Laboratoires Preflight Audit
Préparation post-quantique et crypto-agilité
Preflight évalue la préparation à la migration selon les normes post-quantiques NIST finalisées et des exigences contrôlées de crypto-agilité. Un résultat de préparation ne signifie pas automatiquement qu’un produit est résistant au quantique, validé par le NIST, certifié ou accrédité.
État actuel de l’implémentation
Les contrôles de préparation quantique sont implémentés ; les déclarations produit restent conditionnées par les preuves.
The Validation Suite contains cryptographic inventory, exact repository/commit/scope binding, source-byte evidence binding, harvest-now-decrypt-later analysis, crypto-agility controls, immutable PQ implementation/test evidence binding, strict hybrid validation and fail-closed public-claim checks. Each product still requires an exact scoped assessment of its real cryptographic dependencies and deployed implementation.
Cryptographic inventory
Enumerates public-key, symmetric, hash, signing, key-establishment and protocol dependencies before any product-level quantum claim is considered. Duplicate asset identities fail closed.
Exact repository scope binding
Repository-derived readiness is bound to owner/repository, the exact 40-character Git commit SHA and a full SHA-256 repository-scope digest. That binding is carried into the evidence payload so a result cannot be silently replayed as evidence for a different code revision or scope.
Source-byte evidence binding
Crypto-inventory v2 derives a normalized path-set digest and an aggregate SHA-256 digest over the exact text bytes actually scanned. Same-finding source changes therefore create different inventory and repository-readiness evidence. Sensitive key and credential contents are never inspected or content-hashed.
Harvest-now-decrypt-later analysis
Flags confidentiality-relevant classical public-key dependencies when data may remain valuable beyond the planned migration horizon.
Crypto-agility controls
Requires algorithm policy, replacement mechanisms, key/certificate rotation, protocol versioning, explicit algorithm-negotiation policy, downgrade protection, key separation, dependency monitoring, migration-test coverage, rollback and evidence traceability.
PQC implementation evidence
Post-quantum implementation readiness requires immutable SHA-256 references binding the exact implementation and its test evidence, plus a controlled reviewer role. Algorithm names or symbolic evidence labels alone cannot produce a passing result.
Strict hybrid validation
A classical + PQ declaration is only a hybrid candidate. Hybrid-ready status additionally requires exact component binding, immutable implementation/test digests, an identified combination mode, controlled reviewer role, downgrade-resistance validation and component-separation validation.
Evidence-bounded claims
Blocks unsupported quantum-ready, quantum-resistant, quantum-safe, quantum-secure, quantum-proof, quantum-protected, PQC-ready, PQC-compliant, NIST-validated and similar claims when the exact scope and evidence do not support them.
External validation boundary
Readiness and interoperability testing do not create CAVP, CMVP, NVLAP, FIPS or other external validation, certification or accreditation status.
Référentiel post-quantique NIST suivi par Preflight
Les normes finalisées sont distinguées des algorithmes encore en normalisation ou relevant de parcours de validation propres à un programme.
FIPS 203
ML-KEM
Key encapsulation
ML-KEM-512 / 768 / 1024
FIPS 204
ML-DSA
Digital signatures
ML-DSA-44 / 65 / 87
FIPS 205
SLH-DSA
Stateless hash-based signatures
Standardized SLH-DSA parameter sets
Conçu pour échouer de manière fermée.
If repository-derived evidence is missing its exact repository, commit, full SHA-256 scope binding, v2 scanner report binding or aggregate scanned-source binding—or if a cryptographic dependency is unknown, duplicated, classical-only and quantum-vulnerable, an unvalidated hybrid candidate, missing immutable PQ/hybrid implementation and test evidence, or outside the declared assessment scope—Preflight will not permit an evidence-backed repository quantum-readiness result. Hybrid candidates must also prove exact component binding, downgrade resistance and component separation. Absolute product-level quantum claims remain separately authorization-gated, and external validation wording requires a real external grant for the exact scope.