Infrastructure declares quantum-vulnerable public-key cryptography

pqc_readiness

Severity

info

Remediation Complexity

hard

Remediation Risk

medium

Remediation Effort

high

Vendor

All

Resource

Encryption

Description

Shor’s algorithm breaks the mathematics every widely-deployed public-key algorithm rests on: RSA, DSA, Diffie-Hellman, and the elliptic-curve family (ECDSA, ECDH). No key size fixes this — a 4096-bit RSA key falls to the same algorithm a 2048-bit one does — so the primitive itself has to be replaced.

Infrastructure is where the most consequential instances live. A KMS key spec of RSA_2048, a Key Vault key of type RSA, or a load-balancer cipher suite whose key exchange is RSA all commit a system to an algorithm that a future quantum adversary breaks, and the traffic or data they protect is harvestable today and decryptable later.

This detector reports the cryptography an infrastructure template declares, using the same algorithm catalogue the code-side pqc_readiness rules use — so a given algorithm is judged identically wherever it is declared.

It is opt-in (Very_Strict) because the algorithms it reports are not broken today: the finding is a migration item, not a vulnerability.

Examples

Terraform

resource "aws_kms_key" "signing" {
  customer_master_key_spec = "RSA_2048" (1)
  description              = "release signing key"
}

1	The key material is RSA, which Shor’s algorithm breaks at any size.

Kubernetes

apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
spec:
  containers:
  - command:
    - kube-apiserver
    - --tls-cipher-suites=TLS_RSA_WITH_AES_256_GCM_SHA384 (1)
    name: kube-apiserver

1	The suite authenticates with RSA, so every session it negotiates is quantum-vulnerable.

Mitigation / Fix

Buildtime

Plan the migration rather than tuning the key size — there is no size that helps.

For keys a provider holds, create a new key with a post-quantum or hybrid algorithm as soon as the provider offers one, and re-issue whatever the old key signed or wrapped.
For transport, prefer a managed security policy that the provider updates, so the hybrid key exchange arrives without a template change.
Where the provider has no post-quantum option yet, record the resource in the migration inventory: the CBOM this scanner produces lists exactly these assets.

resource "aws_kms_key" "signing" {
  customer_master_key_spec = "SYMMETRIC_DEFAULT" # FIXED where the use allows a symmetric key
  description              = "release signing key"
}