Cryptographic Artifact Discovery & Analysis Platform
A cryptographic discovery and post-quantum migration prototype, from a Smart India Hackathon problem statement.
Q-TRACE originated from a Smart India Hackathon problem statement. As the team lead, I contributed across planning, system design, development and execution, in a team of six.
Q-TRACE is a hackathon prototype, not a commercial product.
“Harvest now, decrypt later” attacks capture encrypted traffic today and wait for quantum computers to break RSA, ECDSA and ECDH. Organisations first need to know what cryptography they actually run, and how urgently each instance must migrate.
Before planning a post-quantum migration, an organization needs an inventory of the cryptography it uses and the risk attached to each finding.
The adversary records encrypted traffic now and decrypts it once a cryptographically relevant quantum computer exists. Anything protected by RSA, ECDSA or ECDH whose confidentiality must outlast that moment is exposed, even if no system is breached today.
Scan targets
source · dependencies · certificates · live TLS
Cryptographic discovery
progress streamed live to the browser
Mosca risk engine
X + Y > Z
NIST replacement recommender
FIPS 203 · 204 · 205
CBOM and reports
CycloneDX · PDF
A scanner that finds cryptography in source code, dependencies, certificates and live TLS endpoints; a Mosca-inequality risk engine; a recommender that maps vulnerable algorithms to NIST FIPS 203/204/205 replacements; and CycloneDX cryptographic bills of materials and PDF reports — with scan progress streamed live to the browser.
Q-TRACE’s risk engine is built on Mosca’s inequality: if data must stay secret for X years and migration takes Y years, it is at risk when X + Y exceeds Z, the years until a cryptographically relevant quantum computer. The calculator below demonstrates that inequality and the replacement mapping. It is not Q-TRACE’s code, and every input is your own assumption.
How long the data must stay confidential.
How long moving to post-quantum cryptography takes.
An adjustable assumption, not a prediction.
At risk
X + Y exceeds Z by 3 years: data encrypted today could be decrypted while it still matters. Migration is already 3 years late for this data.
Key establishmentReplace with ML-KEM (FIPS 203)
The documented scanner covers source code, dependencies, certificates and live TLS endpoints. Binary, library and container analysis are not presented as supported capabilities.