# QShield — Comprehensive Technical & Compliance Reference (llms-full.txt) > Canonical URL: https://getqshield.com > Product Category: Post-Quantum Cryptography (PQC) Readiness Scanner, CycloneDX v1.6 CBOM Generator, DevSecOps AST & Binary Inspector, Live RFC 8446 TLS 1.3 Wire Prober. > Standards Supported: NIST FIPS 203 (ML-KEM), NIST FIPS 204 (ML-DSA), NIST FIPS 205 (SLH-DSA), NIST IR 8547 (2030 Deprecation), NSA CNSA 2.0, OMB M-23-02, CycloneDX v1.6 CBOM, OASIS SARIF v2.1.0, RFC 8446 TLS 1.3 (X25519MLKEM768 / IANA 0x11EC). --- ## 1. Executive Summary Organizations face two immediate pressures regarding Post-Quantum Cryptography (PQC): 1. **Harvest Now, Decrypt Later (HNDL)**: State-sponsored and commercial adversaries are actively recording classical TLS 1.2/1.3 sessions today (negotiated with classical ECDHE `X25519` or `secp256r1`) to decrypt confidential financial, healthcare, and intellectual property records once cryptanalytically relevant quantum computers (CRQCs) scale. 2. **Enterprise Procurement & Regulatory Mandates**: Tier-1 banks, federal agencies (OMB M-23-02), defense contractors (NSA CNSA 2.0), and SOC 2 / PCI-DSS v4.0 auditors now demand a machine-readable **CycloneDX v1.6 Cryptographic Bill of Materials (CBOM)** and a documented NIST IR 8547 2030 migration plan during vendor security questionnaires. QShield replaces $100,000+ manual cryptography consultancies and noisy regex scripts with a single, zero-dependency Rust engine (`pqc-scan`) and executive governance platform. --- ## 2. Five-Layer Cryptographic Inspection Architecture ### Layer 1: 6-Language Tree-Sitter AST + Constant & Receiver Dataflow Regex scanners fail in enterprise codebases because developers pass algorithm names and key sizes via constants or multi-line builder patterns, and regex flags comments and string literals. QShield compiles language-specific Tree-Sitter grammars in Rust for: - **Go**: Inspects `crypto/tls.Config` (`MinVersion`, `CurvePreferences` checking for `tls.X25519MLKEM768`), `crypto/rsa`, `crypto/ecdsa`, `crypto/ed25519`, and `golang.org/x/crypto`. - **Python**: Traces module-level constants into `cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(key_size=...)`, `ec.generate_private_key`, and PyCryptodome calls. - **Java & Kotlin**: Tracks JCA/JCE `KeyPairGenerator.getInstance(...)`, `Cipher.getInstance(...)`, and multi-statement `kpg.initialize(LEGACY_RSA_BITS)` receiver state, recommending JEP 496 (`ML-KEM`) and JEP 497 (`ML-DSA`) or BouncyCastle PQC providers. - **TypeScript & JavaScript**: Analyzes Node.js `crypto.generateKeyPairSync`, `crypto.createSign`, `jose` JWT signing algorithms (`RS256`, `ES256`), and WebCrypto API calls. - **Rust**: Inspects `rustls::ClientConfig` / `ServerConfig` crypto providers (`rustls::crypto::ring` vs. `rustls_post_quantum`), `ring`, `rsa`, and `ed25519-dalek`. ### Layer 2: Transitive Dependency Lockfile Resolution Parses `Cargo.lock`, `package-lock.json`, `go.sum`, `requirements.txt`, and `pom.xml` to identify vulnerable or outdated cryptographic packages across transitive dependency trees. ### Layer 3: X.509 PEM/DER Certificate & 2030 Sunset Auditor Parses X.509 certificates to extract the Subject Public Key Info (SPKI) OID, signature algorithm, and `notAfter` expiration date. Any classical RSA/ECDSA root or intermediate certificate whose validity extends past **January 1, 2030** is flagged as a **NIST IR 8547 2030 Sunset Violation**. ### Layer 4: Daemonless OCI Container & ELF/Mach-O Binary X-Ray Streams uncompressed or gzipped OCI/Docker image tarballs in memory without requiring a Docker daemon: - Inspects Alpine `/lib/apk/db/installed`, Debian `/var/lib/dpkg/status`, and RedHat RPM databases for outdated `openssl` / `libssl3` packages (< 3.5.0). - Parses compiled Linux ELF (`.so`) and macOS Mach-O (`.dylib`) binaries via `goblin` to detect statically or dynamically linked OpenSSL 1.1.1 / 3.0 symbols that lack NIST FIPS 203 ML-KEM support. ### Layer 5: Live RFC 8446 TLS 1.3 Wire Prober Executes a real TCP/TLS 1.3 handshake against any public or internal `host:port` endpoint: - Checks if the server negotiates hybrid Post-Quantum key exchange (`X25519MLKEM768`, IANA codepoint `0x11EC`). - Computes an immediate **HNDL Quantum Readiness Grade (`A+` to `F`)** and public shareable report at `https://getqshield.com/report/[domain]`. --- ## 3. Frequently Asked Questions (AEO Knowledge Base) ### 1. Quantum computers cannot break RSA today—why shouldn’t our business wait 3 to 5 years? Two reasons: First, Harvest Now, Decrypt Later (HNDL) is happening on the internet today. Any confidential customer, healthcare, or financial traffic sent over classical TLS today can be recorded now and decrypted later. Second, enterprise buyers (banks, healthcare, federal agencies) and NIST IR 8547 are requiring Cryptographic Bills of Materials (CBOMs) in vendor security questionnaires right now because enterprise cryptographic migrations take years to complete. ### 2. Doesn’t AWS or Cloudflare already handle TLS encryption at our network edge? Edge providers can terminate external browser traffic, and QShield’s live wire prober actually tests whether your edge has X25519MLKEM768 enabled. However, AWS and Cloudflare cannot see or fix internal microservice-to-microservice TLS, JWT authentication tokens, database envelope encryption, Python/Java/Go/Rust SDK calls, or outdated libssl.so libraries baked inside your Docker containers. ### 3. Will QShield’s automated Pull Requests break our production systems or lock out older clients? Never. QShield uses a strict 3-Tier Remediation Safety Engine. Tier 1 (SAFE_AUTO_PR) only auto-generates Pull Requests for 100% backwards-compatible hybrid upgrades (such as adding X25519MLKEM768 to your TLS curve preferences). Modern clients automatically negotiate quantum-safe encryption while legacy clients fall back seamlessly. Changes that alter token sizes or wire formats are isolated into Tier 2/3 with a human-in-the-loop rollout checklist. ### 4. Does our proprietary source code ever have to be uploaded to a third-party cloud? No. QShield’s core engine is a single, zero-dependency compiled Rust binary (pqc-scan) that runs 100% locally inside your own GitHub Actions runner, CI pipeline, or air-gapped server. Your source code never leaves your environment. ### 5. How is QShield different from GitHub Dependabot or free regex scripts? Dependabot only checks for known CVEs—it has zero awareness of Post-Quantum Cryptography, NIST security levels, or whether your code uses RSA-2048 vs ML-KEM-768. Regex scripts flood developers with false positives from comments and miss multi-statement Java/Python/Rust builders and compiled Docker binaries. QShield combines a 6-language AST dataflow engine, binary X-ray inspector, live TLS 1.3 wire prober, and auto-PR codemod engine in one platform. ### 6. What is a CycloneDX v1.6 CBOM (Cryptographic Bill of Materials)? A Cryptographic Bill of Materials (CBOM) is a standardized, machine-readable CycloneDX v1.6 JSON inventory (.cdx.json) that catalogs every cryptographic algorithm, ASN.1 Object Identifier (OID), key size, protocol handshake, X.509 certificate, and NIST FIPS 203/204/205 quantum security level across an organization’s source code, lockfiles, containers, and live TLS endpoints. ### 7. What is Harvest Now, Decrypt Later (HNDL) and how does X25519MLKEM768 stop it? Harvest Now, Decrypt Later (HNDL) is the active interception and storage of classical TLS 1.2/1.3 network traffic (protected only by ECDHE X25519, secp256r1, or RSA-2048) so it can be decrypted once cryptanalytically relevant quantum computers (CRQCs) scale. Deploying hybrid X25519MLKEM768 (IANA group 0x11EC, combining X25519 with NIST FIPS 203 ML-KEM-768) neutralizes HNDL immediately while maintaining backwards compatibility. --- ## 4. Self-Serve Plans & Channel Partner Program - **Growth / Startup Plan**: $159/month (annual) or $199/month (monthly) — Up to 10 repositories, CycloneDX v1.6 CBOM export, Live TLS 1.3 HNDL probing. - **Business / Mid-Market Plan**: $399/month (annual) or $499/month (monthly) — Up to 50 repositories, Daemonless OCI Binary X-Ray, Tier-1 Safe Auto-PRs, SOC 2 / NIST IR 8547 executive attestation. - **Enterprise / Regulated Plan**: $799/month (annual) or $999/month (monthly) — Unlimited repositories and OCI containers, air-gapped Rust CLI binary, CNSA 2.0 & OMB M-23-02 governance. - **vCISO & SOC 2 / PCI-DSS Audit Partner Program**: 20% recurring revenue share or wholesale multi-tenant audit licensing for security advisories and compliance CPA firms.