Remote Services Not Using Post-Quantum Ciphers

#TRUSTED 88076133eeb95983e484f5324c85017ccaa98cd0b9db194f8c6f96599095756547a250b6983e0b43f876bf57bf2b852230e5ddee2e9724eb2038b7ca4df454c485258e6ad56d1faec3d2a9200fe63df1b3c2362c6f0162ed4a63f0f317ab01f0718254f116f655520ffd06d21191c85ff9674c74bf9fcd7ff8282f8d39bdffc9cf89e03ba353e299fd70f28d88f1fa31520c645d121d84423de99844bafd8e2a3f2847d1b487d5d7060e11aeca7210490e5f526add38ced9b599d0c2a314494bb93790846254f0eba0a78b26d3e953750d7ff21c23a48ff9698f192c94091dac5a92f74518bde2bc8f603eb4f54b9661c5570630b7bd987009a7afee4e14486fc1e2892af721a1e78db982af8447c6663f8dc94ba12db06ccc1d627735f7a03fbd3d1e82af7e331ae99fc9381410d35daa11384586cf037f3bfe7e3ba8789b6e3840c8046d78faea00f1058bad8933aa1243da933c45a939bf5f85ad017ab1644f57bf935c2829a87d91abb00644af668ee8c33099f1235435290b1ecf3e8063b123d33e3f6159391f2402cb81c2e3f4a80d0fbde0ccc1904f8f488e254aaa09a8e1c54d9c754be9701f1d2a53fb4cf6653cf869754a53cee077b77b1616e8a9c30cf2007dbbc6a70aacd995c017e202b180c637891911afecf61f68e47ab2327786bbb052ba2df616dc93bc4282c7780bf616a9b50b995d57748a5cf3f5196b
#TRUST-RSA-SHA256 8576af88eadb59b8fa72b82186cb4bb9c320387715da9c85bc36e74cd80aff3ce225654333d250f6f91f683d3755db9e1ce8f870ce3e7802ef403914ea14d9faba5d3ef731ab2496404130993f83a2e1ab623a0486e314ddfb139039a7e7c29f3c77c41ba77adfe5d4eced6e05b885d402e7131493bcb91748d52bf392c9dfed7ef901c8df82547e01f42ca6e4ac8f9f111c1c9f0be4a89e86f747921c8a4fedd93602a1edb2cdec5e8c1d64fbc916b205e8e6c04485d0ee1addb0155bb3c6794593c4d05a152f5135092b8e462898d06d02a53be5fe96d349e552b20e4cb080c74f2c514cc217eb1714f38bdb65d46eb1c44e76af7893c43da797e4edf736c9e9ceb62b75a25d9dd0a2d651102fd240ff916086a3eea2ced28c51af400687635abf79d04d61b3c5505f95161bcaa6408f6a05a9b52d01a098911f5f875a169af150971d70e993cbf70b2a9785610fab463704d353eb4acea57c1436227e74dffae42b2f16075af970dab133db992979b252ec931382793afbcf3bd29311f16a866bcd091594a7b2dddffae5b364983a1c6d6212235cc94cf039a171f8c1ab3c3e8ddb1ff74ed166026dc90b0e060788e5a7baa99702616cad97d7b2912554402bfe4b5eed86b6355eaa999084bff6d0dbbc2c2e2b97954e693c03fe6c130b1612cd2c53853780d3c13889c9a53ed44b63eede88e1e72cb4ecae34e3ddd9c786
#%NASL_MIN_LEVEL 80900
#TRUST-RSA-SHA256
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(277650);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/08");

  script_name(english:"Remote Services Not Using Post-Quantum Ciphers");

  script_set_attribute(attribute:"synopsis", value:
"Reports remote services that do not offer post-quantum ciphers.");
  script_set_attribute(attribute:"description", value:
"This plugin reports network services that do not offer post-quantum
ciphers.  Tenable makes no attempt to determine whether the remote
service would be vulnerable to a post-quantum attack.

However, cryptography that depends on the classic difficulty of
solving the discrete logarithm problem or on the classic difficulty
of large prime factorization is broken by Shor's algorithm.  Examples
of this are RSA asymmetric encryption and Diffie-Hellman key
exchange.");

  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");
  # https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7a390f87");
  # https://www.ietf.org/archive/id/draft-kwiatkowski-pquip-pqc-migration-00.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ad7d6b3b");
  # https://www.rd.ntt/e/research/JN202305_21871.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1c0c61e0");
  # https://ntruprime.cr.yp.to/ntruprime-20170816.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5eec4b28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/08");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"General");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("target_cipher_inventory.nasl");

  exit(0);
}

var report;
var reported = FALSE;

var pqc_kbs = get_kb_list("Host/PQC/*/*/vulnerable");
var pqc_kb, kb_parts;
var port, proto;

for(pqc_kb in pqc_kbs)
{
  kb_parts = split(pqc_kb - "Host/PQC/", sep:"/", keep:FALSE);
  port = int(kb_parts[0]);
  proto = kb_parts[1];

  report = "The target " + proto + " server offers no post-quantum ciphers.";

  reported = TRUE;
  security_report_v4(port:port, severity:SECURITY_NOTE, extra:report);
}

if(!reported)
  exit(0, "The target has no services that do not offer post-quantum ciphers.");