Arpan0995

Arpan0995/pqc-migration-readiness

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

1 stars 0 forks 1 watchers Java Apache License 2.0

crypto-agility cryptography fips-203 fips-204 java ml-dsa ml-kem post-quantum-cryptography pqc security-tools static-analysis

View on GitHub Website

36 Open Issues Need Help Last updated: Sep 8, 2026

Open Issues Need Help

View All on GitHub

Fix stale Bouncy Castle version in benchmarks RESULTS.md 5 days ago

documentation good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add a benchmarks module README linking to RESULTS.md 5 days ago

documentation good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add a one-command benchmark runner (benchmarks/run-benchmarks.sh) 5 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add negative tests: DualSignature.verify must reject under-length signatures 5 days ago

good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

SARIF: declare run-level columnKind so startColumn is unambiguous 5 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

AuditLog writes raw control characters, producing invalid JSON Lines 5 days ago

bug good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Guard HybridKeyEstablishment.decapsulate against a truncated key-establishment wire 5 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Scan aborts on an unreadable directory in the tree instead of skipping it 5 days ago

bug good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Scan aborts on a source file with non-UTF-8 bytes instead of skipping it 5 days ago

bug good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Log the migration-effort estimate from the Maven plugin, matching the CLI 5 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add a positive test fixture for Cipher.getInstance("ECIES") 10 days ago

good first issue detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Re-run the Phase 1 case studies with the 1.4.0 auditor 10 days ago

help wanted good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add a --quiet / -q flag to silence informational stdout 10 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add positive test fixtures for the Ed448 and EdDSA signature families 10 days ago

good first issue detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Detect ElGamal as a quantum-vulnerable Cipher and KeyPairGenerator algorithm 10 days ago

good first issue detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Move GPG signing into a release profile so a plain mvn install works 10 days ago

help wanted good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add a --version / -v flag to the CLI 10 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

SARIF: emit stable partialFingerprints so code scanning tracks alerts across runs 10 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add a hard-negative test: algorithm names in comments and strings must stay quiet 10 days ago

good first issue detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add P-384 curve sentinel buffer widths (48, 97) to the F1 rule 10 days ago

good first issue detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add missing java.security.interfaces marker key types to the F4 coupling list 10 days ago

good first issue detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Gradle projects with per-module build-script names collapse into one (root) module 11 days ago

bug help wanted detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Scanning 20k+ files exhausts the default heap: every CompilationUnit is retained for constant propagation 11 days ago

bug help wanted

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

One-command install paths: JBang, Homebrew, SDKMAN 11 days ago

enhancement help wanted

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Docs: a walkthrough of how to read a readiness report 11 days ago

documentation good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Regenerate or remove the stale docs/CODEBASE-SUMMARY.pdf 11 days ago

documentation good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Hand-labelled ground-truth corpus for detector precision and recall 11 days ago

help wanted

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Reproduce the JMH benchmark campaign on other hardware and JDK builds 11 days ago

help wanted

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Per-site remediation guidance: say what each finding should become 11 days ago

enhancement help wanted

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Self-contained HTML report 11 days ago

enhancement help wanted

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Make the per-module hotspot cap configurable 11 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Add a --fail-on tier threshold so CI can gate on the result 11 days ago

enhancement good first issue

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Model enums and registries so dynamically selected algorithms are found 11 days ago

enhancement help wanted detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Detect the JOSE/JWT surface 11 days ago

enhancement help wanted detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Detection rule F8: third-party API boundary 11 days ago

enhancement help wanted detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis

Detection rule F2: fixed-width persistence and wire formats 11 days ago

enhancement help wanted detection

Arpan0995/pqc-migration-readiness

1

Static auditor estimating post-quantum (PQC) migration effort for Java codebases: detects quantum-vulnerable JCA usage and structural fragility, with a runtime crypto-agility layer

Java

#crypto-agility#cryptography#fips-203#fips-204#java#ml-dsa#ml-kem#post-quantum-cryptography#pqc#security-tools#static-analysis