Tools guides

A cryptographic inventory is a complete, current map of every algorithm, key, certificate, protocol, and library in your estate, plus where each is used and what data it protects. Why it is the mandatory first step of any PQC migration, how to build one, and how CBOM keeps it alive instead of stale.

How to turn on hybrid post-quantum key exchange (X25519MLKEM768), why modern stacks may already have it, the config that silently disables it, and the middlebox failure to expect.

The practical hunt for RSA, Diffie–Hellman, and elliptic-curve schemes across source, dependencies, certificates, and live traffic: what actually counts as vulnerable, the detection methods, their blind spots, and how findings converge into one machine-readable inventory.

The concrete patterns that make an algorithm a replaceable component: runtime negotiation, a provider abstraction, config-driven selection, self-describing versioned formats, size-agnostic storage, and automated rotation. The engineering behind agility, not the argument for it.

Regulators publish dated deadlines for retiring classical cryptography; most CI gates only catch new findings. How a policy-as-code mandate gate evaluates your whole estate against CNSA 2.0 or NIST IR 8547's calendar (warning after the deprecate date, failing after the disallow date), and why a regulatory deadline cannot be baselined away.

A QuantaKrypto attestation is a post-quantum-signed, independently checkable record of a project's cryptographic posture. It is what turns the self-reported score in a crypto-agility.json manifest into evidence. Here is what it contains, how it is signed, and the exact steps to verify one yourself, without trusting us.