{"limits":{"max_files":1000,"max_request_bytes":900000},"notice":"Pattern-based scan: a starting point for manual review, not an audit, a proof or a certification. Cryptography reached through opaque dependencies is invisible to it.","rules":[{"description":"Broken by Shor's algorithm on a large quantum computer: the private key is recoverable from public data.","family":"rsa","name":"RSA","recommendation":"Signatures: ML-DSA-87 (FIPS 204). Encryption and key transport: ML-KEM-1024 (FIPS 203).","rule_id":"vantax/rsa","severity":"CRITICAL"},{"description":"Broken by Shor's algorithm on a large quantum computer: the private key is recoverable from public data.","family":"dsa","name":"DSA","recommendation":"Sign with ML-DSA-87 (NIST FIPS 204). Where the protocol still requires this signature, add an ML-DSA-87 attestation next to it (hybrid mode), then retire the classical path.","rule_id":"vantax/dsa","severity":"CRITICAL"},{"description":"Key exchange broken by Shor's algorithm: recorded traffic can be decrypted later (harvest now, decrypt later).","family":"ffdh","name":"Finite-field Diffie-Hellman","recommendation":"Use ML-KEM-1024 (NIST FIPS 203) for key establishment, or hybrid X25519 + ML-KEM during the transition.","rule_id":"vantax/ffdh","severity":"CRITICAL"},{"description":"Broken by Shor's algorithm on a large quantum computer: the private key is recoverable from public data.","family":"elgamal","name":"ElGamal","recommendation":"Use ML-KEM-1024 (NIST FIPS 203) for key establishment, or hybrid X25519 + ML-KEM during the transition.","rule_id":"vantax/elgamal","severity":"CRITICAL"},{"description":"Broken by Shor's algorithm on a large quantum computer: the private key is recoverable from public data.","family":"ecdsa","name":"ECDSA / elliptic-curve keys","recommendation":"Sign with ML-DSA-87 (NIST FIPS 204). Where the protocol still requires this signature, add an ML-DSA-87 attestation next to it (hybrid mode), then retire the classical path.","rule_id":"vantax/ecdsa","severity":"CRITICAL"},{"description":"The Bitcoin and Ethereum curve. Broken by Shor's algorithm: any public key exposed on-chain reveals its private key to a large quantum computer.","family":"secp256k1","name":"secp256k1","recommendation":"Sign with ML-DSA-87 (NIST FIPS 204). Where the protocol still requires this signature, add an ML-DSA-87 attestation next to it (hybrid mode), then retire the classical path.","rule_id":"vantax/secp256k1","severity":"CRITICAL"},{"description":"Broken by Shor's algorithm on a large quantum computer: the private key is recoverable from public data.","family":"nist-p-curves","name":"NIST P-curves (P-256, P-384, P-521)","recommendation":"ML-DSA-87 for signatures; ML-KEM-1024 for key agreement.","rule_id":"vantax/nist-p-curves","severity":"CRITICAL"},{"description":"Broken by Shor's algorithm on a large quantum computer: the private key is recoverable from public data.","family":"brainpool","name":"Brainpool curves","recommendation":"ML-DSA-87 for signatures; ML-KEM-1024 for key agreement.","rule_id":"vantax/brainpool","severity":"CRITICAL"},{"description":"Broken by Shor's algorithm on a large quantum computer: the private key is recoverable from public data.","family":"sm2","name":"SM2","recommendation":"ML-DSA-87 for signatures; ML-KEM-1024 for key agreement.","rule_id":"vantax/sm2","severity":"CRITICAL"},{"description":"Solana, many wallets and SSH keys sign with Ed25519. Broken by Shor's algorithm on a large quantum computer.","family":"ed25519","name":"Ed25519 / EdDSA","recommendation":"Sign with ML-DSA-87 (NIST FIPS 204). Where the protocol still requires this signature, add an ML-DSA-87 attestation next to it (hybrid mode), then retire the classical path.","rule_id":"vantax/ed25519","severity":"CRITICAL"},{"description":"Broken by Shor's algorithm on a large quantum computer: the private key is recoverable from public data.","family":"ed448","name":"Ed448","recommendation":"Sign with ML-DSA-87 (NIST FIPS 204). Where the protocol still requires this signature, add an ML-DSA-87 attestation next to it (hybrid mode), then retire the classical path.","rule_id":"vantax/ed448","severity":"CRITICAL"},{"description":"Key exchange broken by Shor's algorithm: recorded traffic can be decrypted later (harvest now, decrypt later).","family":"x25519-ecdh","name":"X25519 / ECDH key exchange","recommendation":"Use ML-KEM-1024 (NIST FIPS 203) for key establishment, or hybrid X25519 + ML-KEM during the transition.","rule_id":"vantax/x25519-ecdh","severity":"CRITICAL"},{"description":"Key exchange broken by Shor's algorithm.","family":"x448","name":"X448","recommendation":"Use ML-KEM-1024 (NIST FIPS 203) for key establishment, or hybrid X25519 + ML-KEM during the transition.","rule_id":"vantax/x448","severity":"CRITICAL"},{"description":"Bitcoin Taproot and other Schnorr signatures are broken by Shor's algorithm.","family":"schnorr","name":"Schnorr / BIP-340","recommendation":"Sign with ML-DSA-87 (NIST FIPS 204). Where the protocol still requires this signature, add an ML-DSA-87 attestation next to it (hybrid mode), then retire the classical path.","rule_id":"vantax/schnorr","severity":"CRITICAL"},{"description":"Polkadot-style Schnorr signatures over Ristretto255. Broken by Shor's algorithm.","family":"sr25519","name":"sr25519 / Ristretto","recommendation":"Sign with ML-DSA-87 (NIST FIPS 204). Where the protocol still requires this signature, add an ML-DSA-87 attestation next to it (hybrid mode), then retire the classical path.","rule_id":"vantax/sr25519","severity":"CRITICAL"},{"description":"BLS signatures, KZG commitments and Groth16 proofs rely on pairing-friendly curves, all broken by Shor's algorithm.","family":"pairing-bls","name":"Pairing-based (BLS12-381, BN254)","recommendation":"No standardized post-quantum drop-in exists for pairing-based aggregation or SNARKs. Inventory where they are used and track the protocol's migration path (hash-based or lattice-based alternatives).","rule_id":"vantax/pairing-bls","severity":"CRITICAL"},{"description":"Grover's algorithm square-roots brute-force cost. NIST still rates AES-128 as post-quantum category 1, but long-lived secrets deserve more margin.","family":"aes-128","name":"128-bit symmetric keys (AES-128)","recommendation":"Prefer AES-256 for data that must stay confidential for decades.","rule_id":"vantax/aes-128","severity":"LOW"},{"description":"Weak today, without a quantum computer: 56-bit DES is brute-forceable and NIST retired 3DES in 2023.","family":"des-3des","name":"DES / 3DES","recommendation":"Replace with AES-256-GCM or ChaCha20-Poly1305.","rule_id":"vantax/des-3des","severity":"HIGH"},{"description":"Broken or deprecated ciphers, unsafe today without a quantum computer.","family":"rc4-legacy","name":"RC4 / RC2 / Blowfish","recommendation":"Replace with AES-256-GCM or ChaCha20-Poly1305.","rule_id":"vantax/rc4-legacy","severity":"HIGH"},{"description":"Practical collision attacks exist today. Not a quantum issue, but unsafe for signatures and integrity. (HMAC-SHA1 is not broken, but should not appear in new designs.)","family":"md5-sha1","name":"MD5 / SHA-1","recommendation":"Use SHA3-256/512 or SHA-256/512.","rule_id":"vantax/md5-sha1","severity":"HIGH"}]}