Comprehensive post-quantum cryptography preparedness assessment
The Quantum Readiness Scoring System evaluates a system's preparedness for the post-quantum cryptography (PQC) era. Using a comprehensive 100-point scale, it assesses hardware capabilities, operating system support, cryptographic libraries, and network readiness to provide actionable insights and upgrade recommendations.
Quantum readiness assessment is only available during local mode scans (-mode local). It can be disabled with the -disable-quantum-readiness flag.
Mission-critical systems (domain controllers, CAs, HSMs).
Score <85 → ×0.90 penalty applied.
High-importance systems (application servers, web servers).
Score <75 → ×0.95 penalty applied.
Standard business systems with normal security needs.
No score adjustment applied.
Certain system characteristics result in automatic score reductions or caps, reflecting fundamental incompatibilities with post-quantum cryptography requirements.
Assessment returns immediately with overall score 0 and status "Not Ready". Cannot support PQC key sizes or operations.
Earns 0 points for the memory component only (up to 10 pts lost). The overall assessment continues; the system is not hard-blocked.
10% penalty applied to overall score for mission-critical systems (domain controllers, CAs) that have not yet reached the critical threshold.
5% penalty applied to overall score for high-importance systems (application servers, web servers) below the target threshold.
# Enable quantum readiness assessment (default in local mode)
./certscanner -mode local -output report.json
# Disable quantum readiness assessment
./certscanner -mode local -disable-quantum-readiness -output report.json
# View quantum assessment in different formats
./certscanner -mode local -outputformat json -output quantum.json
./certscanner -mode local -outputformat tychon -output quantum.ndjson
./certscanner -mode local -outputformat html -output quantum.htmlquantum_readiness field in scan reportquantum.* fields in all events{
"quantum_readiness": {
"assessment_id": "qr_20250915_101539_abc123",
"timestamp": "2025-09-15T10:15:39.123456-07:00",
"assessment_type": "workstation",
"overall_score": 65,
"max_possible_score": 100,
"readiness_status": "Update Required",
"status_color": "orange",
"hardware_score": {
"total_score": 32,
"total_max_score": 40,
"cpu_score": 18,
"cpu_max_score": 20,
"memory_score": 14,
"memory_max_score": 15,
"security_hw_score": 0,
"security_hw_max_score": 5
},
"operating_system_score": {
"total_score": 15,
"total_max_score": 30,
"os_version_score": 12,
"os_version_max_score": 20,
"crypto_api_score": 3,
"crypto_api_max_score": 10
},
"crypto_library_score": {
"total_score": 12,
"total_max_score": 25,
"openssl_score": 8,
"openssl_max_score": 15,
"system_crypto_score": 4,
"system_crypto_max_score": 10
},
"network_score": {
"total_score": 6,
"total_max_score": 6,
"bandwidth_score": 3,
"bandwidth_max_score": 3,
"protocol_score": 3,
"protocol_max_score": 3
},
"recommendations": [
"Upgrade to macOS 15.0+",
"Update OpenSSL to 3.4.0+"
]
}
}In addition to the system-level 0–100 score, each TLS port, application, and the overall system receives a letter grade (A+ through F) derived from what the scanner observes on the wire: TLS protocol, key exchange, certificate, and cipher suite quality.
| Grade | Score | Meaning |
|---|---|---|
| A+ | 98–100 | CNSA 2.0 compliant — ML-KEM-1024 + post-quantum cert + TLS 1.3. |
| A | 85–97 | Quantum ready — PQC KEX present (ML-KEM-768 or hybrid), strong cert. |
| B | 70–84 | Best achievable with classical-only crypto — TLS 1.3 + X25519 + good cert. |
| C | 50–69 | Moderate risk — TLS 1.2 + ECDHE or weak cert. |
| D | 30–49 | Significant risk — RSA KEX, old TLS, or poor cert. |
| F | 0–29 | Critical — broken ciphers, TLS 1.0/1.1 primary, very weak RSA. |
Design intent: An A grade is unreachable without actual PQC key exchange. TLS 1.3 + ML-KEM-768 + any reasonable cert (RSA-2048+) guarantees a minimum A. A+ requires CNSA 2.0 key sizes (ML-KEM-1024).
| Component | Max Points | Key Rules |
|---|---|---|
| Protocol Level | 20 | TLS 1.3 = 20; TLS 1.2 = 10; TLS 1.1 = 3; TLS 1.0 = 1. Deduct −3 if TLS 1.1 in supported list; −5 if TLS 1.0. |
| Primary Key Exchange | 35 | ML-KEM-1024 hybrid = 35; ML-KEM-768 hybrid = 32; ML-KEM-1024 only = 33; ML-KEM-768 only = 30; ML-KEM-512 = 25; X25519/X448 = 20; secp384r1/P-521 = 18; secp256r1 = 17; RSA (no ephemeral) = 5. |
| Certificate Public Key | 20 | ML-DSA/SLH-DSA/FALCON = 20; EC P-384+/P-521/Ed448 = 17; EC P-256/Ed25519 = 16; RSA-4096 = 15; RSA-3072 = 13; RSA-2048 = 12; RSA-1024 = 3. |
| Signature Hash | 10 | SHA-512/SHA-384 = 10; SHA-256 = 8; SHA-1 = 2; MD5 = 0; unknown = 5. |
| Cipher Suite Quality | 15 | Start 15. AES-128-GCM = −1; CBC mode = −4; broken (RC4/DES/3DES/NULL) = −8; any insecure in supported list = −3; weak cipher = −1. Floor at 0. |
Applied post-sum; can push score below a grade threshold. Floor at 0.
| Condition | Deduction |
|---|---|
| Certificate is expired | −10 pts |
| Certificate is self-signed | −5 pts |
| Certificate validity > 5 years | −8 pts |
| Certificate validity > 3 years | −5 pts |
OperatingSystemScore| Configuration | Max Score | Grade |
|---|---|---|
| Classical only — TLS 1.3 + X25519 + Ed25519 + SHA-384 + AES-256 | 83 | B |
| TLS 1.3 + ML-KEM-768 only + RSA-2048 + SHA-256 + AES-256 | 85 | A |
| TLS 1.3 + ML-KEM-768 hybrid + ML-DSA cert + perfect | 97 | A |
| TLS 1.3 + ML-KEM-1024 only + ML-DSA cert + perfect | 98 | A+ |
| TLS 1.3 + ML-KEM-1024 hybrid + ML-DSA cert + perfect | 100 | A+ |