Laboratorios Preflight Audit
Preparación poscuántica y criptoagilidad
Preflight evalúa la preparación para la migración frente a los estándares poscuánticos NIST finalizados y requisitos controlados de criptoagilidad. Un resultado de preparación no significa automáticamente que un producto sea resistente a la computación cuántica, validado por NIST, certificado o acreditado.
Estado actual de implementación
Los controles de preparación cuántica están implementados; las afirmaciones de producto siguen condicionadas por la evidencia.
The Validation Suite contains cryptographic inventory, exact repository/commit/scope binding, source-byte evidence binding, harvest-now-decrypt-later analysis, crypto-agility controls, immutable PQ implementation/test evidence binding, strict hybrid validation and fail-closed public-claim checks. Each product still requires an exact scoped assessment of its real cryptographic dependencies and deployed implementation.
Cryptographic inventory
Enumerates public-key, symmetric, hash, signing, key-establishment and protocol dependencies before any product-level quantum claim is considered. Duplicate asset identities fail closed.
Exact repository scope binding
Repository-derived readiness is bound to owner/repository, the exact 40-character Git commit SHA and a full SHA-256 repository-scope digest. That binding is carried into the evidence payload so a result cannot be silently replayed as evidence for a different code revision or scope.
Source-byte evidence binding
Crypto-inventory v2 derives a normalized path-set digest and an aggregate SHA-256 digest over the exact text bytes actually scanned. Same-finding source changes therefore create different inventory and repository-readiness evidence. Sensitive key and credential contents are never inspected or content-hashed.
Harvest-now-decrypt-later analysis
Flags confidentiality-relevant classical public-key dependencies when data may remain valuable beyond the planned migration horizon.
Crypto-agility controls
Requires algorithm policy, replacement mechanisms, key/certificate rotation, protocol versioning, explicit algorithm-negotiation policy, downgrade protection, key separation, dependency monitoring, migration-test coverage, rollback and evidence traceability.
PQC implementation evidence
Post-quantum implementation readiness requires immutable SHA-256 references binding the exact implementation and its test evidence, plus a controlled reviewer role. Algorithm names or symbolic evidence labels alone cannot produce a passing result.
Strict hybrid validation
A classical + PQ declaration is only a hybrid candidate. Hybrid-ready status additionally requires exact component binding, immutable implementation/test digests, an identified combination mode, controlled reviewer role, downgrade-resistance validation and component-separation validation.
Evidence-bounded claims
Blocks unsupported quantum-ready, quantum-resistant, quantum-safe, quantum-secure, quantum-proof, quantum-protected, PQC-ready, PQC-compliant, NIST-validated and similar claims when the exact scope and evidence do not support them.
External validation boundary
Readiness and interoperability testing do not create CAVP, CMVP, NVLAP, FIPS or other external validation, certification or accreditation status.
Línea base poscuántica NIST seguida por Preflight
Los estándares finalizados se mantienen separados de algoritmos aún en estandarización o de vías de validación específicas de programas.
FIPS 203
ML-KEM
Key encapsulation
ML-KEM-512 / 768 / 1024
FIPS 204
ML-DSA
Digital signatures
ML-DSA-44 / 65 / 87
FIPS 205
SLH-DSA
Stateless hash-based signatures
Standardized SLH-DSA parameter sets
Diseñado para fallar de forma cerrada.
If repository-derived evidence is missing its exact repository, commit, full SHA-256 scope binding, v2 scanner report binding or aggregate scanned-source binding—or if a cryptographic dependency is unknown, duplicated, classical-only and quantum-vulnerable, an unvalidated hybrid candidate, missing immutable PQ/hybrid implementation and test evidence, or outside the declared assessment scope—Preflight will not permit an evidence-backed repository quantum-readiness result. Hybrid candidates must also prove exact component binding, downgrade resistance and component separation. Absolute product-level quantum claims remain separately authorization-gated, and external validation wording requires a real external grant for the exact scope.