Post-quantum tools · FIPS 203, 204, 205
Ten tools. One migration path.
From finding your cryptography to replacing it. 2 tools are open to use on this site today and the migration tracker is a public demo. Of the rest, 5 are built and run in our own lab, and 2 are still being built; none is public yet.
Discover, rank, migrate, comply
Every tool, with its real status.
Algorithm Selector
Describe what you are protecting: TLS, firmware, code signing, key exchange. Get a NIST post-quantum algorithm with the source of every rule behind the choice. Same answers, same recommendation.
- ML-KEM-512 / 768 / 1024 (FIPS 203)
- ML-DSA-44 / 65 / 87 (FIPS 204)
- SLH-DSA (FIPS 205)
- Hybrid TLS group (RFC 10024)
- Example code tested with pyca/cryptography
Cryptographic Inventory
Scan your source code and find every cryptographic asset: keys, certificates, protocols, libraries. Outputs a machine-readable inventory with quantum risk scores per component.
- Python AST + dependency manifest + regex
- Standard crypto inventory format (CycloneDX)
- File and line for every finding
- Known gaps stated in metadata
Migration Board
How we report a post-quantum migration: every asset by status, and only assets with evidence count as migrated. Claims and exceptions never count as done.
- Public page: sample data for an invented organization
- Verified / claimed / in progress / not started / exception
- Our tracker: each status change is hash-chained to the one before
- Our tracker: verified is refused without an evidence reference
Store-Now-Break-Later Risk Score
Is data copied today still valuable when it can be decrypted? Enter how long it must stay secret, how long migration takes, and the horizon you plan against. If the first two add up to more than the third, it is exposed.
- Runs entirely in your browser
- Nothing you enter is sent or stored
- X + Y > Z exposure test per asset
- Default horizon ten years, adjustable
- Prospective, NOT active detection
Quantum Key Provenance
A signed certificate of where key material came from, checkable without contacting the issuer. Our quantum entropy source is not running today, so no quantum-origin certificate is issued.
- ML-DSA-87 signed (FIPS 204)
- Offline verification
- Refuses a quantum-origin claim without a quantum source
- PDF certificate export
- Not public
Regional Compliance Bridge
Map NIST post-quantum standards to LATAM regulator requirements (Costa Rica, Colombia, Mexico, Brazil, Chile). Curated knowledge base, never generates a regulation. Legal review flagged on every item.
- CR · CO · MX · BR · CL
- Gap / best-effort mapping only
- NOT legal advice, every item
- PDF report export
Secure Agent Sandbox
Run AI agents with per-agent keys and signed capability manifests, each agent in its own process; the gVisor sandbox is not wired yet. Deny-by-default, re-verified on every check. Automatic quarantine on missed heartbeat.
- ML-KEM-768 per-agent key pair
- Signed capability manifests
- Auto-quarantine (3 missed heartbeats)
- Process-level isolation (gVisor not wired)
Crypto-Agility Planner
Detect cryptographic pairs that must migrate together (sign/verify, encrypt/decrypt), order them dependency-first, and pick each replacement by what the cryptography does: a post-quantum standard for public keys, a stronger classical algorithm for hashes and small symmetric keys, and a question back when the use is unclear.
- Dependency-first migration grouping
- classical → hybrid → post-quantum-only phases
- Per-asset rollback (one phase)
- Maintenance-window planning
Key Management Service
Key management with post-quantum algorithms, using operations named and shaped after AWS KMS (CreateKey, GenerateDataKey, Encrypt, Decrypt, Sign); not a drop-in replacement for the AWS API. ML-KEM and ML-DSA key generation, symmetric keys from the system random generator, hash-chained audit log. Software-only.
- ML-KEM / ML-DSA / AES-256 key types
- Symmetric keys from the system CSPRNG
- Key rotation (versioned)
- FIPS-140 status: not validated (honest)
Quantum Hardware Connector
Translates circuits for several quantum hardware backends and estimates what a run would cost. It does not submit jobs yet.
- IBM · IonQ · Quantinuum · QuEra backends
- Pre-compile resource estimation
- Translation ≠ re-optimization (stated)
- No job submission yet
Using the tools that are not public
They come with an assessment.
The tools marked not public are what we run inside an engagement, against systems you authorize. We are looking for our first production deployment partners; scope and terms are agreed in conversation.