Question 1

What is post-quantum cryptography (PQC)?

Accepted Answer

Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to be secure against attacks by quantum computers. NIST has standardized ML-KEM (FIPS 203) for key encapsulation, ML-DSA (FIPS 204) for digital signatures, and SLH-DSA (FIPS 205) for hash-based signatures as replacements for RSA, ECDSA, and other quantum-vulnerable algorithms.

Question 2

Which cryptographic algorithms are vulnerable to quantum computers?

Accepted Answer

RSA (all key sizes), ECDSA, Ed25519, ECDH, X25519, Diffie-Hellman, and DSA are all vulnerable to Shor's algorithm on quantum computers. Symmetric algorithms like AES-256, ChaCha20, and hash functions like SHA-256 remain quantum-resistant.

Question 3

How do I scan my code for quantum-vulnerable cryptography?

Accepted Answer

Run 'npx pqaudit .' in your project directory. pqaudit scans source code and dependencies for quantum-vulnerable algorithms, generates a CycloneDX Cryptographic Bill of Materials (CBOM), and recommends NIST-approved PQC replacements for each finding.

Question 4

When do organizations need to migrate to post-quantum cryptography?

Accepted Answer

NSA CNSA 2.0 mandates PQC for new national security systems by January 2027, with full migration required by 2033. Google has set a 2029 deadline for its own products. In March 2026, Google research showed quantum factoring requires 20x fewer qubits than previously estimated, accelerating the urgency.

Scan your code for quantum-vulnerable cryptography

Detect quantum-vulnerable algorithms in seconds

Scan codebases and dependencies

CycloneDX CBOM and SARIF output

NIST-approved migration guidance

The post-quantum migration window is closing

Find your quantum debt.