QuantumSafe

Scan your code for the encryption quantum computers will break, score it 0–100, and get the NIST-approved replacement for every finding — free & open source.

Live demo  ·  Install  ·  Documentation  ·  How it works  ·  Report a bug

QuantumSafe scans code across 11 languages for the cryptography that quantum computers will break (RSA, ECC, Diffie-Hellman) or weaken (AES-128, SHA-256), scores the risk 0–100, and maps every finding to its NIST FIPS 203/204/205 replacement — backed by a real Qiskit implementation of Shor's and Grover's algorithms and a from-scratch lattice (LWE) key-encapsulation mechanism.

⚠️ Disclaimer. QuantumSafe is a security-awareness and triage tool. It uses static pattern + AST analysis and is not a substitute for a professional cryptographic audit. Findings are heuristic and may include false positives/negatives.

---

The three layers

QuantumSafe covers the full arc of the post-quantum problem — not just naming it, but executing the attack, finding the vulnerable code, and running the solution:

Layer	Module	What it does
1. Attack	quantum/	Shor's and Grover's algorithms in Qiskit, run on a quantum simulator. At simulator scale Shor factors a small number and reconstructs a toy RSA key — an educational demonstration of why RSA/ECC are rated HIGH (not a break of real key sizes).
2. Detection	cli/	A hybrid AST + regex static-analysis engine over 11 languages, with cross-language usage-awareness, dependency + lockfile scanning, reachability ranking, and call-site-specific fixes, that scores risk and produces a NIST-aligned migration plan. 100% precision on the labeled benchmark (18 files), 100% recall on 50 seeded cases, and 93% precision (95% CI 86–97%) on a random, hand-labeled sample of 100 findings in real PyPI packages — see methodology and real-code precision.
3. Fix	pqc/	A from-scratch lattice (LWE) key-encapsulation mechanism — the math behind CRYSTALS-Kyber / ML-KEM — so the recommended fix is runnable and provable.

The detection layer ships through three surfaces that share one engine:

• A free CLI (pip install quantumsafe-scan) — scan local dirs or public GitHub repos (and their dependency manifests); export JSON / HTML / SARIF / CBOM / SVG badge.
• A Flask REST API — powers the dashboard, ingests scans, handles auth.
• A dark, terminal-style web dashboard — scan history, findings, migration plans, and exports. Free, no paywall.

---

Why it matters

RSA-2048 and elliptic-curve crypto secure almost everything — HTTPS/TLS, certificates, SSH, code signing, VPNs. Shor's algorithm breaks all of it. The math is settled; only the hardware is missing (RSA-2048 needs millions of error-corrected qubits, and today's machines have a few hundred noisy ones).

That gap is the reason to act now, not later:

• "Harvest now, decrypt later": an adversary can record encrypted traffic today and decrypt it once the hardware exists. Anything that must stay secret for 5–15 years is effectively at risk now.
• Migration is slow: swapping cryptography across a large codebase takes years — which is why NIST finalized the post-quantum standards (FIPS 203/204/205) in 2024.

QuantumSafe makes that migration tractable: find the vulnerable crypto, understand why it's vulnerable, and adopt the quantum-safe replacement.

---

Architecture

One shared detection engine (cli/) sits behind three surfaces — the CLI, the REST API, and the web dashboard — and is flanked by two runnable companions: the quantum/ attack module (which justifies the risk ratings) and the pqc/ defense module (which implements the recommended fix). Full write-up in docs/ARCHITECTURE.md; the diagram is regenerated by python docs/make_architecture.py (vector source: docs/architecture.svg).

Documentation

Document	What's in it
docs/WHITEPAPER.md	Full technical whitepaper: threat model, design, scoring, evaluation, limitations, future work
docs/ARCHITECTURE.md	Components, the CLI→API→Scanner→Risk→Export pipeline, data flow, deployment topology
docs/architecture_diagram.txt	One-screen ASCII system diagram
docs/EXAMPLES.md	Real scan output — terminal table, JSON, SARIF, HTML, badge
docs/NIST_MAPPING.md	Every detected family → its NIST PQC replacement, with the reasoning
docs/CVE_MAPPING.md	Findings mapped to general vulnerability classes (no invented CVEs)
benchmark/RESULTS.md	Precision/recall/F1, risk distribution, reproducible charts
TECHNICAL_OVERVIEW.md	Design decisions, quantum-threat background, honest limitations

---

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗