post-quantum-cryptography-azure

name	post-quantum-cryptography-azure
description	Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.
domain	cybersecurity
subdomain	post-quantum-cryptography
tags	["post-quantum","pqc","azure","key-vault","tls","cryptography","cbom"]
version	1.0
author	openshield
license	Apache-2.0
nist_csf	["PR.DS-1","PR.DS-2","PR.AC-4"]

Post-Quantum Cryptography Assessment for Azure

When to Use

• When assessing an Azure environment for quantum readiness
• When building a Cryptographic Bill of Materials for Azure resources
• When identifying classical cryptographic algorithms that need migration
• When planning post-quantum migration for Key Vault keys and certificates
• When evaluating TLS configurations for quantum vulnerability

Key Concepts

Term	Definition
Harvest Now Decrypt Later	Attack where adversaries collect encrypted traffic today and decrypt it when quantum computers become available
Shor's Algorithm	Quantum algorithm that can break RSA and ECC by solving integer factorisation and discrete logarithm problems efficiently
ML-KEM	Module Lattice Key Encapsulation Mechanism, NIST FIPS 203, post-quantum safe key exchange
ML-DSA	Module Lattice Digital Signature Algorithm, NIST FIPS 204, post-quantum safe signing
SLH-DSA	Stateless Hash-Based Digital Signature Algorithm, NIST FIPS 205, post-quantum safe signing
CBOM	Cryptographic Bill of Materials, inventory of all cryptographic assets in a system
PQMA	Post-Quantum Migration Analyser, tool for validating PQC migration paths

OpenShield PQC Rules

Rule	Description	Severity
AZ-PQC-001	TLS below 1.3 on App Service	HIGH
AZ-PQC-002	Key Vault key using RSA or ECC algorithm	HIGH
AZ-PQC-003	Key Vault certificate using non-quantum-safe signature algorithm	MEDIUM

Assessment Workflow

Step 1: Identify Classical Keys in Key Vault

az keyvault list --output table
az keyvault key list --vault-name <vault-name> --output table
az keyvault certificate list --vault-name <vault-name> --output table

Step 2: Check TLS Configuration on App Services

az webapp list --output table
az webapp config show --resource-group <rg> --name <app-name> --query minTlsVersion

Step 3: Build Cryptographic Bill of Materials