Readiness Pack Module 05
Cryptographic Inventory / Post-Quantum Cryptography (PQC) Readiness Pack
File In. Recommended Sequence Out.
Send a redacted, unclassified listing of TLS, certificates, PKI, VPN, SSH, code-signing, HSM or KMS product versions, and application crypto libraries. You get the recommended migration sequence. The Cryptographic Bill Of Materials is the input. If the file cannot leave the source, use the Evidence Pack on your computer. Send versions, not keys.
Sources We Inventory
- TLS Endpoints And Cipher Suites
- Certificate And PKI Inventories
- VPN / SSH / IKE Configurations
- Code-Signing And Firmware-Signing Stores
- HSM / KMS Product Versions (Not Key Material)
- Application Crypto Libraries
Standards The Sequence Uses
- NIST FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA
- LMS / XMSS For Firmware Signing; NSS Sets ML-KEM-1024 And ML-DSA-87
What You Send And Get
Send: A redacted, unclassified listing of protocols, libraries, certificates, HSM/KMS product versions, VPN/SSH, and code-signing. Mark sensitivity and NSS only if you want those factors used. Send versions, not keys. If the file cannot leave the source, use the Evidence Pack on your computer.
Get: Recommended migration sequence, phase view (2030 key establishment, 2031 signatures, 2035 for what remains), Cryptographic Bill Of Materials, exposure register, gap list, refuse list, one-page narrative, and cover hash — packaged as a Readiness Pack.
You get a roadmap you can attach to the plan. You do not get an authorization, a product name, or a filed OMB plan. Send versions, not keys. If you want a module built, that is a separate trade study.
The sequence uses published rules: the deadline, the migration class, sensitivity only when you provide it, and whether a vendor path is published.
Portable — a published FIPS 203 / 204 / 205 path.
Rewrite — RSA or ECC that must move.
Blocked — no published vendor path, or the path cannot be determined from this listing.
Rows with no determinable path are flagged for an analyst. They are not guessed.
If the file cannot leave your computer, use the Evidence Pack there.
Send a redacted unclassified listing. Do not include CUI, live keys, private key material, or unmarked program files. If you cannot redact the file, use the Evidence Pack on your computer. That pack stays with you.
Open-Source Stack Snapshot
You name the library and the version. We refresh that snapshot for a small firm-fixed price. There is nothing to subscribe to.
| Stack | ML-KEM (FIPS 203) | ML-DSA (FIPS 204) | SLH-DSA (FIPS 205) |
|---|---|---|---|
| liboqs | Published integration path | Published integration path | Published integration path |
| oqs-provider | Experimental on the named OpenSSL build | Experimental on the named OpenSSL build | Experimental on the named OpenSSL build |
| OpenSSL | Hybrid or provider — name the version | Hybrid or provider — name the version | Version-dependent |
| wolfSSL | Commercial build path — name the version | Commercial build path — name the version | Version-dependent |
The row sample shows how a listing is tagged. The sequence is what you buy. If the file cannot leave your computer, use the Evidence Pack there.
Request An Unclassified ListingTry The Row SampleOpen Evidence Pack