Cryptographic dependency explorer

What the labels mean

Each entry gives a short version. These are the full explanations.

Quantum status

Vulnerable

A capable quantum computer could break it, so it needs migrating.

Check key size

Quantum attacks reduce the safety margin, but modern sizes hold, so confirm rather than replace.

Not affected

No known quantum attack makes it practically breakable at this size, so no change is needed now. That's practical resilience, not a guarantee: keep it under review as research and standards change.

Unknown

Not enough evidence yet to say.

What a quantum computer could do later

Harvest now, decrypt later

Could be exploited later only if all of these hold: someone records the traffic or obtains a stored copy now, together with what's needed to recover the key (for a connection, its key-exchange messages; for stored data, the wrapped keys as well as the encrypted data); the protection depends on this vulnerable method alone, not on a hybrid with a quantum-resistant one; and a capable quantum computer exists while the data still matters. How long the data must stay secret decides the urgency.

Forgery later

Once a capable quantum computer exists, someone could work out the private key from the public key, then forge new signatures or impersonate the key's owner. That doesn't change what was signed earlier, or checks already made. What it weakens is a vulnerable signature's value as proof afterwards: a forger could make a new signature that looks as valid as an old one, so the signature alone can no longer show who signed or when. Records that must stay provable for years can keep their value through independent evidence of when they existed and were checked, such as trusted timestamps or validation evidence kept at the time, renewed with stronger algorithms before the old ones weaken. Re-signing, or other quantum-resistant protection, is needed where that evidence doesn't exist, or where the signature itself must keep being checked as proof in future.

Renewing evidence, in plain terms: to show later that a signature was valid, an archive keeps the evidence used to check it: the certificates and revocation records it was validated against, and trusted timestamps showing when the record and that evidence existed. Before the algorithm behind any of that evidence becomes unreliable, the archive adds a new trusted timestamp, made with a stronger algorithm, that covers the whole preserved set, including the earlier timestamps. This shows the evidence existed, unchanged, while its algorithms could still be trusted, so the chain of proof carries forward without re-signing the records themselves. A new timestamp on its own doesn't prove that an old signature was valid; it protects the evidence from which that can still be shown. Standards for long-term archives, such as RFC 4998, describe this.

No known practical quantum attack

No known quantum attack makes this practically breakable at this size. Grover's algorithm gives at most a square-root speed-up against symmetric keys and hashes, which leaves a large margin at these sizes.

Unknown

Can't be assessed until the algorithm is known.

Evidence

Documented

Confirmed by its owner, a platform export or a scan.

Inferred

Deduced, not yet confirmed. The note says why.

Unknown

Evidence not yet available. Unknown is a valid answer; a guess is not.