Post-Quantum Cryptography Readiness

Post-quantum cryptography (PQC) addresses the threat that quantum computers pose to current cryptographic systems. Geode implements a comprehensive post-quantum preparedness strategy that protects sensitive graph data against both current and future threats. By combining strong symmetric encryption, mandatory forward secrecy, and cryptographic agility, Geode ensures your data remains secure even as quantum computing advances. <h3 id="the-quantum-threat" class="position-relative d-flex align-items-center group"> The Quantum Threat <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="the-quantum-threat" aria-haspopup="dialog" aria-label="Share link: The Quantum Threat"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script> <h4 id="understanding-quantum-computing-risks" class="position-relative d-flex align-items-center group"> Understanding Quantum Computing Risks <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="understanding-quantum-computing-risks" aria-haspopup="dialog" aria-label="Share link: Understanding Quantum Computing Risks"> Share link </button> </h4>Current asymmetric cryptography (RSA, ECC) relies on mathematical problems that quantum computers can solve efficiently: <table> <thead> <tr> <th>Algorithm</th> <th>Classical Security</th> <th>Quantum Attack</th> <th>Threat Level</th> </tr> </thead> <tbody> <tr> <td>RSA-2048</td> <td>112-bit</td> <td>Shor’s Algorithm</td> <td>Critical</td> </tr> <tr> <td>ECDSA P-256</td> <td>128-bit</td> <td>Shor’s Algorithm</td> <td>Critical</td> </tr> <tr> <td>ECDH/X25519</td> <td>128-bit</td> <td>Shor’s Algorithm</td> <td>Critical</td> </tr> <tr> <td>AES-256</td> <td>256-bit</td> <td>Grover’s Algorithm</td> <td>Manageable (128-bit)</td> </tr> <tr> <td>SHA-256</td> <td>256-bit</td> <td>Grover’s Algorithm</td> <td>Manageable (128-bit)</td> </tr> </tbody> </table> Key insight: Symmetric cryptography (AES) and hash functions (SHA) remain relatively secure against quantum attacks, but asymmetric cryptography used for key exchange and signatures is vulnerable. <h4 id="store-now-decrypt-later-sndl" class="position-relative d-flex align-items-center group"> Store Now, Decrypt Later (SNDL) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="store-now-decrypt-later-sndl" aria-haspopup="dialog" aria-label="Share link: Store Now, Decrypt Later (SNDL)"> Share link </button> </h4>The most immediate quantum threat is the “harvest now, decrypt later” attack: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Current Reality: 1. Adversary records encrypted network traffic 2. Traffic encrypted with classical cryptography 3. Storage is cheap - bulk collection is feasible Future Scenario: 1. Cryptographically relevant quantum computer (CRQC) becomes available 2. Adversary decrypts historical traffic 3. Sensitive data exposed years after transmission </code></pre></div> <h3 id="geodes-post-quantum-strategy" class="position-relative d-flex align-items-center group"> Geode&rsquo;s Post-Quantum Strategy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="geodes-post-quantum-strategy" aria-haspopup="dialog" aria-label="Share link: Geodes Post-Quantum Strategy"> Share link </button> </h3> <h4 id="layer-1-strong-symmetric-encryption" class="position-relative d-flex align-items-center group"> Layer 1: Strong Symmetric Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="layer-1-strong-symmetric-encryption" aria-haspopup="dialog" aria-label="Share link: Layer 1: Strong Symmetric Encryption"> Share link </button> </h4>AES-256 provides post-quantum security for data at rest and in transit: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml encryption: at_rest: enabled: true algorithm: "aes-256-gcm" # 128-bit post-quantum security key_size: 256 cipher_suites: - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 </code></pre></div> <h4 id="layer-2-mandatory-forward-secrecy" class="position-relative d-flex align-items-center group"> Layer 2: Mandatory Forward Secrecy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="layer-2-mandatory-forward-secrecy" aria-haspopup="dialog" aria-label="Share link: Layer 2: Mandatory Forward Secrecy"> Share link </button> </h4>Forward secrecy limits the value of future key compromise: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: min_version: "1.3" # Forward secrecy required session_resumption: enabled: true ticket_lifetime: 3600 # Short ticket lifetime </code></pre></div>Why this matters: Even if a future quantum computer breaks the key exchange algorithm, past symmetric session keys were never transmitted and remain protected. <h4 id="layer-3-cryptographic-agility" class="position-relative d-flex align-items-center group"> Layer 3: Cryptographic Agility <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="layer-3-cryptographic-agility" aria-haspopup="dialog" aria-label="Share link: Layer 3: Cryptographic Agility"> Share link </button> </h4>Geode’s architecture supports algorithm updates without major changes: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml cryptography: agility: enabled: true key_exchange: preferred: - "ML-KEM-768" # Post-quantum (when available) - "X25519" # Classical fallback hybrid_mode: true </code></pre></div> <h3 id="nist-post-quantum-standards" class="position-relative d-flex align-items-center group"> NIST Post-Quantum Standards <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="nist-post-quantum-standards" aria-haspopup="dialog" aria-label="Share link: NIST Post-Quantum Standards"> Share link </button> </h3> <h4 id="selected-algorithms" class="position-relative d-flex align-items-center group"> Selected Algorithms <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="selected-algorithms" aria-haspopup="dialog" aria-label="Share link: Selected Algorithms"> Share link </button> </h4>Key Encapsulation (Key Exchange): <table> <thead> <tr> <th>Standard</th> <th>Algorithm</th> <th>Security Level</th> <th>Key Size</th> <th>Ciphertext Size</th> </tr> </thead> <tbody> <tr> <td>FIPS 203</td> <td>ML-KEM-512</td> <td>1 (128-bit)</td> <td>800 bytes</td> <td>768 bytes</td> </tr> <tr> <td>FIPS 203</td> <td>ML-KEM-768</td> <td>3 (192-bit)</td> <td>1,184 bytes</td> <td>1,088 bytes</td> </tr> <tr> <td>FIPS 203</td> <td>ML-KEM-1024</td> <td>5 (256-bit)</td> <td>1,568 bytes</td> <td>1,568 bytes</td> </tr> </tbody> </table> Digital Signatures: <table> <thead> <tr> <th>Standard</th> <th>Algorithm</th> <th>Security Level</th> <th>Public Key</th> <th>Signature</th> </tr> </thead> <tbody> <tr> <td>FIPS 204</td> <td>ML-DSA-44</td> <td>2 (128-bit)</td> <td>1,312 bytes</td> <td>2,420 bytes</td> </tr> <tr> <td>FIPS 204</td> <td>ML-DSA-65</td> <td>3 (192-bit)</td> <td>1,952 bytes</td> <td>3,293 bytes</td> </tr> <tr> <td>FIPS 204</td> <td>ML-DSA-87</td> <td>5 (256-bit)</td> <td>2,592 bytes</td> <td>4,595 bytes</td> </tr> </tbody> </table> <h4 id="recommended-configuration" class="position-relative d-flex align-items-center group"> Recommended Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="recommended-configuration" aria-haspopup="dialog" aria-label="Share link: Recommended Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># Standard Security (most use cases) cryptography: post_quantum: key_encapsulation: "ML-KEM-768" # NIST Level 3 signature: "ML-DSA-65" # NIST Level 3 # High Security (government, financial) cryptography: post_quantum: key_encapsulation: "ML-KEM-1024" # NIST Level 5 signature: "ML-DSA-87" # NIST Level 5 </code></pre></div> <h3 id="hybrid-cryptography" class="position-relative d-flex align-items-center group"> Hybrid Cryptography <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hybrid-cryptography" aria-haspopup="dialog" aria-label="Share link: Hybrid Cryptography"> Share link </button> </h3>Hybrid mode combines classical and post-quantum algorithms for defense in depth: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Hybrid Key Exchange: classical_secret = X25519(client_private, server_public) pq_secret = ML-KEM.Decapsulate(ciphertext, client_private) shared_secret = KDF(classical_secret || pq_secret) Security: Attacker must break BOTH algorithms </code></pre></div> <h4 id="configuration" class="position-relative d-flex align-items-center group"> Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="configuration" aria-haspopup="dialog" aria-label="Share link: Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: hybrid: enabled: true mode: "require" key_exchange: classical: "X25519" post_quantum: "ML-KEM-768" authentication: classical: "Ed25519" post_quantum: "ML-DSA-65" </code></pre></div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">geode serve --tls-hybrid=enabled \ --tls-hybrid-kex=X25519+ML-KEM-768 geode tls-status --verbose # Hybrid Mode: Enabled # Key Exchange: X25519 + ML-KEM-768 </code></pre></div> <h3 id="migration-planning" class="position-relative d-flex align-items-center group"> Migration Planning <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="migration-planning" aria-haspopup="dialog" aria-label="Share link: Migration Planning"> Share link </button> </h3> <h4 id="migration-timeline" class="position-relative d-flex align-items-center group"> Migration Timeline <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="migration-timeline" aria-haspopup="dialog" aria-label="Share link: Migration Timeline"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Phase 1: Assessment (Current) - Inventory cryptographic assets - Identify sensitive long-term data Phase 2: Preparation - Enable cryptographic agility - Test PQC algorithms in staging Phase 3: Hybrid Deployment - Deploy hybrid TLS configuration - Monitor performance impact Phase 4: Full PQC (Future) - Transition to pure PQC - Deprecate classical algorithms </code></pre></div> <h4 id="assessment" class="position-relative d-flex align-items-center group"> Assessment <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="assessment" aria-haspopup="dialog" aria-label="Share link: Assessment"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">geode crypto-audit --comprehensive # Output: # Current Cryptographic Inventory: # TLS Key Exchange: X25519 (classical, quantum-vulnerable) # Data Encryption: AES-256-GCM (quantum-resistant) # # Recommendations: # - Enable hybrid key exchange when available # - Current data-at-rest encryption is quantum-safe </code></pre></div> <h3 id="performance-considerations" class="position-relative d-flex align-items-center group"> Performance Considerations <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-considerations" aria-haspopup="dialog" aria-label="Share link: Performance Considerations"> Share link </button> </h3> <h4 id="key-exchange-performance" class="position-relative d-flex align-items-center group"> Key Exchange Performance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="key-exchange-performance" aria-haspopup="dialog" aria-label="Share link: Key Exchange Performance"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Algorithm Key Gen Encaps Decaps Total ---------------------------------------------------------- X25519 (classical) 0.02ms 0.02ms 0.02ms 0.06ms ML-KEM-768 (PQC) 0.08ms 0.10ms 0.12ms 0.30ms Hybrid (X25519+KEM) 0.10ms 0.12ms 0.14ms 0.36ms </code></pre></div> <h4 id="optimization" class="position-relative d-flex align-items-center group"> Optimization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="optimization" aria-haspopup="dialog" aria-label="Share link: Optimization"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">performance: post_quantum: session_resumption: enabled: true ticket_lifetime: 86400 connection_pooling: enabled: true max_idle_connections: 100 acceleration: avx2: true </code></pre></div> <h3 id="compliance-and-standards" class="position-relative d-flex align-items-center group"> Compliance and Standards <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-and-standards" aria-haspopup="dialog" aria-label="Share link: Compliance and Standards"> Share link </button> </h3> <h4 id="regulatory-guidance" class="position-relative d-flex align-items-center group"> Regulatory Guidance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="regulatory-guidance" aria-haspopup="dialog" aria-label="Share link: Regulatory Guidance"> Share link </button> </h4><ul> <li>NIST: FIPS 203, 204, 205 (ML-KEM, ML-DSA, SLH-DSA)</li> <li>NSA CNSA 2.0: Post-quantum requirements for national security systems</li> <li>CISA: Post-quantum migration guidance for critical infrastructure</li> </ul> <h4 id="compliance-configuration" class="position-relative d-flex align-items-center group"> Compliance Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-configuration" aria-haspopup="dialog" aria-label="Share link: Compliance Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># CNSA 2.0 compliant configuration compliance: standard: "CNSA-2.0" cryptography: symmetric: "AES-256" hash: "SHA-384" key_exchange: "ML-KEM-1024" signature: "ML-DSA-87" </code></pre></div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">geode compliance-check --standard=CNSA-2.0 # Symmetric Encryption: COMPLIANT (AES-256-GCM) # Key Exchange: PREPARING (X25519 -> ML-KEM-1024) </code></pre></div> <h3 id="monitoring" class="position-relative d-flex align-items-center group"> Monitoring <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="monitoring" aria-haspopup="dialog" aria-label="Share link: Monitoring"> Share link </button> </h3><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">geode crypto-status # Cryptographic Status: # TLS Version: 1.3 # Forward Secrecy: Enabled # Cipher: AES-256-GCM (quantum-resistant) # Hybrid Mode: Available # # Post-Quantum Readiness: # - Data-at-rest: Protected (AES-256) # - Forward secrecy: Limiting SNDL exposure # - Algorithm agility: Enabled </code></pre></div> <h3 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h3> <h4 id="immediate-actions" class="position-relative d-flex align-items-center group"> Immediate Actions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="immediate-actions" aria-haspopup="dialog" aria-label="Share link: Immediate Actions"> Share link </button> </h4><ol> <li>Enable AES-256: Use 256-bit symmetric encryption</li> <li>Enforce TLS 1.3: Mandatory forward secrecy</li> <li>Enable Agility: Prepare for algorithm updates</li> <li>Audit Cryptography: Inventory all cryptographic usage</li> <li>Classify Data: Identify long-term sensitive data</li> </ol> <h4 id="long-term-strategy" class="position-relative d-flex align-items-center group"> Long-term Strategy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="long-term-strategy" aria-haspopup="dialog" aria-label="Share link: Long-term Strategy"> Share link </button> </h4><ol> <li>Deploy Hybrid: Enable hybrid cryptography</li> <li>Migrate to PQC: Transition to pure post-quantum</li> <li>Continuous Assessment: Regular security audits</li> <li>Stay Current: Update algorithms as standards evolve</li> </ol> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/forward-secrecy/" >Forward Secrecy</a> - Ephemeral key exchange</li> <li><a href="/tags/tls/" >TLS Encryption</a> - Transport security configuration</li> <li><a href="/tags/encryption/" >Encryption</a> - Data encryption at rest</li> <li><a href="/tags/security/" >Security</a> - Security overview</li> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory requirements</li> <li><a href="/tags/authentication/" >Authentication</a> - Identity verification</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li><a href="/docs/architecture/security-architecture/" >Security Architecture</a> - Security design</li> <li><a href="/docs/ops/deployment/" >Deployment Guide</a> - Production deployment</li> <li>NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)</li> <li>NSA CNSA 2.0 Commercial National Security Algorithm Suite</li> <li>CISA Post-Quantum Cryptography Initiative</li> </ul>

Popular

Related Articles

Post-Quantum Readiness & Cryptography