Cryptographic inventory
Discovery across source, binaries, network endpoints, key stores and suppliers, delivered as a CycloneDX CBOM.
2026ASD milestone: PQC transition plan by year end
Post-quantum migration and PKI engineering.
- Focus
- PQC · PKI · Crypto-agility
- Standards
- FIPS 203 · 204 · 205
- Frameworks
- ASD ISM · PSPF · CPS 234
- Method
- ASD LATICE
Why now
The dates are set.
2024
NIST · Standards
FIPS 203, 204 and 205 published: ML-KEM, ML-DSA and SLH-DSA.
2026
ASD · Plan
A refined transition plan in place. The ISM requires one (ISM-2073).
2028
ASD · Start
Transition under way, critical systems first.
2030
ASD · Complete
RSA, DH, ECDH and ECDSA no longer approved. Nor ML-KEM-768, ML-DSA-65, AES-128/192 or SHA-256.
2035
NIST · Disallowed
IR 8547 disallows quantum-vulnerable public-key algorithms.
Harvest now, decrypt later
Data with a long confidentiality lifetime is already exposed.
01
Capture
Encrypted traffic is copied off the wire today.
02
Store
The ciphertext is kept for as long as it takes.
03
Decrypt
A quantum computer breaks the RSA or ECDH key exchange and the session keys fall out.
Services
From inventory to cut-over.
PQC transition planning
A transition plan that satisfies ISM-2073: findings ranked by data lifetime and exposure, sequenced and costed.
PKI architecture
CA hierarchy design and review, HSM integration, CP/CPS, and certificate lifecycle automation.
Vendor PQC assurance
Supplier assessments using the ASD, NSA and CISA post-quantum vendor questions, and PQC clauses for procurement.
Migration engineering
ML-KEM-1024 and ML-DSA-87 in TLS 1.3, SSH, IPsec and code signing, with interoperability testing.
Compliance & assurance
Control mapping to the ASD ISM, PSPF and APRA CPS 234, with evidence an assessor can verify.
Approach
Built on ASD's LATICE framework.
- L
Locate
Find the traditional asymmetric cryptography across code, network, endpoints, cloud and suppliers.
→ Cryptographic inventory
- A
Assess
Weigh each finding by the sensitivity and lifetime of what it protects.
→ Risk-ranked findings
- T
Triage
Sequence the work: critical systems first, then dependencies and vendor timelines.
→ Transition plan
- I
Implement
Deploy ML-KEM-1024 and ML-DSA-87, update PKI, test interoperability, cut over.
→ Migrated systems
C · ECommunicate and educateRuns through every phase: executives, system owners, vendors and staff.
Know what you have
Migration starts with an inventory.
cbom / sample-findings6 of 8 need work
| Asset | Usage | Algorithm | Status |
|---|---|---|---|
| api.example.com | TLS 1.3 | ECDHE P-256 | Not approved after 2030 |
| Issuing CA G2 | X.509 | RSA-2048 | Not approved after 2030 |
| build-signer | Code signing | ECDSA P-384 | Not approved after 2030 |
| vpn-gw-01 | IKEv2 | DH Group 14 | Not approved after 2030 |
| records-archive | At rest | AES-128-GCM | Transitional |
| edge.example.com | TLS 1.3 | X25519MLKEM768 | Transitional |
| Root CA G3 | X.509 | ML-DSA-87 | ISM-aligned |
| vpn-gw-02 | IKEv2 | ML-KEM-1024 | ISM-aligned |
Not approved after 2030 · 4Transitional · 2ISM-aligned · 2Illustrative excerpt, assessed against the ASD ISM.
Standards we work with
- ML-KEM-1024 · ML-DSA-87
ASD ISM
Long-term parameter sets
- FIPS 203
ML-KEM
Key encapsulation
- FIPS 204
ML-DSA
Digital signatures
- FIPS 205
SLH-DSA
Hash-based signatures
- SP 800-208
LMS / XMSS
Firmware & code signing
- 2030 · 2035
NIST IR 8547
Deprecation and disallowance dates
- CycloneDX 1.6
CBOM
Cryptographic inventory
On the wire
Same protocols, bigger messages. Which is why migration needs testing, not just configuration.
ClientTLS 1.3Server
- ClientHello1,568 B
ML-KEM-1024 encapsulation key
- ServerHello1,568 B
ML-KEM-1024 ciphertext
- Shared secret32 B
derived on both sides
- CertificateVerify4,627 B
ML-DSA-87 signature
- Application data
AES-256-GCM
Bytes on the wire
- Key share49×
- X2551932 BML-KEM-10241,568 B
- Signature48×
- ECDSA P-38496 BML-DSA-874,627 B
- Public key27×
- ECDSA P-38497 BML-DSA-872,592 B
FAQ
Common questions.
Contact
Talk to us.
Tell us what you're working on and we'll reply by email.