML_KEM.encapsulate(ek)// malformed ek -> peers disagree on the shared secret// FIX: assert valid_range(ek); else reject before useProtocol-integration
A system uses asymmetric crypto in ten places — identity keys, prekeys, ratchets, backups, attestation — but 'going PQ' flips one global flag.
if config.pq_enabled: // BUG: one switch for ten call-sites handshake.use_pq()// identity keys, signed prekeys, backups... still classical// FIX: inventory each site; migrate in threat-model orderProtocol-integration
A hybrid combiner concatenates the two shared secrets without labels or transcript binding, leaving the construction ambiguous.
ss = KDF(ss_classical || ss_pq) // BUG: no labels, order ambiguous// downgrade / re-ordering can go unnoticed// FIX: ss = KDF(label || ss_classical || ss_pq || transcript)Library & dependency
Key generation from the reference implementation paired with decapsulation from an AVX2 build — subtly incompatible code paths.
keygen = ref.keygen // BUG: two implementations, one keypairdecapsulate = avx2.decapsulate// edge-case divergence -> interop and correctness failures// FIX: one audited implementation end-to-endPrimitive-level
A glitch during rejection sampling can leak secret data or yield a forgeable signature on fault-prone hardware.
sig = ML_DSA.sign(sk, m) // glitch during rejection sampling// WATCH: faulted signature may leak sk or be forgeable// FIX: self-verify(sig, pk, m) before releasing the signaturePrimitive-level
Secret-dependent memory access patterns in the number-theoretic transform expose a cache side-channel.
acc = twiddle[secret_index] // secret-dependent memory access// WATCH: cache-timing leak of secret coefficients// FIX: linear sweeps / scatter-gather independent of secretsPrimitive-level
On embedded targets, a weak per-signature RNG undermines the hedged-randomness assumption of ML-DSA.
rnd = device_rng() // low entropy on embeddedsig = ML_DSA.sign(sk, m, rnd)// WATCH: predictable rnd weakens hedged signing// FIX: use deterministic variant or a vetted CSPRNGProtocol-integration
A negotiation that silently falls back to classical key exchange lets an active attacker strip the post-quantum protection.
if !peer.supports_pq: use_classical() // WATCH: MITM forces the fallback// FIX: bind the negotiated groups into the authenticated transcriptOperational & key-mgmt
Transport is hybridised but backups and archives stay RSA-wrapped — exactly the long-lived data harvest-now-decrypt-later targets.
transport = hybrid_pq() // goodbackup = RSA_wrap(data_key) // WATCH: HNDL on long-lived data// FIX: extend PQ to storage, backups and key escrowProtocol-integration
Reusing a single keypair across a KEM and a signature scheme opens the door to cross-protocol attacks.
k = keygen()use_as_kem(k); use_as_signature(k) // WATCH: cross-protocol interaction// FIX: separate keys per purpose, with domain separationLibrary & dependency
Shipping a post-quantum library with no recent maintenance and no published audit — a supply-chain and patch-latency risk.
import pqc_lib v0.0.3 // last release 18 months ago, no audit// WATCH: unpatched defects, no security response process// FIX: choose on maintenance + audit posture, not feature countWe assess against the standards as written and align findings to the regime that governs you.
The finalised ML-KEM, ML-DSA, and SLH-DSA standards. We audit against the standards as written — not earlier round-3 candidates.
The NSA's algorithm suite and migration timeline for national-security systems and their suppliers.
Operational resilience obligations for EU financial entities — including the cryptographic posture of critical systems.
Expanded cybersecurity obligations across essential and important entities, with state-of-the-art cryptography expectations.
We align findings to the 27001 family so your PQC work slots into an existing certification cycle rather than running beside it.
Germany's BSI and France's ANSSI publish their own migration guidance and timelines; we map exposure to the regime that governs you.
The organisation. The quantakrypto certificate attests to your post-quantum readiness posture at a point in time, scoped to the systems we assessed.
Yes. Scoping & discovery is always a separate, paid engagement. It delivers a scope document and indicative pricing so you can decide on the full audit with real information.
We assess against the finalised NIST standards and align to the ISO 27001 family, DORA, and NIS2. You get credibility today without waiting for a dedicated PQC accreditation scheme.
No — and we say so on every certificate. An assessment is point-in-time. The annual renewal keeps your posture current as standards and libraries move.
Book a paid discovery call and leave with a scope and indicative pricing.