How to Scan Your Codebase for Quantum-Vulnerable Cryptography (Free Open Source Tool)

#opensource #security #cybersecurity #showdev

If your codebase uses RSA, ECC, DSA, or ECDSA, it is already vulnerable to quantum computers. Adversaries are collecting encrypted traffic today under the "harvest now, decrypt later" strategy. I built an open-source tool called Quantum Migration Toolkit that scans your entire codebase for quantum-vulnerable cryptography and automatically remediates it.

Why You Need to Act Now

Large-scale quantum computers will break RSA, ECC, DSA, and ECDSA via Shor's algorithm. Three major regulations are already in effect:

U.S. OMB M-23-02 / NSM-10 — federal agencies must inventory quantum-vulnerable systems
NSA CNSA 2.0 — mandates ML-KEM and ML-DSA for National Security Systems by 2030–2035
EU NIS2 — requires quantum risk assessment for critical infrastructure

NIST finalized three post-quantum cryptography standards in 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). Migration starts now.

What Quantum Migration Toolkit Does

Scans 9+ languages using regex + Tree-sitter AST
Detects RSA, ECC, DSA, DES, RC4, MD5, SHA-1, weak RNG, hardcoded secrets — 18 total patterns
Remediates findings with a local AI model grounded in real PQC API definitions
Vendors a working ML-KEM + ML-DSA + AES-256-GCM SDK into your project
Patches your build system automatically — CMake, pip, Cargo, Maven, Gradle, Go, NPM
Outputs SARIF 2.1.0 for CI/CD and CycloneDX 1.6 CBOM for cryptographic asset inventory

Installation

Prerequisites

C++17 compiler (GCC 7+, Clang 5+, MSVC 2019+)
CMake 3.18+
OpenSSL 3.0+

Build on Linux/macOS

git clone https://github.com/Savaid-Khan-Official/Quantum-Migration-Toolkit.git
cd Quantum-Migration-Toolkit
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel

First-time build fetches and compiles liboqs in about 5–10 minutes. Subsequent builds take seconds.

Running Your First Scan

./build/cli/quantum-migrate /path/to/your/code

Output looks like this:

[CRITICAL] VULN-RSA-001 — crypto/auth.cpp:42
  RSA_generate_key_ex(rsa, 2048, e, NULL)
  Migrate to: ML-KEM-768 (FIPS 203)

[CRITICAL] VULN-ECC-001 — src/tls.py:17
  EC_KEY_generate_key(eckey)
  Migrate to: ML-DSA-65 (FIPS 204)

[HIGH] VULN-MD5-001 — utils/hash.go:8
  md5.New()
  Migrate to: SHA-256

For a full scan with entropy detection and CI/CD output:

./build/cli/quantum-migrate /path/to/code --entropy --proximity --format=sarif --output=results.sarif --fail-on=critical

AI-Assisted Remediation

./build/cli/quantum-migrate /path/to/code \
  --remediate \
  --model models/qwen2.5-coder-14b-instruct-q4_k_m.gguf \
  --vendor-into /path/to/code \
  --patch-build-system \
  --backup

Recommended model is Qwen2.5-Coder-14B-Instruct Q4_K_M (~9 GB). The tool injects real PQC API signatures into every prompt — this eliminates hallucinated function names that plague generic LLM rewrites.

Add --apply to write fixes directly to source. Every modified file is backed up and compile-checked — if it fails to compile it rolls back automatically.

Real-World Performance

Tested across five real open-source projects totaling 7,409 files:

Project	Findings	Scan Time
OpenSSH-portable v9.8p1	128	5.3s
PyCryptodome v3.20.0	272	7.3s
Bouncy Castle v1.78	1,079	51.8s
rustls 0.23.21	16	3.2s
libssh2 1.11.1	165	2.1s

Hand-labeled precision on OpenSSH: 96.9% — 124 out of 128 findings were true positives.

Migration Targets

Vulnerable Algorithm	Replace With
RSA encryption / key exchange	ML-KEM-768 (FIPS 203)
RSA signatures, DSA, ECDSA	ML-DSA-65 (FIPS 204)
Long-lived signatures	SLH-DSA / SPHINCS+ (FIPS 205)
DES, 3DES, RC4, ECB	AES-256-GCM
MD5, SHA-1, SHA-224	SHA-256 / SHA-3
Weak RNG	OS CSPRNG

Try It on the Test Repo

./build/cli/quantum-migrate test_repo/ --entropy --proximity --output=audit.txt

Expected output is 36–42 findings across C++, Python, Java, Go, Rust, and JavaScript. Good way to see exactly what it looks like before scanning your own code.