How to Scan Your Codebase for Quantum-Vulnerable Cryptography (Free Open Source Tool)

If your codebase uses RSA, ECC, DSA, or ECDSA, it is already vulnerable to quantum computers. Adversaries are collecting encrypted traffic today under the "harvest now, decrypt later" strategy. I built an open-source tool called Quantum Migration Toolkit that scans your entire codebase for quantum-vulnerable cryptography and automatically remediates it.

Why You Need to Act Now

Large-scale quantum computers will break RSA, ECC, DSA, and ECDSA via Shor's algorithm. Three major regulations are already in effect:

• U.S. OMB M-23-02 / NSM-10 — federal agencies must inventory quantum-vulnerable systems
• NSA CNSA 2.0 — mandates ML-KEM and ML-DSA for National Security Systems by 2030–2035
• EU NIS2 — requires quantum risk assessment for critical infrastructure

NIST finalized three post-quantum cryptography standards in 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). Migration starts now.

What Quantum Migration Toolkit Does

• Scans 9+ languages using regex + Tree-sitter AST
• Detects RSA, ECC, DSA, DES, RC4, MD5, SHA-1, weak RNG, hardcoded secrets — 18 total patterns
• Remediates findings with a local AI model grounded in real PQC API definitions
• Vendors a working ML-KEM + ML-DSA + AES-256-GCM SDK into your project
• Patches your build system automatically — CMake, pip, Cargo, Maven, Gradle, Go, NPM
• Outputs SARIF 2.1.0 for CI/CD and CycloneDX 1.6 CBOM for cryptographic asset inventory

Installation

Prerequisites

• C++17 compiler (GCC 7+, Clang 5+, MSVC 2019+)
• CMake 3.18+
• OpenSSL 3.0+

Build on Linux/macOS

git clone https://github.com/Savaid-Khan-Official/Quantum-Migration-Toolkit.git
cd Quantum-Migration-Toolkit
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel

First-time build fetches and compiles liboqs in about 5–10 minutes. Subsequent builds take seconds.

Running Your First Scan

./build/cli/quantum-migrate /path/to/your/code

Output looks like this:

[CRITICAL] VULN-RSA-001 — crypto/auth.cpp:42
  RSA_generate_key_ex(rsa, 2048, e, NULL)
  Migrate to: ML-KEM-768 (FIPS 203)

[CRITICAL] VULN-ECC-001 — src/tls.py:17
  EC_KEY_generate_key(eckey)
  Migrate to: ML-DSA-65 (FIPS 204)

[HIGH] VULN-MD5-001 — utils/hash.go:8
  md5.New()
  Migrate to: SHA-256

For a full scan with entropy detection and CI/CD output:

./build/cli/quantum-migrate /path/to/code --entropy --proximity --format=sarif --output=results.sarif --fail-on=critical

AI-Assisted Remediation

./build/cli/quantum-migrate /path/to/code \
  --remediate \
  --model models/qwen2.5-coder-14b-instruct-q4_k_m.gguf \
  --vendor-into /path/to/code \
  --patch-build-system \
  --backup

Recommended model is Qwen2.5-Coder-14B-Instruct Q4_K_M (~9 GB). The tool injects real PQC API signatures into every prompt — this eliminates hallucinated function names that plague generic LLM rewrites.

Add --apply to write fixes directly to source. Every modified file is backed up and compile-checked — if it fails to compile it rolls back automatically.

Real-World Performance

Tested across five real open-source projects totaling 7,409 files:

Hand-labeled precision on OpenSSH: 96.9% — 124 out of 128 findings were true positives.

Migration Targets

Try It on the Test Repo

./build/cli/quantum-migrate test_repo/ --entropy --proximity --output=audit.txt

Expected output is 36–42 findings across C++, Python, Java, Go, Rust, and JavaScript. Good way to see exactly what it looks like before scanning your own code.

Get Started

The toolkit is open source under MIT.

GitHub: Quantum Migration Toolkit

LinkedIn: Savaid Khan

Website: savaidkhan.com

Star the repo if you find it useful and open an issue for any languages or patterns you want added. Questions welcome in the comments.