skills.rest
blamejs
blamejsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

pqc-first

Enforce post-quantum cryptography standards and analyze compliance gaps across security frameworks.

Updated May 11, 2026
Search Tags:#post-quantum cryptography#compliance gap analysis#pqc migration#harvest-now-decrypt-later#crypto version gating#nist fips 203#quantum risk
One-click install
npx skills add https://github.com/blamejs/exceptd-skills --skill pqc-first
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pqc-first
Source: https://github.com/blamejs/exceptd-skills/tree/main/skills/pqc-first
Command: npx skills add https://github.com/blamejs/exceptd-skills --skill pqc-first

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Most security and compliance frameworks use outdated, algorithm-agnostic cryptographic requirements that leave systems vulnerable to harvest-now-decrypt-later (HNDL) attacks when cryptographically relevant quantum computers (CRQCs) become available, and many organizations use outdated, unsupported cryptographic library versions that lack post-quantum algorithm support.

Core Features & Use Cases

  • Hard version gates: Enforce minimum supported versions for OpenSSL, Go, Rust, Python, Java, and other crypto libraries to ensure post-quantum algorithm availability.
  • Algorithm registry and selection guide: Reference production-ready NIST-standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) and guidance for deprecated classical algorithms and hybrid cryptographic constructions.
  • Compliance gap analysis: Identify where major frameworks (NIST 800-53, ISO 27001, PCI DSS, NIS2, etc.) fail to mandate post-quantum cryptography, and assess HNDL risk for data with long sensitivity windows.
  • Use Case: A security team can use this skill to audit their organization's TLS configuration, enforce OpenSSL 3.5+ as a minimum version, replace standalone RSA key exchange with hybrid X25519+ML-KEM-768, and document compliance gaps for their annual ISO 27001 audit.

Quick Start

Use the pqc-first skill to audit your organization's cryptographic library versions and flag any non-compliant classical-only algorithms in use for your TLS and code signing workflows.

Frequently Asked Questions about pqc-first

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze compliance gaps for post-quantum cryptography in NIST 800-53 or ISO 27001?▼

Compliance gap analysis identifies where frameworks like NIST 800-53 and ISO 27001 fail to mandate post-quantum cryptography, assessing harvest-now-decrypt-later risk for long-sensitivity-window data. It documents cryptographic control gaps for legacy compliance audits.

What is the harvest-now-decrypt-later risk and how do I mitigate it during PQC migration?▼

Harvest-now-decrypt-later attacks occur when adversaries steal encrypted data now to decrypt it later using quantum computers. PQC migration mitigates this by adopting NIST FIPS 203 standardized algorithms like ML-KEM for quantum-resistant key exchange.

How do I enforce hard version gating for OpenSSL and other crypto libraries to ensure PQC support?▼

Hard version gating enforces minimum supported versions for crypto libraries like OpenSSL, Go, and Java to guarantee post-quantum algorithm availability. It flags non-compliant classical-only algorithms in TLS and code signing workflows.

Which NIST standardized post-quantum algorithms should I use for hybrid cryptographic constructions?▼

NIST FIPS 203/204/205 standardized algorithms include ML-KEM, ML-DSA, and SLH-DSA for production use. Hybrid cryptographic constructions combine these with classical algorithms like X25519 to ensure quantum resistance during migration.

Does PCI DSS or NIS2 require post-quantum cryptography for TLS configuration reviews?▼

Most frameworks like PCI DSS and NIS2 use outdated algorithm-agnostic requirements that fail to mandate post-quantum cryptography. TLS configuration reviews assess these compliance gaps and document HNDL risk for audit purposes.

When do I need to replace standalone RSA key exchange with hybrid X25519 plus ML-KEM-768?▼

Standalone RSA key exchange must be replaced with hybrid constructions like X25519 plus ML-KEM-768 when auditing TLS configurations for quantum resistance. This closes cryptographic control gaps and ensures production-ready PQC adoption.

Related Skills

Explore More Legal & Compliance Skills→
GhostPWNGhostPWN
4

Cryptographic Analysis & Assessment

Analyze cryptographic configurations and implementations for security weaknesses.

Official
Advanced
dtsongdtsong
1

pqc-readiness

Inventory classical crypto usage and plan phased PQC migration timelines.

Community
Advanced
ryukyagamilightryukyagamilight
1

audit

Configure auditd and scan Linux systems for vulnerabilities and compliance issues.

Community
Advanced
jaskaranhundaljaskaranhundal
3

quantum-security-readiness

Assess cryptographic readiness for quantum threats and generate a prioritized PQC migration roadmap.

Community
Advanced