quantum-security-project

OWASP Quantum Security Project Prepare Today. Protect tomorrow. An official OWASP community project mapping the security risks of the quantum era in a practical, vendor-neutral, and risk-based way - the antidote to hype and fear. Status: Bootstrap phase. The OWASP Top 10 for Quantum Security Risk...

nixos-config

Lan Tian's NixOS Configuration This repository holds the configuration files for all my NixOS systems. Features Full system root-on-tmpfs, using impermanence Nftables instead of iptables Secret management with sops-nix QEMU user mode emulation for most architectures Nix Flakes with Nixpkgs patchi...

pqaudit

pqaudit Scan codebases for quantum-vulnerable cryptography. Get a clear picture of what needs to migrate before Q-Day. pqaudit detects usage of RSA, ECDSA, Ed25519, ECDH, DH, and other algorithms broken by Shor's algorithm. It also identifies already-migrated PQC usage ML-KEM, ML-DSA, SLH-DSA so...

op4

op4 — Secure Terminal Messenger Op4 is a terminal-based encrypted messaging application written in Rust. It provides end-to-end encrypted private messaging with post-quantum cryptography, routed entirely through the Tor network so that neither the content of your messages nor your IP address is...

PQC-Scanner

The PQC Network Scanner is a purpose‑built assessment tool designed to help organisations understand their cryptographic exposure as they transition toward a post‑quantum security posture. Unlike traditional TLS scanners that focus solely on certificate validity or classical cryptographic strengt...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – SPHINCS+ WOTS+ Weak Randomness Signature Forgery Overview An implementation of the SPHINCS+ post‑quantum signature scheme uses a flawed random number generator during WOTS+ signature generation. The same nonce k is reused across multiple signatures, allowing an attacker to recove...

codecrypt

Codecrypt The post-quantum cryptography tool. Codecrypt is currently unmaintained, although I still successfully use it. If you are interested in developing/maintaining it, ping me. About This is a GnuPG-like unix program for encryption and signing that uses only quantum-computer-resistant...

JLSEC-2026-757 Use-after-free in PQC hybrid key-share handling

Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 released in 5.9.1: a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data through deserializeMetadata when it reads key metadata from AWS Secrets Manager. An attacker who can write the secret that holds the PQC key metadata can supply a crafted Base64-encoded Java serializati...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the deserializeMetadata paths in AwsSecretsManagerKeyLifecycleManager, HashicorpVaultKeyLifecycleManager, and the legacy metadata migration path in FileBasedKeyLifecycleManager. An attacker can...

CVE-2026-43867

The CVE concerns Apache Camel’s PQC component where AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() Base64-decodes and deserializes persisted KeyMetadata via a raw java.io.ObjectInputStream.readObject() without an ObjectInputFilter or class allow-list. A user who can write to the confi...

PT-2026-55886

☕ Apache Camel critical alert: CVE-2026-43867 hits the camel-pqc component. Post-quantum key metadata deserialized via ObjectInputStream with zero ObjectInputFilter — unauthenticated RCE risk at CVSS 9.8. Check your Camel builds now. AppSec Apache https://t.co/iaMBNrOfI0 https://t.co/mkIJ19Sd5Y...

Microsoft Accelerates Post-Quantum Cryptography Shift to 2029

Microsoft on Tuesday said it's accelerating its quantum safe security roadmap, stating technology advances in quantum computing are making it essential to replace existing encryption standards sooner than previously expected. "Advances in quantum research and development have shifted the risk...

Accelerating the quantum-safe timeline

The quantum-safe timeline has changed For years, planning for post-quantum cryptography PQC was framed as a future problem: important, inevitable, but distant. That perspective is evolving as technology advances and organizations prepare for the scale and complexity of the transition ahead. At...

CVE-2026-7531 Use-after-free in PQC hybrid key-share handling

Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 released in 5.9.1: a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory...

CVE-2026-7531 Use-after-free in PQC hybrid key-share handling

Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 released in 5.9.1: a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory...

CVE-2026-7531

CVE-2026-7531 describes a use-after-free in the handling of PQC hybrid key-shares for TLS 1.3. The issue occurs when a malicious server sends a truncated PQC hybrid KeyShare, which can trigger the error cleanup path to operate on freed memory. Documents consistently label this as an incomplete fi...

Post-Quantum Cryptography Is Coming, but Your DNS Might Not Be Ready

Learn why crypto-agility depends not just on adopting the right standards, but on maintaining a clear, unified view of your DNS environment before the migration begins...

Certification of Network Quantum Sensing

The distribution of quantum sensors on quantum networks is a key enabler of quantum technologies in interferometry, gravimetry, timekeeping, biological monitoring, and beyond. Yet, guaranteeing the security of these distributed sensors over noisy, insecure networks remains a formidable challenge...

The Clock Is Already Ticking: Why Post-Quantum Cryptography Can’t Wait

There is a question I have been hearing more and more from CISOs, compliance officers, and security architects over the past year. It does not start with "we had a breach" or "we failed an audit." It starts with something that sounds almost philosophical: " Are we quantum-safe?" A year ago, that...