Post-Quantum Readiness Reports

Every survey produces a Post-Quantum Cryptography (PQC) report that classifies the cryptography found in your software by post-quantum readiness. It answers two questions at once: which of your components use cryptography that is already broken today, and which use algorithms that a cryptographically relevant quantum computer will break — quantum-vulnerable public-key algorithms such as RSA, ECDSA, and Diffie-Hellman.

Classification follows NIST’s post-quantum transition guidance (NIST IR 8547), which schedules quantum-vulnerable algorithms for deprecation by 2030.

Getting a PQC report

There is nothing extra to run. Both survey types produce a PQC report automatically:

# Inventory: classifies the cryptography present in your artifacts
spice survey inventory my-app ./build/output

# Runtime: classifies the cryptography your application actually executes
spice survey runtime my-app --jfr -- java -jar app.jar

The report appears in the dashboard on the survey’s page, alongside its CBOM. An inventory survey yields a PQC Inventory report (“what cryptography is present?”); a runtime survey yields a PQC Runtime report (“what cryptography did this artifact actually use?”).

How findings are classified

Cryptographic usage detected by a survey is matched against a curated known algorithm catalog — a database of cryptographic algorithms, each classified for post-quantum readiness against NIST guidance. Each report records the content hashes of the exact catalog version it was generated with, so results are reproducible and auditable.

Report sections

The report groups your libraries into readiness categories, worst finding first:

Category	Meaning
Critical: Banned Algorithms	Algorithms broken by conventional computers today (RC2, RC4, DES, 3DES, MD5, SHA-1, RSA-1024, etc.). Migrate immediately.
Warning: Mixed Cryptography	Libraries containing both post-quantum safe and legacy algorithms. Review and plan migration to post-quantum only.
Transition Away: Deprecated by 2030	Algorithms scheduled for deprecation by 2030 under NIST IR 8547, including AES-128, RSA (above 1024 bits), and elliptic-curve algorithms. Plan migration.
Compliant: Post-Quantum Ready	Libraries using 100% post-quantum safe algorithms, such as the NIST-standardized ML-KEM, ML-DSA, and SLH-DSA. No action needed.
Uncategorized	Cryptographic usage that could not be matched to a known classification. Review manually.

An executive summary at the top counts the findings in each category. Each library entry then lists:

• the library’s package URL (purl) and version,
• every cryptographic algorithm detected in it, each badged with its own status,
• the files in which the cryptography was found, and
• an assessment explaining the classification and recommending next steps.

Runtime details

The PQC report from a runtime survey additionally records what the instrumented JVM did while it ran:

• Runtime environment — JVM version and vendor, operating system.
• Event summary — total cryptographic events observed and distinct methods exercised.
• TLS connections — peer host and port, negotiated protocol version, and cipher suite for each connection.
• Certificates — subject, key type and length, signature algorithm, and expiry.

Exporting

Reports can be exported from the report view in the dashboard in several formats — for example HTML, PDF, and JSON — for sharing and offline analysis.