Inspect the output, including its boundaries.

# Post-Quantum Readiness Report

Prepared by Latticis MigrationOS from a read-only cryptographic discovery scan.

## Executive summary

- **27 cryptographic references** detected across **11 inspected files**.
- **17 (63.0%) were classified as quantum-vulnerable** and should enter review.
- **8 references need review** and **2 were classified as quantum-safe**.

This static inventory is the Cryptographic Bill of Materials (CBOM) used to plan and track post-quantum migration.

## Inventory by quantum risk

| Classification | Assets | Share |
|---|---:|---:|
| Quantum-vulnerable | 17 | 63.0% |
| Needs review | 8 | 29.6% |
| Quantum-safe | 2 | 7.4% |

## Highest-risk algorithm references detected

| Algorithm | Occurrences | Status | Migration guidance |
|---|---:|---|---|
| RSA | 6 | Quantum-vulnerable | Shor breakable. Migrate key exchange to ML-KEM (FIPS 203) and signatures to ML-DSA (FIPS 204). |
| X.509 certificate material | 4 | Quantum-vulnerable | Review the detected context, key size, protocol role, and migration target. |
| ECDSA | 4 | Quantum-vulnerable | Shor breakable. Migrate signatures to ML-DSA (FIPS 204). |
| AES | 2 | Needs review | Review the detected context, key size, protocol role, and migration target. |
| SHA-256 | 2 | Needs review | Review the detected context, key size, protocol role, and migration target. |
| HMAC | 2 | Needs review | Review the detected context, key size, protocol role, and migration target. |
| DSA | 1 | Quantum-vulnerable | Shor breakable and deprecated. Migrate signatures to ML-DSA (FIPS 204). |
| MD5 | 1 | Quantum-vulnerable | Cryptographically broken today. Replace with SHA-256, SHA-384, SHA-512, or SHA-3. |
| Legacy TLS/SSL configuration | 1 | Quantum-vulnerable | Review the detected context, key size, protocol role, and migration target. |
| Embedded secret / API-key reference | 1 | Needs review | Review the detected context, key size, protocol role, and migration target. |

## Risk-ranked findings

| Risk | Status | Algorithm | Location | Notes |
|---:|---|---|---|---|
| 0.88 | Quantum-vulnerable | RSA | services/policy-api/token-service.ts:7 | [redacted] |
| 0.77 | Quantum-vulnerable | RSA | infrastructure/main.tf:3 | [redacted] |
| 0.77 | Quantum-vulnerable | ECDSA | infrastructure/main.tf:8 | [redacted] |
| 0.77 | Quantum-vulnerable | ECDSA | infrastructure/main.tf:9 | [redacted] |
| 0.77 | Quantum-vulnerable | DSA | infrastructure/pqc-pilot.yaml:5 | [redacted] |
| 0.77 | Quantum-vulnerable | ECDSA | services/mobile-backend/push-signing.yaml:5 | [redacted] |
| 0.68 | Quantum-vulnerable | RSA | services/claims-service/callback_signer.py:9 | [redacted] |
| 0.68 | Quantum-vulnerable | MD5 | services/claims-service/callback_signer.py:17 | [redacted] |
| 0.67 | Quantum-vulnerable | X.509 certificate material | infrastructure/k8s-tls-secret.yaml:4 | [redacted] |
| 0.67 | Quantum-vulnerable | X.509 certificate material | infrastructure/k8s-tls-secret.yaml:7 | [redacted] |
| 0.67 | Quantum-vulnerable | X.509 certificate material | infrastructure/k8s-tls-secret.yaml:9 | [redacted] |
| 0.67 | Quantum-vulnerable | X.509 certificate material | infrastructure/k8s-tls-secret.yaml:10 | [redacted] |
| 0.67 | Quantum-vulnerable | RSA | infrastructure/main.tf:2 | [redacted] |
| 0.67 | Quantum-vulnerable | RSA | infrastructure/main.tf:7 | [redacted] |
| 0.67 | Quantum-vulnerable | RSA | infrastructure/main.tf:3 | [redacted] |

## Recommended next steps

1. Validate references classified as quantum-vulnerable, ordered by risk score.
2. Replace broken legacy primitives such as MD5, SHA-1, DES, 3DES, and RC4 immediately.
3. Add crypto-agility where static evidence indicates hard-coded algorithms.
4. For validated production contexts, plan key exchange migration to ML-KEM (FIPS 203) and signature migration to ML-DSA (FIPS 204).
5. Re-scan after each change to keep the CBOM current.

Scope note: this was a read-only static discovery scan. References were detected and classified; operational use was not verified. No keys were exercised, rotated, or modified.