Say what you mean

Post-quantum work fails more often on vocabulary than on mathematics. Two teams say “crypto-agility” and mean different things; a board hears “quantum-safe” and assumes a product was bought. This is the vocabulary we use, defined the way we use it.

164 showing

ACMEProtocol#: The protocol that automates certificate issuance and renewal, best known from Let's Encrypt and now standard in most cloud and service-mesh tooling.→ CSR → X.509 → Crypto-agility → Key rotation → PKI
Advanced persistent threatAttackalso APT · state-sponsored adversary#: A well-resourced adversary, typically state-sponsored, that pursues a specific target patiently over months or years.→ Harvest now, decrypt later → Confidentiality lifetime → Cryptographically relevant quantum computer
AEADAlgorithmalso Authenticated Encryption with Associated Data#: A cipher interface that delivers confidentiality and integrity in one operation, so ciphertext cannot be modified undetected.→ AES-GCM → ChaCha20-Poly1305 → HMAC → Padding oracle attack
AESAlgorithmalso Advanced Encryption Standard · Rijndael · AES-128 · AES-256#: The symmetric block cipher standardised by NIST in FIPS 197 and used for nearly all bulk encryption in the enterprise.AES is not broken by quantum computers in the way public-key cryptography is. Grover's algorithm offers at most a quadratic speedup against key search, and that speedup is hard to realise at scale, so AES-256 is treated as a long-term choice and AES-128 as adequate for most present-day confidentiality.CNSA 2.0 requires AES-256. For data with a long confidentiality lifetime, moving symmetric keys to 256 bits is cheap and worth doing inside the same migration.→ AES-GCM → Grover's algorithm → Security level → CNSA 2.0 → Confidentiality lifetime
AES-GCMAlgorithmalso GCM · Galois/Counter Mode · AES-GCM-SIV#: The authenticated encryption mode that pairs AES counter-mode encryption with a Galois-field authentication tag, and the default cipher in TLS 1.3.GCM's sharpest edge is nonce management. Encrypting two different messages under the same key and nonce destroys both confidentiality and authenticity and leaks the authentication key. Random 96-bit nonces are safe only up to a bounded number of messages per key, which is why long-lived keys need counters or a misuse-resistant variant.→ AEAD → AES → Nonce reuse → TLS 1.3 → ChaCha20-Poly1305
Algorithm confusion attackAttack#: Exploiting a verifier that trusts the algorithm named inside a token or message, so an attacker can choose a weaker verification path.→ JWT → JOSE → Downgrade attack → Composite signature
AssetPlatform#: The unit AutoPQC counts and scores: a specific cryptographic use in a specific place, such as one certificate on one endpoint or one signing key in one pipeline.Defining the asset boundary is what makes counts comparable over time. A certificate served by forty load-balanced instances is one asset, not forty; a library that offers five algorithms is scored on what it actually negotiates, not on what it could.Our pilot estate contained 42 assets under this definition, 36 of which were classified vulnerable.→ Finding → Detector → CBOM → Cryptographic inventory → Exposure score What counts as an asset
AutoPQCPlatform#: Theos Quantum's platform: it discovers cryptography across an enterprise estate, scores exposure to quantum attack, maps findings to the NIST standards, prioritises remediation, and measures the performance impact before a change ships.AutoPQC implements FIPS 203, FIPS 204 and FIPS 205. In our pilot estate it discovered 42 cryptographic assets, classified 36 of them vulnerable, and returned an aggregate risk score of 75 / 100.The same estate took 22 hours to review by hand and 14 minutes through AutoPQC. Classification accuracy on our labelled evaluation set is 95.2%, with a macro-F1 of 0.94.→ Exposure score → Detector → Finding → Asset → The Theos Method → Cryptographic inventory The platform

Baseline AssessmentPlatform#: Our entry engagement: discovery across an agreed scope, an exposure-scored inventory, a CBOM, and a prioritised remediation sequence.A Baseline Assessment answers what you have and what to do first. It does not perform the migration, and it does not include the deep protocol and performance work of a full engagement.[PLACEHOLDER: Baseline Assessment duration, scope limits and price]→ Deep Migration Engagement → Cryptographic inventory → CBOM → Exposure score → Posture Attestation Engagements
Blast radiusGovernance#: How much of an estate is affected if one key, certificate or trust anchor is compromised or has to be replaced at short notice.→ Certificate authority → KMS → Risk tier → Exposure score → Migration window

C25

CBOMStandardalso cryptographic bill of materials#: A machine-readable inventory of the cryptographic assets in a system — algorithms, key lengths, certificates, protocols and where each one is used.A CBOM is the deliverable that makes a migration plannable, because it converts a diffuse question into a list with owners. It is also the artefact regulators are converging on when they ask for evidence of cryptographic awareness.AutoPQC emits a CBOM in CycloneDX form for every assessed estate, alongside the findings that reference it.→ SBOM → CycloneDX → Cryptographic inventory → Asset → AutoPQC Cryptographic bills of material
Certificate authorityProtocolalso CA · issuing CA · root CA#: An entity that issues certificates by signing them, and whose own key anchors trust for everything below it.A root key is the hardest thing in an estate to migrate, because its public key is embedded in trust stores, firmware and hardware that may never be updated. It is also the key with the longest exposure, which is why hash-based signatures are attractive for new roots.→ PKI → X.509 → SLH-DSA (SPHINCS+)→ LMS → HSM → Blast radius
Certificate TransparencyProtocolalso CT · CT log#: A system of append-only public logs recording issued certificates, so that mis-issuance can be detected by the domain owner rather than trusted away.→ Merkle tree → X.509 → Certificate authority → Evidence Ledger
ChaCha20-Poly1305Algorithmalso ChaCha20 · Poly1305#: A stream-cipher-based AEAD construction used where AES hardware acceleration is unavailable, notably in mobile TLS and WireGuard tunnels.→ AEAD → AES-GCM → TLS 1.3 → Nonce reuse
Chosen-ciphertext attackAttackalso CCA#: An attack in which the adversary submits ciphertexts of its choosing and learns something from how the system responds, even from an error message.→ IND-CCA2 → Padding oracle attack → Key encapsulation mechanism → RSA padding modes
Cipher suiteProtocol#: The named bundle of algorithms a TLS connection agrees on, and the field most often used as a proxy for a system's cryptographic posture.→ TLS 1.3 → AES-GCM → Detector → Downgrade attack
Classic McElieceAlgorithm#: A code-based KEM built on a 1978 construction, with unusually large public keys and an unusually long record of surviving cryptanalysis.→ Code-based cryptography → HQC → Key encapsulation mechanism
CNSA 2.0Standardalso Commercial National Security Algorithm Suite 2.0#: The NSA's algorithm suite for US national-security systems, which specifies post-quantum algorithms and a published timeline for adopting them.CNSA 2.0 names ML-KEM-1024 for key establishment, ML-DSA-87 for general signatures, LMS or XMSS for software and firmware signing, AES-256 for symmetric encryption, and SHA-384 or SHA-512 for hashing. Notably it does not recommend hybrid modes as an end state, which puts it at odds with much commercial guidance.Its timeline is the most concrete public deadline in the field, with earlier dates for software and firmware signing and full adoption expected across national-security systems by 2035. Regulated commercial buyers increasingly use it as a reference even where it does not bind them.→ ML-KEM (Kyber)→ ML-DSA (Dilithium)→ LMS → AES → Hybrid key exchange → Migration window CNSA 2.0 and the federal timeline
Code signingProtocol#: Signing software, firmware or packages so a recipient can verify origin and integrity before execution.Code signing has the longest verification horizon of any signature use in most estates. A device shipped today may still be verifying firmware in fifteen years against a public key burned into silicon, so the signature algorithm has to outlast the product.This is where hash-based signatures earn their cost, and where CNSA 2.0 sets its earliest deadlines.→ LMS → XMSS → SLH-DSA (SPHINCS+)→ CNSA 2.0 → NIST SP 800-208 → Supply-chain attack
Code-based cryptographyMathematics#: Cryptography whose hardness comes from decoding a random-looking error-correcting code, the second-oldest surviving post-quantum family.→ HQC → Classic McEliece → Lattice → Post-quantum cryptography
Collision attackAttack#: Finding two different inputs that produce the same hash, which lets a signature over one be presented as a signature over the other.→ SHA-1 → Hash function → Digital signature → Cryptanalysis
Composite signatureProtocol#: A single algorithm identifier that binds a classical and a post-quantum signature into one object, so existing certificate parsers treat the pair as indivisible.→ Hybrid signature → X.509 → ML-DSA (Dilithium)→ Downgrade attack
Confidentiality lifetimeGovernancealso data shelf life · cryptoperiod#: How long a given piece of data must stay secret, which is the input that decides whether harvest-now-decrypt-later applies to it at all.Confidentiality lifetime is a business judgement, not a technical measurement, and it is the field customers most often have to supply themselves. A session cookie needs minutes; a mortgage file needs decades; a genome or a state record needs a lifetime.It is the strongest single term in our exposure model, because it is what separates a connection that is genuinely at risk today from one that merely uses an algorithm on a retirement list.→ Harvest now, decrypt later → Mosca inequality → Exposure score → NIST SP 800-57 → Risk tier
Constant-time implementationAlgorithm#: Code written so that execution time and memory-access patterns do not depend on secret data, closing the most common side-channel leak.Post-quantum schemes bring new constant-time hazards: rejection-sampling loops, table lookups indexed by secret values, and floating-point arithmetic in FN-DSA. A correct algorithm in a leaky implementation is not a secure deployment, which is why we record the library and version and not just the algorithm name.→ Side-channel attack → Timing attack → FN-DSA (Falcon)→ Detector
ContinuumPlatform#: Roadmap. Continuum is our planned continuous-monitoring and API surface for cryptographic drift, keeping an inventory current between engagements.Continuum is not generally available. Nothing in an assessment today depends on it, and we will not quote it as a shipping capability. [PLACEHOLDER: Continuum availability target date]→ Cryptographic inventory → Crypto-agility → AutoPQC → Threat Radar
Coordinated vulnerability disclosureGovernancealso CVD · responsible disclosure#: An agreed process by which a researcher reports a flaw privately and the vendor fixes it before details are published.Our own disclosure process, scope and contact route are published on the Security & Disclosure page. [PLACEHOLDER: disclosure contact address, PGP fingerprint and response-time commitment]→ CVE → Zero-day → KEV catalogue Security & Disclosure
CRLProtocolalso certificate revocation list#: A signed list of revoked certificates published by an authority, the older of the two standard revocation mechanisms.→ OCSP → X.509 → Certificate authority → Blast radius
CryptanalysisAttack#: The study of breaking cryptographic systems, or of establishing how much work breaking them would take.Cryptanalysis, not quantum computing, is what has broken the most cryptography in practice. SIKE, Rainbow and SHA-1 all fell to classical mathematics. A migration plan that treats the quantum threat as the only threat is mis-specified.→ SIKE → Collision attack → Lattice reduction → Multivariate cryptography → Post-quantum cryptography
Crypto-agilityGovernancealso cryptographic agility · algorithm agility#: The property of a system that lets its cryptographic algorithms, parameters and keys be replaced without redesigning the application around them.Agility is the deliverable that outlasts this particular migration. The organisations that will handle the next algorithm change cheaply are the ones that centralise cryptographic choices behind an interface, express them in configuration rather than code, automate certificate issuance, and can enumerate what they use.It is also measurable. Time from decision to full deployment of a changed algorithm is a better metric of readiness than any count of post-quantum endpoints.→ Cryptographic inventory → ACME → PKCS #11 → Hybrid key exchange → Continuum Designing for crypto-agility
Cryptographic inventoryGovernancealso crypto inventory · cryptographic discovery#: A complete, maintained record of where cryptography is used across an estate, with the algorithm, key length, owner and purpose of each use.Every serious piece of migration guidance begins here, because nothing downstream can be sequenced without it. In practice the inventory is never complete on the first pass: certificates in embedded devices, cryptography inside purchased software, and keys held by suppliers are all hard to see.We report coverage honestly rather than implying completeness. A finding we could not reach is recorded as unreached, not as absent.→ CBOM → Asset → Detector → Crypto-agility → Baseline Assessment → AutoPQC How discovery finds cryptography
Cryptographically relevant quantum computerHardwarealso CRQC#: A quantum computer capable of breaking the public-key cryptography in real use, which requires error correction at a scale not yet demonstrated.No such machine is known to exist. Credible public estimates for its arrival span the 2030s and beyond, with wide uncertainty, and they rest on assumptions about error rates and algorithmic improvement that continue to change.We treat the arrival date as an input with error bars rather than a deadline. The decision it feeds — whether your confidentiality lifetime plus your migration duration already crosses it — usually does not depend on resolving the uncertainty.→ Logical qubit → Quantum error correction → Mosca inequality → Shor's algorithm → Migration window → NISQ
CSRProtocolalso certificate signing request · PKCS #10#: A signed request in which a key holder asks a certificate authority to certify its public key, proving possession of the matching private key.→ X.509 → Certificate authority → ACME → PKI
CVEStandardalso Common Vulnerabilities and Exposures#: The public identifier scheme for disclosed software vulnerabilities, giving each one a stable reference of the form CVE-2024-12345.Cryptographic findings and CVEs overlap but are not the same thing. Using RSA-2048 for a thirty-year secret is a serious exposure with no CVE attached, while a memory-safety bug in a TLS library is a CVE with no cryptographic implication. We report both and keep them separate.→ CVSS → KEV catalogue → EPSS → Finding → Zero-day
CVSSStandardalso Common Vulnerability Scoring System#: A standardised 0.0–10.0 severity score for vulnerabilities, based on how a flaw can be exploited and what it affects.CVSS measures technical severity, not urgency in your estate. Version 4.0 was published in 2023 and adds threat and environmental dimensions, but the base score still says nothing about whether the affected key protects a payroll file or a thirty-year medical record. Our exposure score is deliberately a different measurement.→ CVE → EPSS → KEV catalogue → Exposure score
CycloneDXStandard#: An OWASP bill-of-materials specification whose recent versions can describe cryptographic assets, making it the practical format for a CBOM.→ CBOM → SBOM → Cryptographic inventory

D11

DecoherenceHardware#: The loss of a qubit's quantum state through interaction with its environment, which limits how long a computation can run.→ Qubit → Quantum error correction → NISQ
Deep Migration EngagementPlatform#: Our extended engagement: hybrid rollout design, protocol-level change, measured performance proof, rollback planning and re-assessment after the change lands.This is where hybrid key exchange gets designed against real client populations, where middlebox behaviour gets tested, and where the performance impact is measured on the customer's own traffic rather than a benchmark.[PLACEHOLDER: Deep Migration Engagement duration, staffing model and price]→ Baseline Assessment → Hybrid key exchange → Performance proof → Migration window → Crypto-agility Engagements
DetectorPlatform#: A single discovery rule in AutoPQC that identifies one kind of cryptographic use — a TLS negotiation, a certificate, a key file, a library call, a configuration setting.Each detector has a declared scope, a declared confidence and a declared failure mode, and every finding names the detector that produced it. That is what makes a result arguable: an owner who disagrees can see exactly which rule fired and why.Detectors are versioned with the method, so a report from six months ago can be reproduced against the rules that were in force when it ran.→ Finding → Asset → Method version → Cryptographic inventory → AutoPQC The detector catalogue
Diffie–HellmanAlgorithmalso DH · FFDHE · finite-field Diffie–Hellman#: The original public key-agreement method, letting two parties derive a shared secret over a public channel using arithmetic in a finite field.→ ECDH → Discrete logarithm problem → Shor's algorithm → IKEv2 → NIST SP 800-56
Digital signatureAlgorithm#: A value that proves a message was produced by the holder of a private key and has not changed since, verifiable by anyone holding the public key.Signatures and key establishment fail on different clocks. A recorded key exchange can be attacked years later, so key establishment is urgent. A signature is generally only useful to forge while the key is still trusted, so signature migration is driven by certificate and firmware lifetimes rather than by data lifetimes.→ ML-DSA (Dilithium)→ SLH-DSA (SPHINCS+)→ ECDSA → RSA → Harvest now, decrypt later → Migration window
Discrete logarithm problemMathematicsalso DLP · ECDLP#: The problem of recovering the exponent in a modular or elliptic-curve exponentiation, and the foundation of Diffie–Hellman, DSA, ECDSA and EdDSA.Shor's algorithm solves the discrete logarithm problem in both the finite-field and elliptic-curve settings. That single result is why the entire deployed public-key layer, not just RSA, is on the migration list.→ Diffie–Hellman → ECDSA → EdDSA → Shor's algorithm → Elliptic curve
DORAGovernancealso Digital Operational Resilience Act#: The EU regulation on digital operational resilience for financial entities, which applies from 17 January 2025.DORA does not name post-quantum algorithms. It requires financial entities to manage ICT risk, keep an inventory of information assets, govern cryptographic controls and demonstrate resilience, and a supervisor reading those obligations will expect an institution to know where its cryptography is.It also reaches critical ICT third parties, which means a supplier's cryptographic posture becomes the financial entity's problem.→ Cryptographic inventory → GDPR → NIS2 → Baseline Assessment → Posture Attestation DORA and financial-sector obligations
Downgrade attackAttackalso rollback attack · negotiation stripping#: Forcing two parties to agree on a weaker algorithm or version than both support, by interfering with the negotiation between them.Downgrade risk is the reason hybrid deployment needs care. If a client will silently accept a classical-only key exchange when the post-quantum one fails, an attacker on the path only has to make it fail. Migration is only complete when the weaker option can be refused.→ Hybrid key exchange → Cipher suite → Machine-in-the-middle attack → Composite signature → TLS 1.3
DPDP Act 2023Governancealso Digital Personal Data Protection Act, 2023 · DPDPA#: India's data-protection statute, enacted in 2023, which places obligations on data fiduciaries to protect personal data with reasonable security safeguards.The Act is framed around obligations rather than prescribed controls, with detail left to subordinate rules. For an Indian enterprise the practical reading is the same as elsewhere: retention periods and safeguard adequacy are linked, and cryptography with a known expiry date sits awkwardly against long retention.[PLACEHOLDER: status and date of the DPDP Rules relied on in this section]→ GDPR → Confidentiality lifetime → Cryptographic inventory The Indian regulatory picture
DRBGAlgorithmalso Deterministic Random Bit Generator · CSPRNG#: A deterministic algorithm that stretches a high-entropy seed into a long stream of unpredictable bits for keys, nonces and challenges.→ Entropy → True random number generator → NIST SP 800-90A → Nonce reuse
DSAAlgorithmalso Digital Signature Algorithm#: The finite-field signature algorithm from the original US Digital Signature Standard, now withdrawn for new signature generation.→ FIPS 186-5 → Discrete logarithm problem → ECDSA → Shor's algorithm → Nonce reuse

ECDHAlgorithmalso Elliptic-Curve Diffie–Hellman · ECDHE#: Diffie–Hellman key agreement performed over an elliptic curve, and the dominant key-establishment method in deployed TLS today.→ Diffie–Hellman → X25519 → Perfect forward secrecy → Harvest now, decrypt later → ML-KEM (Kyber)
ECDSAAlgorithmalso Elliptic Curve Digital Signature Algorithm · P-256 · secp256r1#: The elliptic-curve signature algorithm behind most modern TLS certificates, code-signing chains and device identities.ECDSA gives RSA-grade classical security in far fewer bytes, which is why it displaced RSA in new deployments. It inherits two weaknesses: it is broken by Shor's algorithm, and it is brittle about the per-signature nonce, where any bias or repetition leaks the private key.Curves seen in the field are mostly NIST P-256, P-384 and P-521. The parameter worth recording is the curve, not just the algorithm name.→ Elliptic curve → Nonce reuse → Shor's algorithm → EdDSA → ML-DSA (Dilithium)→ FIPS 186-5
Ed25519Algorithm#: The most widely deployed EdDSA instantiation, standard for SSH keys, package signing and many internal service identities.→ EdDSA → SSH → Shor's algorithm → Elliptic curve → ML-DSA (Dilithium)
EdDSAAlgorithmalso Edwards-curve Digital Signature Algorithm#: A signature scheme over Edwards curves that derives its per-signature nonce deterministically, removing ECDSA's most common implementation failure.→ Ed25519 → ECDSA → Nonce reuse → FIPS 186-5 → Elliptic curve
Elliptic curveMathematicsalso ECC · elliptic-curve cryptography · Curve25519#: A curve over a finite field whose points form a group, giving compact keys for signatures and key agreement at high classical security.→ ECDSA → ECDH → X25519 → Discrete logarithm problem → Isogeny
EntropyMathematics#: A measure of unpredictability in bits, and the raw material every key, nonce and salt is drawn from.→ DRBG → True random number generator → Nonce reuse → Key management
EPSSStandardalso Exploit Prediction Scoring System#: A data-driven estimate of the probability that a given vulnerability will be exploited in the near term, maintained by FIRST.→ CVSS → CVE → KEV catalogue → Harvest now, decrypt later
Evidence LedgerPlatform#: The hash-chained record behind every AutoPQC result, holding each detector run, input digest and scoring decision so a report can be reconstructed and audited later.Entries are linked by hash, so an alteration to an earlier record invalidates everything after it. The design borrows from Certificate Transparency: the point is not to prevent a change but to make one impossible to hide.This is the panel an auditor should be shown when they ask how a number was produced.→ Merkle tree → Certificate Transparency → Method version → Posture Attestation → The Theos Method What to hand an auditor
Exposure scorePlatform#: The 0–100 number AutoPQC assigns to an asset or an estate, expressing how much quantum-attack exposure it carries and how urgently it should be addressed.The score is deterministic and reproducible: the same inputs under the same method version always produce the same number. Its main terms are the algorithm and key length in use, the confidentiality lifetime of what the asset protects, the blast radius of the key, and how hard the asset is to change.It is not a CVSS score and does not try to be. CVSS answers how severe a flaw is; this answers how exposed a specific key in a specific estate is to a specific adversary.→ Risk tier → Confidentiality lifetime → Blast radius → CVSS → The Theos Method → Finding How the exposure score is built

Fault injectionAttackalso glitching · differential fault analysis#: Deliberately inducing a computation error — through voltage, clock, laser or temperature manipulation — so that the faulty output reveals a secret.→ Side-channel attack → Ed25519 → ML-DSA (Dilithium)→ TPM → Secure enclave
Fiat–Shamir transformMathematics#: A technique that turns an interactive proof of knowledge into a non-interactive signature by replacing the verifier's challenge with a hash.→ ML-DSA (Dilithium)→ Digital signature → Hash function → Constant-time implementation
FindingPlatform#: One recorded observation about one asset: what was found, which detector found it, what it means, and what to do about it.→ Detector → Asset → Exposure score → Risk tier → CVE Why a specific asset was flagged
FIPS 140-3Standardalso FIPS 140 · Cryptographic Module Validation Program · CMVP#: The US and Canadian validation standard for cryptographic modules, aligned to ISO/IEC 19790 and administered through the Cryptographic Module Validation Program.FIPS 140-3 validates the module, not the algorithm. That distinction drives real migration timelines: an organisation can be ready to deploy ML-KEM long before the HSM or library it depends on holds a certificate covering it, and regulated deployments often cannot move until the certificate exists.Treat validated-module availability as a dependency in the migration plan, with its own owner and its own date.→ HSM → KMS → FIPS 203 → SHAKE → Migration window
FIPS 186-5Standardalso Digital Signature Standard · DSS#: The current US Digital Signature Standard, which approves ECDSA and EdDSA and withdraws DSA for new signature generation.→ DSA → ECDSA → EdDSA → FIPS 204 → NIST SP 800-131A
FIPS 203Standard#: The NIST standard for ML-KEM, published in August 2024, defining the post-quantum key-encapsulation mechanism.→ ML-KEM (Kyber)→ FIPS 204 → FIPS 205 → FIPS 140-3 → NIST security category FIPS 203, 204 and 205, mapped to output
FIPS 204Standard#: The NIST standard for ML-DSA, published in August 2024, defining the primary post-quantum digital signature scheme.→ ML-DSA (Dilithium)→ FIPS 203 → FIPS 205 → FIPS 186-5 → Code signing FIPS 203, 204 and 205, mapped to output
FIPS 205Standard#: The NIST standard for SLH-DSA, published in August 2024, defining the stateless hash-based signature scheme.→ SLH-DSA (SPHINCS+)→ FIPS 203 → FIPS 204 → NIST SP 800-208 FIPS 203, 204 and 205, mapped to output
FN-DSA (Falcon)Algorithmalso FN-DSA · Falcon#: A lattice signature scheme selected by NIST alongside ML-DSA, notable for signatures several times smaller than ML-DSA at comparable security.NIST has stated it will publish FN-DSA as a separate standard; that document was not final at the time of writing, so treat FN-DSA as a planned option rather than a shipping one.The small signature is attractive wherever bytes are expensive — DNS responses, constrained links, dense certificate chains. The trade-off is implementation difficulty: signing uses floating-point Gaussian sampling, which is unusually hard to make constant-time and unusually easy to get subtly wrong. Prefer a validated implementation over your own.→ ML-DSA (Dilithium)→ NTRU → Constant-time implementation → Side-channel attack → Digital signature

GDPRGovernancealso General Data Protection Regulation#: The EU data-protection regulation, which requires appropriate technical measures — encryption among them — proportionate to the risk to individuals.The post-quantum argument under GDPR runs through the word appropriate. Encryption that is expected to fail within the retention period of the data it protects is difficult to defend as an appropriate measure, and a breach of retrospectively decrypted personal data is still a breach of personal data.→ DPDP Act 2023 → DORA → Confidentiality lifetime → Harvest now, decrypt later
Grover's algorithmAttack#: A quantum algorithm that searches an unstructured space in about the square root of the number of possibilities, halving the effective strength of a symmetric key in theory.Grover is often overstated. The quadratic speedup does not parallelise well, the constant factors are severe, and the sequential depth required to search a 128-bit space is far beyond any plausible machine. AES-128 is not urgent; AES-256 removes the question entirely.The practical consequence for planning is small: raise symmetric key sizes where it is cheap, and spend the effort on public-key migration, which is where the actual break is.→ Shor's algorithm → AES → Hash function → Security level

Harvest now, decrypt laterAttackalso HNDL · store now, decrypt later · retrospective decryption#: Recording encrypted traffic today in order to decrypt it once a quantum computer becomes capable, which makes today's confidentiality a future liability.This is the mechanism that turns a distant hardware milestone into a present-tense problem. A well-resourced adversary needs no cryptographic breakthrough to start: bulk capture and storage are cheap, and forward secrecy does not help, because the ephemeral key exchange is exactly what a quantum computer recovers.It only matters for data whose value outlives the migration. That is why we scope it by confidentiality lifetime rather than treating every connection as equally urgent — health records, insurance files, source code, national records and key material qualify; a cache-invalidation callback does not.→ Confidentiality lifetime → Perfect forward secrecy → Mosca inequality → Migration window → Advanced persistent threat → Exposure score Harvest now, decrypt later
Hash functionAlgorithm#: A deterministic function mapping input of any length to a fixed-length digest, from which the input cannot be recovered and for which collisions cannot be found.→ SHA-2 → SHA-3 → SHA-1 → Collision attack → Merkle tree → Grover's algorithm
HIPAAGovernance#: The US framework governing protected health information, under which encryption is an addressable safeguard and a breach of encrypted data may not be reportable.→ Confidentiality lifetime → Harvest now, decrypt later → GDPR
HKDFAlgorithmalso HMAC-based Key Derivation Function · key derivation function · KDF#: The standard method for turning one shared secret into several context-separated keys, used in TLS 1.3 and most modern protocols.→ HMAC → Hybrid key exchange → TLS 1.3 → Key management
HMACAlgorithmalso Hash-based Message Authentication Code#: A symmetric authentication construction that proves a message came from a holder of the shared key, built from an ordinary hash function.→ Hash function → HKDF → JWT → AEAD → Grover's algorithm
HQCAlgorithmalso Hamming Quasi-Cyclic#: A code-based key-encapsulation mechanism NIST selected in 2025 as a backup to ML-KEM, resting on a different hardness assumption.→ Code-based cryptography → Key encapsulation mechanism → ML-KEM (Kyber)→ Crypto-agility → Classic McEliece
HSMHardwarealso hardware security module#: A tamper-resistant device that generates and uses keys internally, so private key material never appears in ordinary memory.HSMs are usually the critical path in a post-quantum migration. Support for ML-KEM, ML-DSA and the stateful hash-based schemes arrives by firmware release, must then be validated under FIPS 140-3 to be usable in regulated contexts, and only then can be scheduled into a maintenance window on a device that may be doing payment authorisation.Inventory the model, firmware version and validation certificate, not just the fact that an HSM exists.→ KMS → TPM → PKCS #11 → FIPS 140-3 → Certificate authority → LMS
Hybrid key exchangeProtocolalso hybrid KEM · PQ/T hybrid#: A key establishment that runs a classical and a post-quantum method together and derives the session key from both, so the session is safe if either holds.Hybrid is the default recommendation for key establishment during the transition, for two reasons. The post-quantum schemes are young, and SIKE showed what a young scheme can do. And the classical half preserves interoperability and a rollback path.Hybrid is not free. Handshakes grow, some middleboxes reject the larger messages, and the combined implementation is more code to get wrong. It is still the right default for confidentiality, and CNSA 2.0 is a notable dissenting view for national-security systems.→ X25519MLKEM768 → ML-KEM (Kyber)→ X25519 → TLS 1.3 → HKDF → CNSA 2.0 → Hybrid signature Hybrid modes and keeping your rollback
Hybrid signatureProtocol#: A signature that carries both a classical and a post-quantum component and is accepted only if both verify.→ Hybrid key exchange → Composite signature → Digital signature → Code signing → X.509

IKEv2Protocolalso Internet Key Exchange version 2#: The key-negotiation protocol for IPsec, extended by the IETF to carry multiple key exchanges so a post-quantum method can be added alongside a classical one.→ IPsec → Hybrid key exchange → Diffie–Hellman → Key management
IND-CCA2Attackalso adaptive chosen-ciphertext indistinguishability#: The standard security goal for public-key encryption: an adversary with a decryption oracle still cannot tell which of two chosen messages a ciphertext encrypts.ML-KEM targets IND-CCA2, which is what makes it safe to use a single long-term key pair for many encapsulations. A scheme that only achieves the weaker chosen-plaintext notion is not a drop-in substitute, and this is one of the properties a hybrid combiner must preserve.→ Chosen-ciphertext attack → ML-KEM (Kyber)→ Key encapsulation mechanism → Hybrid key exchange
Integer factorisationMathematics#: The problem of splitting a large integer into its prime factors, believed hard classically and solved efficiently by Shor's algorithm on a quantum computer.→ RSA → Shor's algorithm → Discrete logarithm problem
IPsecProtocol#: The IP-layer encryption suite behind most site-to-site VPNs and much regulated network segmentation.→ IKEv2 → Diffie–Hellman → Harvest now, decrypt later → Crypto-agility
ISO/IEC 27001Standard#: The international standard for an information security management system, certifying that an organisation manages security risk through a defined, audited process.→ SOC 2 → Cryptographic inventory → NIST Cybersecurity Framework → Posture Attestation
IsogenyMathematicsalso isogeny-based cryptography · supersingular isogeny#: A structure-preserving map between elliptic curves, whose composition into long chains was proposed as a hard problem for post-quantum key exchange.→ SIKE → Elliptic curve → Cryptanalysis → Post-quantum cryptography

JOSEProtocolalso JSON Object Signing and Encryption · JWS · JWE · JWK#: The family of specifications for signing, encrypting and representing keys in JSON, of which JWT is the token profile.→ JWT → Algorithm confusion attack → Detector → Key rotation
JWTProtocolalso JSON Web Token#: A compact signed or encrypted token format used to carry authentication and authorisation claims between services.JWT migration priority depends entirely on the algorithm. HMAC-signed tokens carry no quantum exposure; RSA- and ECDSA-signed tokens, common wherever an identity provider publishes a public key set, do. Token lifetimes are short, so the forgery window is narrow, which puts JWTs behind key establishment in most sequencing.→ JOSE → HMAC → Algorithm confusion attack → SAML → Digital signature

KerberosProtocol#: The ticket-based authentication protocol at the centre of Windows domain authentication, built mainly on symmetric cryptography.→ SAML → AES → PKI → X.509
KEV catalogueStandardalso Known Exploited Vulnerabilities · CISA KEV#: CISA's list of vulnerabilities with confirmed active exploitation, used as a first-order patch-priority signal.→ CVE → EPSS → Harvest now, decrypt later → Exposure score
Key encapsulation mechanismAlgorithmalso KEM#: A primitive in which a sender generates a fresh symmetric key together with a ciphertext that only the recipient's private key can open.A KEM replaces the older habit of encrypting a chosen session key with a public-key cipher. The distinction matters for migration: ML-KEM is a KEM, not a drop-in RSA encryption function, so code that assumes it can encrypt arbitrary plaintext under a public key needs restructuring rather than a library swap.→ ML-KEM (Kyber)→ HQC → ECDH → Hybrid key exchange → IND-CCA2
Key managementGovernance#: The discipline covering how keys are generated, stored, distributed, used, rotated, archived and destroyed.→ Key rotation → KMS → HSM → NIST SP 800-57 → Entropy
Key rotationGovernance#: Replacing a key on a defined schedule so that any single key's exposure window, and the value of compromising it, stays bounded.→ Key management → ACME → Crypto-agility → NIST SP 800-57 → SSH
KMSHardwarealso key management service#: A managed service that stores keys and performs cryptographic operations on request, usually backed by hardware and integrated with cloud access control.→ HSM → Key management → Key rotation → Blast radius → NIST SP 800-57

LatticeMathematicsalso lattice cryptography · algebraic lattice#: A regular, infinitely repeating grid of points in high-dimensional space, whose geometry gives rise to problems believed hard for both classical and quantum computers.Lattices are the workhorse of post-quantum cryptography because they support fast arithmetic, small-ish keys and flexible constructions: ML-KEM, ML-DSA and FN-DSA all sit here. The concentration of standards in one family is itself a risk, which is why NIST also selected a code-based backup.→ Learning with errors → Shortest vector problem → Lattice reduction → ML-KEM (Kyber)→ Code-based cryptography → HQC
Lattice reductionMathematicsalso BKZ · LLL#: The family of algorithms that attack lattice problems by transforming a lattice basis into a shorter, more orthogonal one.Parameter sets for ML-KEM and ML-DSA are chosen by estimating the cost of the best known lattice reduction. Those estimates improve gradually as research advances, which is why parameter choices are periodically revisited and why an estate needs to be able to change parameter set without a rebuild.→ Shortest vector problem → Lattice → Cryptanalysis → Crypto-agility
Learning with errorsMathematicsalso LWE#: The problem of recovering a secret vector from noisy linear equations about it, the hardness assumption underneath most lattice cryptography.The noise is the whole trick. Without it, linear algebra solves the system immediately; with it, the best known algorithms need effort that grows steeply with dimension. LWE also has a reduction to worst-case lattice problems, which is a stronger theoretical footing than most deployed cryptography enjoys.→ Lattice → Module-LWE → Ring-LWE → Shortest vector problem
LMSAlgorithmalso Leighton-Micali Signatures · HSS · Hierarchical Signature System#: A stateful hash-based signature scheme specified in RFC 8554, approved by NIST SP 800-208 and named in CNSA 2.0 for software and firmware signing.→ NIST SP 800-208 → XMSS → CNSA 2.0 → Code signing → Merkle tree → HSM
Logical qubitHardware#: An error-corrected qubit assembled from many physical qubits, stable enough to run a long computation such as Shor's algorithm.The ratio between physical and logical qubits is the crux of the whole timeline question. It depends on the error-correcting code and on physical error rates, and published estimates have moved substantially as both improve. This is why any confident date for a cryptographically relevant machine should be read as an opinion.→ Physical qubit → Quantum error correction → Cryptographically relevant quantum computer → Shor's algorithm

M10

Machine-in-the-middle attackAttackalso MITM · man-in-the-middle · on-path attack#: An attacker positioned between two parties who relays and may alter their traffic while appearing legitimate to both.→ Downgrade attack → mTLS → TLS 1.3 → X25519MLKEM768 → Certificate authority
Merkle treeMathematicsalso hash tree#: A tree of hashes in which each parent commits to its children, allowing inclusion in a large set to be proved with a short path.→ Hash function → XMSS → LMS → Certificate Transparency → Evidence Ledger
Method versionPlatform#: The pinned identifier of the scoring rules in force when a result was produced, stamped onto every finding, report and attestation.→ The Theos Method → Evidence Ledger → Detector → Posture Attestation The Theos Method
Migration windowGovernance#: The time an organisation has left to complete its migration before its longest-lived secrets are exposed, which is set by data lifetime rather than by the industry's timeline.The window is not the same for every organisation, and for some categories of data it has already closed. Multi-year migrations are normal: discovery, vendor dependency, validated-module availability and change control each consume time that cannot be parallelised away.We publish the arithmetic behind our own view of it rather than a countdown, because the uncertain term is the one we cannot measure.→ Mosca inequality → Confidentiality lifetime → Cryptographically relevant quantum computer → CNSA 2.0 → Deep Migration Engagement The migration window, with the arithmetic
ML-DSA (Dilithium)Algorithmalso ML-DSA · Dilithium · CRYSTALS-Dilithium · Module-Lattice-Based Digital Signature Algorithm#: The lattice-based signature scheme standardised in FIPS 204, intended as the general-purpose replacement for RSA and ECDSA signatures.The parameter sets are ML-DSA-44, ML-DSA-65 and ML-DSA-87. Signatures run to a few kilobytes, which is the main integration constraint: certificate chains, signed tokens and firmware headers all grow, and some of them sit behind fixed-size fields or packet-size limits.ML-DSA is a Fiat–Shamir construction designed so that a correct implementation needs no secret-dependent branching. It is the scheme most enterprise migrations should reach for first, unless a specific size or conservatism argument points elsewhere.→ FIPS 204 → Digital signature → Module-LWE → Fiat–Shamir transform → SLH-DSA (SPHINCS+)→ FN-DSA (Falcon)FIPS 203, 204 and 205, mapped to output
ML-KEM (Kyber)Algorithmalso ML-KEM · Kyber · CRYSTALS-Kyber · Module-Lattice-Based Key-Encapsulation Mechanism#: The lattice-based key-encapsulation mechanism standardised in FIPS 203, and the default post-quantum replacement for classical key exchange.Three parameter sets are defined: ML-KEM-512, ML-KEM-768 and ML-KEM-1024, targeting NIST security categories 1, 3 and 5 respectively. ML-KEM-768 is the common choice for general transport security; CNSA 2.0 requires ML-KEM-1024 for national-security systems.Public keys and ciphertexts are larger than an elliptic-curve equivalent — of the order of a kilobyte at the 768 parameter set rather than 32 bytes — but encapsulation and decapsulation are fast, often faster than the arithmetic they replace. The cost lands on bandwidth and packet size, not CPU, which is why handshake measurement matters more than benchmark tables.→ FIPS 203 → Key encapsulation mechanism → Module-LWE → Hybrid key exchange → X25519MLKEM768 → NIST security category FIPS 203, 204 and 205, mapped to output
Module-LWEMathematicsalso MLWE · module lattice#: A structured variant of learning with errors that works over small matrices of polynomials, giving a security and performance dial that plain LWE lacks.→ Learning with errors → Ring-LWE → ML-KEM (Kyber)→ ML-DSA (Dilithium)→ Number-theoretic transform
Mosca inequalityMathematicsalso Mosca theorem · x + y > z#: The planning rule that if the time your data must stay secret plus the time your migration takes exceeds the time until a quantum attacker exists, you are already late.Written out: x is confidentiality lifetime, y is migration duration, z is time to a cryptographically relevant quantum computer. If x + y > z, exposure has already begun. The value of the inequality is not the arithmetic but the shape of it — two of the three terms are under your control, and the third is not.We publish our own working of it rather than a countdown clock, because z is an estimate with wide error bars and presenting it as a deadline would misrepresent what is known.→ Confidentiality lifetime → Migration window → Cryptographically relevant quantum computer → Harvest now, decrypt later The migration window, with the arithmetic
mTLSProtocolalso mutual TLS · client certificate authentication#: TLS in which both sides present certificates, so the client is authenticated cryptographically rather than by a bearer token.→ TLS 1.3 → X.509 → PKI → Certificate authority → Crypto-agility
Multivariate cryptographyMathematics#: Cryptography built on the difficulty of solving systems of multivariate polynomial equations, historically a source of very short signatures.The family has a poor security record. Several prominent candidates in the NIST process were broken during evaluation, including the Rainbow scheme that reached the final round. NIST continues to consider multivariate designs among additional signature candidates, but none is standardised.→ Cryptanalysis → Post-quantum cryptography → Digital signature

N12

NIS2Governance#: The EU directive raising cybersecurity requirements across essential and important entities in sectors including energy, transport, health and digital infrastructure.→ DORA → ISO/IEC 27001 → Cryptographic inventory
NISQHardwarealso Noisy Intermediate-Scale Quantum#: The current era of quantum hardware: machines large enough to be interesting but too noisy to run long algorithms without error correction.NISQ devices cannot run Shor's algorithm at cryptographically meaningful sizes, and no amount of adding noisy qubits changes that. Demonstrations of computational advantage on specially chosen problems are real results that say nothing about factoring a 2048-bit modulus.→ Quantum error correction → Cryptographically relevant quantum computer → Physical qubit → Decoherence
NIST Cybersecurity FrameworkStandardalso NIST CSF · CSF 2.0#: NIST's high-level framework organising security work into Govern, Identify, Protect, Detect, Respond and Recover.→ Cryptographic inventory → ISO/IEC 27001 → Zero Trust Architecture → Baseline Assessment
NIST security categoryStandardalso security category 1 · category 3 · category 5#: The five-level scale NIST used in the post-quantum process to express target strength by comparison with breaking AES or finding SHA collisions.→ Security level → ML-KEM (Kyber)→ ML-DSA (Dilithium)→ AES
NIST SP 800-131AStandard#: NIST's transition guidance on cryptographic algorithms and key lengths, which sets out what is approved, deprecated, restricted or disallowed and when.SP 800-131A is the document that makes algorithm retirement concrete rather than aspirational. It is how SHA-1, small RSA keys and legacy modes acquired end dates, and it is the natural home for the post-quantum transition schedule as NIST develops it.→ SHA-1 → RSA → Security level → CNSA 2.0 → Cryptographic inventory
NIST SP 800-208Standard#: NIST's recommendation for stateful hash-based signatures, approving LMS, HSS and XMSS for federal use ahead of the stateless standard.→ LMS → XMSS → SLH-DSA (SPHINCS+)→ Code signing → CNSA 2.0
NIST SP 800-56Standardalso SP 800-56A · SP 800-56B · SP 800-56C#: The NIST recommendations for key establishment — discrete-log schemes, integer-factorisation schemes, and the derivation of keys from the shared secrets they produce.→ ECDH → Diffie–Hellman → HKDF → Hybrid key exchange → Key encapsulation mechanism
NIST SP 800-57Standard#: NIST's recommendation for key management, covering key lifecycles, cryptoperiods, roles and the handling of keys from generation to destruction.→ Key management → Key rotation → Confidentiality lifetime → KMS
NIST SP 800-90AStandard#: The NIST specification for approved deterministic random bit generators, including the hash, HMAC and counter-mode constructions.→ DRBG → Entropy → True random number generator
Nonce reuseAttackalso IV reuse · nonce misuse#: Using the same number-used-once twice under the same key, which in most constructions is not a degradation but a total failure.The consequences vary by primitive and are all bad. Repeat a nonce in AES-GCM and you lose confidentiality for both messages and leak the authentication key. Repeat or bias a nonce in ECDSA and the private key falls out with simple algebra.Nonce failures cluster around the same causes: cloned virtual machines, restored snapshots, weak entropy at boot, and counters that reset. They are worth hunting for independently of any quantum consideration.→ AES-GCM → ECDSA → Entropy → DRBG → EdDSA
NTRUAlgorithm#: One of the oldest practical lattice cryptosystems, whose structure underlies FN-DSA and several earlier key-exchange proposals.→ Lattice → FN-DSA (Falcon)→ Ring-LWE
Number-theoretic transformMathematicsalso NTT#: A discrete Fourier transform over a finite field that turns polynomial multiplication from a quadratic operation into a near-linear one.The NTT is why lattice schemes are fast enough to deploy. It is also a favourite side-channel target, because its butterfly structure spreads secret coefficients across many predictable operations. Hardware NTT support is becoming a differentiator in accelerators and secure elements.→ Module-LWE → ML-KEM (Kyber)→ Side-channel attack → Constant-time implementation

OCSPProtocolalso Online Certificate Status Protocol · OCSP stapling#: A protocol for asking whether a specific certificate has been revoked, answered by a signed response from the issuer.→ CRL → X.509 → Certificate authority → Key rotation

Padding oracle attackAttack#: Recovering plaintext by observing whether a system reports a padding error, turning a small behavioural difference into full decryption.The RSA PKCS #1 v1.5 variant published by Bleichenbacher in 1998 has been rediscovered in deployed products repeatedly since, under a series of new names. It is the clearest illustration that cryptographic risk lives in implementations, not only in algorithm choice.→ RSA padding modes → Chosen-ciphertext attack → Timing attack → AEAD
Perfect forward secrecyProtocolalso PFS · forward secrecy#: The property that compromising a long-term private key later does not decrypt sessions recorded earlier, because each session used an ephemeral key.Forward secrecy defeats an adversary who steals a server key. It does not defeat an adversary who breaks the mathematics, because the ephemeral key exchange is itself recoverable. This is the single most common misunderstanding we correct in early conversations.→ ECDH → Harvest now, decrypt later → TLS 1.3 → Hybrid key exchange
Performance proofPlatform#: Measuring the latency, throughput and handshake-size impact of a proposed cryptographic change on the customer's own traffic before it ships.Post-quantum objections in production are almost always about performance and packet size, not security. Answering them with a measurement rather than a vendor benchmark is what moves a change through a review board.What we measure is our own harness against the customer's traffic profile. We do not publish comparative benchmarks against other products.→ ML-KEM (Kyber)→ QUIC → Hybrid key exchange → Deep Migration Engagement → TLS 1.3 Proving the performance impact
Physical qubitHardware#: An actual hardware qubit, noisy and error-prone, of which many are needed to build one reliable logical qubit.→ Logical qubit → Quantum error correction → Qubit → NISQ
PKCS #11Hardwarealso Cryptoki#: The long-standing API through which applications talk to HSMs, smart cards and software key stores.→ HSM → KMS → Crypto-agility → FIPS 140-3
PKIProtocolalso public key infrastructure#: The system of authorities, policies, certificates and revocation machinery that lets one party trust another's public key.Most enterprises run several PKIs without meaning to: a public web PKI, an internal Microsoft-based one, a service-mesh authority, a device-manufacturing authority, and whatever the payments platform brought with it. Each has its own algorithm agility, and the least agile one sets the pace.→ X.509 → Certificate authority → CSR → Certificate Transparency → Crypto-agility → Cryptographic inventory
Post-quantum cryptographyAlgorithmalso PQC · quantum-resistant cryptography · quantum-safe cryptography#: Public-key cryptography designed to remain secure against an adversary with a large quantum computer, while running on ordinary classical hardware.Post-quantum cryptography is not quantum cryptography. It needs no special hardware, no new network and no physics. It is conventional software built on mathematical problems that quantum algorithms are not known to solve efficiently.We prefer the term post-quantum to quantum-safe. Nothing here is provably safe; these are the best-analysed constructions currently standardised, and SIKE is a reminder of what that guarantee is worth.→ ML-KEM (Kyber)→ ML-DSA (Dilithium)→ SLH-DSA (SPHINCS+)→ Quantum key distribution → SIKE → Crypto-agility
Posture AttestationPlatform#: A signed, verifiable statement of an estate's cryptographic posture at a point in time, issued at the end of an engagement and checkable by any third party.An attestation records what was assessed, what the method version was, what was found and what was out of scope. The scope statement is as load-bearing as the result: an attestation that does not say what it did not examine is not evidence.It is not a certification, and we do not present it as one. It is a dated record of an assessment we performed, which a counterparty can verify against our Attestation Lookup.→ Evidence Ledger → Method version → The Theos Method → SOC 2 → Baseline Assessment Attestation Lookup

Quantum error correctionHardwarealso QEC · surface code#: Encoding quantum information redundantly across many physical qubits so errors can be detected and corrected faster than they accumulate.→ Logical qubit → Physical qubit → Decoherence → NISQ → Threat Radar
Quantum key distributionHardwarealso QKD#: Using quantum physics rather than mathematics to establish a shared key, detecting eavesdropping through the disturbance measurement causes.QKD is a different technology from post-quantum cryptography and not a substitute for it. It needs dedicated fibre or line of sight, it does not solve authentication, it cannot be deployed to software endpoints, and several national security agencies have published guidance against relying on it for general use.It has real niche applications. It is not part of an enterprise migration plan, and we do not recommend it as one.→ Post-quantum cryptography → True random number generator → Hybrid key exchange
Quantum volumeHardware#: A single-number benchmark combining qubit count and error rate to express the size of circuit a machine can run reliably.→ Qubit → Cryptographically relevant quantum computer → NISQ
QubitHardware#: The basic unit of quantum information, which unlike a classical bit can hold a superposition of states and be entangled with other qubits.Qubit counts are the most quoted and least informative quantum metric. A machine's usefulness depends on error rates, connectivity, gate fidelity and coherence time as much as on number, which is why a headline count says almost nothing about cryptographic risk.→ Physical qubit → Logical qubit → Quantum error correction → Decoherence → Quantum volume
QUICProtocol#: A UDP-based transport with TLS 1.3 built in, used by HTTP/3 and increasingly by internal service traffic.→ TLS 1.3 → Hybrid key exchange → Performance proof

Replay attackAttack#: Resubmitting a previously valid message, signature or token in a context where it should no longer be accepted.→ Nonce reuse → JWT → Machine-in-the-middle attack → Kerberos
Ring-LWEMathematicsalso RLWE#: A learning-with-errors variant over polynomial rings, which shrinks keys dramatically by giving the lattice extra algebraic structure.→ Learning with errors → Module-LWE → NTRU → Lattice
Risk tierPlatform#: The ordered band an asset falls into once its exposure score is computed, used to sequence remediation rather than to describe severity in the abstract.Tiers exist because a ranked list of several hundred findings is not actionable. They group work into batches an owner can schedule, and they carry the sequencing logic: hard-to-change assets with wide blast radius start early even where immediate exposure is moderate.[PLACEHOLDER: risk tier band names and the exposure-score cut-offs for each]→ Exposure score → Blast radius → Finding → Migration window What the risk tiers mean
RSAAlgorithmalso Rivest–Shamir–Adleman · RSA-2048 · RSA-4096#: The public-key cryptosystem whose security rests on the difficulty of factoring large integers, used for both encryption and signatures since 1977.RSA is the most common finding in an enterprise cryptographic inventory: TLS certificates, code-signing keys, signed tokens, SSH host keys, S/MIME identities, VPN device certificates, database key wrappers. It is also fully broken by a sufficiently capable quantum computer, because factoring is exactly what Shor's algorithm does efficiently.Increasing the key size does not help against that attack. RSA-4096 buys classical margin, not quantum margin. The migration path is ML-KEM for key establishment and ML-DSA or SLH-DSA for signatures.→ Integer factorisation → Shor's algorithm → RSA padding modes → ML-KEM (Kyber)→ ML-DSA (Dilithium)→ NIST SP 800-131A
RSA padding modesAlgorithmalso RSA-OAEP · RSA-PSS · PKCS #1 v1.5#: The schemes that turn raw RSA arithmetic into a usable primitive — OAEP for encryption, PSS for signatures, and the legacy PKCS #1 v1.5 for both.Padding choice is a genuine inventory field, not a detail. PKCS #1 v1.5 encryption has a long history of padding-oracle attacks and should be treated as legacy wherever it survives; PKCS #1 v1.5 signatures remain widespread and are still permitted in many profiles, which is why they persist.None of these choices affects quantum exposure. A correctly padded RSA key and a badly padded one fall to the same attack.→ RSA → Padding oracle attack → Chosen-ciphertext attack → Digital signature

S17

S/MIMEProtocol#: The standard for signed and encrypted email using X.509 certificates, common in government, legal and financial correspondence.→ X.509 → Harvest now, decrypt later → Confidentiality lifetime → PKI
SAMLProtocolalso Security Assertion Markup Language#: The XML-based single sign-on standard still widely used for enterprise federation, in which assertions are signed by the identity provider.→ JWT → RSA → Kerberos → Digital signature
SBOMStandardalso software bill of materials#: A machine-readable inventory of the components and dependencies inside a piece of software.An SBOM tells you that a build links OpenSSL 3.0. It does not tell you which curve that build negotiates, which certificate it presents, or whether a configuration file disables the modern cipher suites. That gap is what a cryptographic bill of materials exists to close.→ CBOM → CycloneDX → Cryptographic inventory → Supply-chain attack
Secure enclaveHardwarealso TEE · trusted execution environment · secure element#: An isolated execution environment on a processor that protects keys and computation from the operating system running alongside it.→ TPM → HSM → Side-channel attack → ML-KEM (Kyber)
Security levelMathematicsalso bits of security · security strength#: A rough measure of how much work an attack requires, expressed as the exponent of a power of two — 128-bit security means about 2^128 operations.Security level is a comparison device, not a physical prediction. Its most common misuse is treating the classical and quantum figures for a scheme as interchangeable, or assuming that a larger RSA modulus raises the quantum security level, which it does not.→ NIST security category → Grover's algorithm → AES → NIST SP 800-131A
SHA-1Algorithmalso MD5 · legacy hash#: A retired 160-bit hash function with practical collision attacks, still found in old certificates, signed artefacts and internal tooling.→ Collision attack → SHA-2 → NIST SP 800-131A → Hash function
SHA-2Algorithmalso SHA-256 · SHA-384 · SHA-512#: The hash family that underpins most deployed signatures, certificates, message authentication codes and integrity checks.→ Hash function → SHA-3 → SHA-1 → HMAC → Collision attack → Security level
SHA-3Algorithmalso Keccak · SHA3-256 · SHA3-512#: The Keccak-based hash family standardised as a structurally different alternative to SHA-2, not as a replacement for it.→ SHAKE → SHA-2 → Hash function → ML-KEM (Kyber)
SHAKEAlgorithmalso SHAKE128 · SHAKE256 · extendable-output function · XOF#: The extendable-output functions from the SHA-3 family, which produce output of any requested length rather than a fixed-size digest.SHAKE is where SHA-3 actually shows up in most estates: ML-KEM and ML-DSA use it internally for hashing, expansion and sampling, and SLH-DSA offers SHAKE-based parameter sets. A platform with no SHA-3 support in its accelerator or its validated module can therefore become a blocker for post-quantum deployment.→ SHA-3 → ML-KEM (Kyber)→ ML-DSA (Dilithium)→ SLH-DSA (SPHINCS+)→ FIPS 140-3
Shor's algorithmAttack#: The quantum algorithm, published in 1994, that factors integers and computes discrete logarithms efficiently, breaking every public-key scheme in wide deployment.Shor's algorithm is the reason this field exists. It does not weaken RSA or elliptic-curve cryptography; it removes their security entirely, and no key size restores it. Running it against real key sizes requires a large fault-tolerant quantum computer, which does not exist today.We do not publish a qubit count for breaking RSA-2048. Published resource estimates vary by orders of magnitude, depend heavily on assumed error rates and architecture, and continue to fall as algorithms improve. Any single figure presented as settled fact should be treated with suspicion, including ours.→ Grover's algorithm → Integer factorisation → Discrete logarithm problem → Cryptographically relevant quantum computer → RSA → Logical qubit What a quantum computer actually breaks
Shortest vector problemMathematicsalso SVP · closest vector problem · CVP#: The problem of finding the shortest non-zero vector in a lattice, one of the hard problems that lattice cryptography reduces to.No efficient quantum algorithm for the approximate shortest vector problem is known, which is the basis for believing lattice schemes survive Shor. That is an absence of evidence rather than a proof, and it is the honest limit of every security claim in this field.→ Lattice → Lattice reduction → Learning with errors → Cryptanalysis
Side-channel attackAttackalso differential power analysis · power analysis · electromagnetic analysis#: Recovering a secret by measuring a physical effect of the computation — time, power draw, electromagnetic emission, sound or cache behaviour — rather than attacking the mathematics.Side channels break correct algorithms in incorrect implementations, and post-quantum schemes have supplied a fresh crop of them: leakage from rejection sampling, from secret-indexed table lookups, and from the number-theoretic transform. Several published attacks recover ML-KEM and ML-DSA keys from implementations that were otherwise standards-conformant.This is why algorithm selection is not the end of a migration. The library, the version and the platform all belong in the record.→ Timing attack → Fault injection → Constant-time implementation → Number-theoretic transform → HSM
SIKEAlgorithmalso Supersingular Isogeny Key Encapsulation · SIDH#: An isogeny-based KEM that reached the final round of the NIST process and was then broken by classical cryptanalysis in 2022.SIKE is the most useful cautionary tale in the field. It had small keys, years of public scrutiny and a clean security argument, and it fell to a mathematical attack that needed no quantum computer at all. It is why we recommend hybrid deployments and why we will not describe any single algorithm as permanently safe.If SIKE appears in an inventory it is a finding, not a migration target. Remove it.→ Isogeny → Cryptanalysis → Hybrid key exchange → Crypto-agility
SLH-DSA (SPHINCS+)Algorithmalso SLH-DSA · SPHINCS+ · Stateless Hash-Based Digital Signature Algorithm#: The stateless hash-based signature scheme standardised in FIPS 205, whose security rests only on the strength of its hash function.SLH-DSA needs no lattice assumption and no signing state, which makes it the conservative choice for keys that must stay trustworthy for decades — root certificates, firmware signing roots, long-lived attestation keys. The price is size and speed: signatures run to tens of kilobytes and signing is slow relative to ML-DSA.Parameter sets come in s (small signature, slower signing) and f (fast signing, larger signature) variants at 128-, 192- and 256-bit security, over either SHA-2 or SHAKE. Pick the hash family before you pick the size; changing it later is a re-issuance event.→ FIPS 205 → Hash function → SHAKE → Digital signature → ML-DSA (Dilithium)→ XMSS → LMS FIPS 203, 204 and 205, mapped to output
SOC 2Standard#: An AICPA reporting framework for service organisations, in which an independent auditor reports on controls over security, availability and related criteria.A Type I report says the controls existed on a date. A Type II report says they operated over a period, usually three to twelve months, and is what enterprise procurement normally asks for.Theos Quantum's own report status is published in the Assurance Center. [PLACEHOLDER: SOC 2 report type, audit period and auditor name]→ ISO/IEC 27001 → Evidence Ledger → Posture Attestation Assurance Center
SSHProtocolalso Secure Shell · OpenSSH#: The protocol used for remote administration and automated file transfer, and one of the few places post-quantum key exchange shipped early and by default.→ Ed25519 → Hybrid key exchange → Key rotation → Cryptographic inventory → Asset
Supply-chain attackAttack#: Compromising software, firmware or a dependency before it reaches the target, so the target installs the compromise itself.→ Code signing → SBOM → CBOM → Blast radius → Zero-day

The Theos MethodPlatform#: Our published assessment and scoring methodology: the detector catalogue, the scoring inputs and weights, the tier boundaries and the error reporting.→ Method version → Exposure score → Detector → Evidence Ledger → Posture Attestation The Theos Method
Threat RadarPlatform#: Our public tracker of developments that change the migration calculus — standards activity, cryptanalytic results, error-correction milestones and vendor support.→ Quantum error correction → Cryptanalysis → Cryptographically relevant quantum computer → Migration window Threat Radar
Timing attackAttack#: A side channel in which the time an operation takes reveals something about the secret data it processed.→ Side-channel attack → Constant-time implementation → Padding oracle attack
TLS 1.3Protocolalso Transport Layer Security · TLS · HTTPS#: The current version of the protocol that encrypts almost all network traffic, specified in RFC 8446 and the main surface where post-quantum key exchange is being deployed.TLS 1.3 removed static RSA key transport and made ephemeral key agreement mandatory, which is why post-quantum work in TLS is about named groups rather than cipher suites. It also cut the handshake to one round trip, which makes the larger post-quantum key shares visible as an extra packet rather than as CPU time.In an inventory, the TLS version is rarely the interesting field. The negotiated group, the certificate signature algorithm and the client population that constrains both are what determine migration difficulty.→ Hybrid key exchange → X25519MLKEM768 → Cipher suite → Perfect forward secrecy → X.509 → QUIC
TPMHardwarealso Trusted Platform Module · hardware root of trust#: A small dedicated chip on a host that holds keys, measures boot integrity and provides a hardware anchor for platform attestation.→ Secure enclave → HSM → Fault injection → Code signing
True random number generatorHardwarealso TRNG · entropy source · quantum random number generator · QRNG#: A hardware source that produces randomness from a physical process rather than an algorithm, used to seed deterministic generators.Quantum random number generators are sometimes marketed as a quantum-security product. They are a good entropy source and nothing more: they do not address Shor's algorithm, and an estate with excellent randomness and RSA key exchange is still fully exposed.→ Entropy → DRBG → NIST SP 800-90A → Quantum key distribution

X.509Protocolalso certificate · digital certificate#: The certificate format that binds a public key to an identity under a signature from a certificate authority, and the substrate of TLS, S/MIME and code signing.Post-quantum migration of the X.509 ecosystem is a coordination problem more than a cryptographic one. A certificate is verified by software you do not control, so a new signature algorithm can only be issued once relying parties understand it. Chain size also grows sharply once every signature in the path is post-quantum.For inventory purposes the fields that matter are the key algorithm, the signature algorithm, the validity window and the issuer — a certificate can hold an elliptic-curve key while being signed with RSA, and both need recording.→ PKI → Certificate authority → CSR → OCSP → CRL → Composite signature → Asset
X25519Algorithm#: The Curve25519 Diffie–Hellman function used for key agreement in most modern TLS, SSH and VPN handshakes.→ ECDH → Hybrid key exchange → X25519MLKEM768 → TLS 1.3 → Elliptic curve
X25519MLKEM768Protocol#: The registered TLS named group that combines X25519 with ML-KEM-768, and the hybrid key exchange most widely deployed on the public web.Major browsers, content delivery networks and cloud load balancers negotiate this group by default, so a large share of internet traffic is already protected against recorded-session decryption. Enterprise estates behind TLS-inspecting middleboxes are frequently the last places it is not.An earlier draft codepoint pairing X25519 with a pre-standard Kyber is still present in some deployments. Treat it as a finding: it is not interoperable with the final standard.→ Hybrid key exchange → ML-KEM (Kyber)→ X25519 → TLS 1.3 → Downgrade attack
XMSSAlgorithmalso eXtended Merkle Signature Scheme · XMSS-MT#: A stateful hash-based signature scheme, specified in RFC 8391 and approved for federal use by NIST SP 800-208.Stateful means the signer must never reuse a one-time key from its Merkle tree. Reuse does not degrade security gracefully; it can be catastrophic. That makes XMSS a poor fit for anything replicated, load-balanced, snapshotted or restored from backup, and a reasonable fit for a single hardware-held firmware-signing key with disciplined state handling.Where state discipline cannot be guaranteed, SLH-DSA gives hash-based security without the bookkeeping.→ NIST SP 800-208 → LMS → Merkle tree → SLH-DSA (SPHINCS+)→ Code signing → HSM

Zero Trust ArchitectureGovernancealso ZTA · zero trust#: A security model that grants no implicit trust based on network position, authenticating and authorising every request instead.→ mTLS → Crypto-agility → PKI → NIST Cybersecurity Framework
Zero-dayAttack#: A vulnerability being exploited before a fix exists, distinct from the far more common case of an available patch that has not been applied.→ CVE → KEV catalogue → Supply-chain attack

Back to the knowledge base