Tokenkeep PQC

Post-quantum migration analysis: find every byte limit ML-DSA will break.

An inventory tells you where crypto is. It can't tell you what breaks when you swap it. ML-DSA, SLH-DSA and ML-KEM artifacts are 30 to 780 times larger than the classical ones they replace. Tokenkeep PQC traces every signature, public key and ciphertext from the code that produces it to the database columns, cookies, header buffers, TLS records and firmware stacks it has to fit through, then reports every overflow and generates the patch.

Check a config now Request a free scan
52×ML-DSA-65 signature vs. Ed25519
184 Bover the 16 KiB TLS record buffer: enough to abort every handshake on a 3-cert chain
11sink categories, from SQL DDL to linker scripts
35 msmedian to analyze a 1,000-file repository

The clock is already running

Data signed today is still checked years from now, and a migration that touches every byte limit takes years, not quarters.

  1. Aug 2024FIPS 203, 204, 205 publishedML-KEM, ML-DSA and SLH-DSA become NIST standards.
  2. 2030CNSA 2.0: software & firmware signingNational-security systems must sign exclusively with post-quantum algorithms. Networking equipment is due the same year.
  3. After 2030NIST: RSA & ECDSA deprecatedUnder NIST IR 8547, quantum-vulnerable signatures may still be used only after a documented risk decision.
  4. 2033CNSA 2.0: web, cloud & OSBrowsers, servers, cloud services and operating systems must use post-quantum algorithms exclusively.
  5. After 2035NIST: disallowedRSA, ECDSA and EdDSA are no longer approved under NIST standards.

Sources: NIST IR 8547, NSA CNSA 2.0. Check the current text of each before planning against these dates.

A CBOM scanner

Cryptographic Bill of Materials

  • Finds Ed25519::sign() on line 42
  • Recommends ML-DSA-65
  • Stops there

Tokenkeep PQC

Cross-layer constraint graph

  • Follows that signature through Base64, DER and JWT framing, computed exactly per hop
  • Into the VARCHAR(512), the nginx header buffer, the session cookie and the mbedTLS record buffer
  • Reports demand vs. limit, the overflow in bytes, and whether any config change can fix it

Pick an algorithm. Watch the stack break.

Eight real-world limits, sized with the same encoding math the engine uses: Base64 and Base64url expansion, JWT framing, DER TLVs and TLS 1.3 certificate messages. Click any row to see the fix.

Modeled scenarios, not a scan of your code. JWT assumes 279 B of header and claims, carried in the cookie and in the request header. TLS assumes a 3-certificate chain with minimal X.509 metadata (measured with OpenSSL 3.6.1). Stack workspace is an engine estimate, since no FIPS standard defines stack use, plus a 4 KiB call chain. PostgreSQL B-tree tuple max is 2,704 B.

Check your own config, right here.

Paste an SQL migration, an nginx.conf, a linker script or another config the scanner reads. It's parsed by the engine's own parsers, compiled to WebAssembly, and runs entirely in your browser. Nothing is uploaded.

A single file has no crypto sources to link, so each limit is sized against a modeled artifact: a Base64 signature or key for SQL columns (chosen by column name), a JWT for headers and cookies, a raw signature for fields and datagrams. The full scanner links real sources across your whole repo.

CRITICAL

Hard ceilings

Protocol, platform or hardware limits. Raising a config value can't fix them, so runtime failure is imminent and the fix is architectural.

RFC 6265 cookies · TLS record buffer · PostgreSQL B-tree tuple · QUIC UDP payload · Lambda env · SQS batch · MCU linker stack

WARNING

Soft limits

Configurable, and wrong until widened. Every finding includes the minimum safe value under the category's headroom policy.

SQL VARCHAR · nginx / Envoy header buffers · Protobuf / OpenAPI max_len · Kafka message.max.bytes · Fluent Bit · WireGuard MTU

From your code to every byte limit.

  1. Parse

    Files are routed by extension to dedicated extractors: tree-sitter for Rust, sqlparser for DDL, a state-machine lexer for nginx, and readers for YAML, .proto, linker scripts, Kafka, TOML and C headers. Other languages come in through your existing CycloneDX CBOM.

  2. Link

    Crypto sources connect to capacity sinks within the same project scope. A signature column in services/billing is never charged for a signer in services/auth.

  3. Solve

    Projected demand per sink, exactly: ⌈(Σ raw × Π enc + TLV + envelope) × outer⌉ × fan-out. Call-graph stack depth is a longest path on a CSR DAG.

  4. Remediate

    Each breach becomes a reviewed unified diff. Soft limits are widened at the literal's exact byte span. Hard ceilings get an architectural indirection, and the patched tree is re-scanned until it's clean.

Gate the merge, not the incident.

JSON findings on stdout, diagnostics on stderr, and exit codes that mean something: 0 clean, 3 soft limits only, 4 hard ceiling. Run it once per candidate algorithm to answer “if we standardize on SLH-DSA-128s, what breaks?”

# .github/workflows/pqc.yml
- name: PQC blast-radius gate
  run: |
    tokenkeep-pqc-scan --path . \
      --target-algo ML-DSA-65 \
      --cbom cbom.json \
      --format json > pqc-findings.json
    # exit 4 → a hard ceiling will fail at runtime

Diagnostic

tokenkeep-pqc-scan

Free

  • Read-only CLI. The remediation engine isn't linked into the binary, so it can't write to your tree
  • All 11 sink categories, across monorepo scopes
  • Terminal report, JSON output and CI exit codes
  • Bring your CBOM for Java, Go, Python, TypeScript and more
Request a free scan

Remediation

Tokenkeep PQC Enterprise

Engagement

  • Every finding turned into a reviewed unified diff, with units kept as written (4K → 16K)
  • Hard-ceiling templates: hash-indexed signature columns, server-side sessions, secret-store references, AIA cert fetching, SQS batch resizing
  • Closed-loop verification: apply, re-analyze, zero breaches, every file still parses
  • A migration readout your security and infra leads can sign off on
Book an assessment

Reference

Post-quantum sizes, by algorithm.

Every number this page uses, in tables you can cite: raw sizes from FIPS 203, 204 and 205, the same values encoded, and which common limits each one breaks.

Start here

Find out what breaks before your users do.

Planning a PQC migration, or running agents against production context? Tell us your stack. We'll show you the blast radius.

or email