Bare post-quantum algorithm declared without a classical hybrid partner

pqc_hybrid

Severity

info

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Vendor

All

Resource

Encryption

Description

During the transition to post-quantum cryptography, several national standards (BSI TR-02102, ANSSI) recommend a hybrid construction: a post-quantum scheme combined with a classical one, so that a weakness in the still-young post-quantum algorithm cannot, on its own, break the protection.

The detector reports infrastructure that declares a bare (pure) post-quantum key establishment or signature — a KMS key created as ML-DSA, a listener naming a pure ML-KEM group. An algorithm that is already hybrid (X25519MLKEM768, SecP256r1MLKEM768) is the goal state and is not reported, and a classical algorithm is `pqc_readiness’ finding rather than this rule’s.

The verdict is the one the code-side pqc_hybrid rules make — the same shared classifier reads the same algorithm catalogue — so a project cannot be told that ML-KEM in its code needs a hybrid partner while the same algorithm in its infrastructure does not.

Because the algorithm is already quantum-safe, this is an advisory, policy-gated signal.

Examples

Terraform

resource "aws_kms_key" "release_signing" {
  description              = "release signing key"
  customer_master_key_spec = "ML_DSA_65" (1)
}

1	A bare post-quantum signature key: quantum-safe, but with no classical partner to fall back on.

Mitigation / Fix

Buildtime

Where transition guidance applies, pair the post-quantum algorithm with a classical one: a hybrid KEM such as X25519+ML-KEM-768 for key establishment, a classical (EdDSA/ECDSA) signature alongside ML-DSA for signing. Where the platform offers no hybrid spec, keep the classical key in service beside the post-quantum one until it does.

resource "aws_kms_key" "release_signing" {
  description              = "release signing key"
  customer_master_key_spec = "ML_DSA_65"
}

resource "aws_kms_key" "release_signing_classical" {
  description              = "classical partner of the release signing key" # FIXED
  customer_master_key_spec = "ECC_NIST_P384"
}

Where policy instead mandates pure post-quantum cryptography — NSA CNSA 2.0 does — set requireHybrid: false on the detector and it reports nothing. That is the same property, with the same default, the code-side rules use: a project that disagrees with itself about hybrid deployment reports contradictory findings for the same algorithm.