Post-quantum security
Inventory RSA/ECDSA exposure, quantify harvest-now-decrypt-later risk with Mosca's inequality, and prove hybrid ML-KEM TLS — the defense side of Q-Day.
Demo recording
Fixture scan, compliance report pack, Mosca assessment, and PQ TLS handshake appendix. Replace the recording URL with your Loom link when ready.
Loading command center…
1) Pick a scenario · 2) Run scan (fixture for recordings) · 3) Review Mosca HNDL risk · 4) Prove PQ handshake · 5) Export CBOM / PDF report
NSM-10 / NIST IR 8547 PQC migration program
API: https://sparkling-vibrancy-production-1a7a.up.railway.app
API gateway TLS
tls · api.regionalbank.example:443 · x25519
RSA-2048 key exchange/signing is harvest-now-decrypt-later exposed.
Customer auth TLS
tls · auth.regionalbank.example:443 · secp256r1
P-256 certificate is quantum-vulnerable under Shor.
OIDC JWKS RS256
jwks · auth.regionalbank.example:443
JWT signing keys must migrate before long-lived tokens expire.
Ops bastion SSH host key
ssh · bastion.regionalbank.example:22
SSH RSA host key should be rotated to PQ-safe algorithms.
