How it works

The padlock in your browser comes down to a math problem. Regular computers can't solve it in any useful amount of time, which is what keeps your data safe. A big enough quantum computer, running Shor's algorithm, solves it quickly. Every RSA key and every elliptic-curve key on the internet today comes apart under it.

The fix already exists. NIST published it in August 2024: ML-KEM for key exchange (FIPS 203) and ML-DSA for signatures (FIPS 204). So the algorithms aren't the hard part. The hard part is that almost nobody knows where their cryptography lives in the first place.

The new algorithms are built on lattices, which are grids of points in very high-dimensional space. Finding the point nearest to a spot in that grid is simple to describe and, as far as anyone can tell, extremely hard to compute, for regular and quantum computers alike. That is the problem ML-KEM leans on instead of the factoring and discrete-log problems that Shor's algorithm tears through.

The lattice is what your encryption is about to be rebuilt on. This tool tells you which parts of your site haven't made the switch.

TLS uses cryptography for two separate jobs, and they run on very different clocks.

Key exchange sets up the secret that encrypts your session. Someone can record that traffic today, sit on it, and decrypt it years from now when a quantum computer shows up. People call this harvest now, decrypt later, and it means the harm is happening quietly right now. It is also the part you can fix today. Hybrid ML-KEM already works in every current major browser and most CDNs.

Signatures prove the server is who it says it is. A signature only has to hold up while the certificate is still trusted. Breaking it in 2032 does nothing to a handshake from 2026. It matters, but it can wait, and no public certificate authority even issues quantum-safe certificates yet, so there is nothing to move to.

A lot of tools lump these two together, because one deadline sounds scarier than two. LatticeScan keeps them apart.

1. Discovery. Since 2018, every publicly trusted certificate has to be logged to public Certificate Transparency logs. We read those logs to find the hostnames a domain has certificates for, including ones people have long forgotten about.

2. Probing. We open a TLS 1.3 connection to each endpoint and offer it onlypost-quantum key exchange groups. If the handshake goes through, the server supports ML-KEM. If it gets refused, it doesn't. This is the same handshake your browser makes every day. Nothing intrusive, nothing that touches your systems.

3. Inventory. We pull the results together into a cryptographic inventory you can export as a CycloneDX CBOM, the format the US government (Executive Order 14412) told CISA to define.

The grade is about post-quantum key exchange across the endpoints we could reach, since that is the part you can actually do something about.

• A · every endpoint uses hybrid ML-KEM
• B · most of them do
• C · modern TLS, but classical key exchange
• D· some endpoints can't do TLS 1.3 at all
• F · obsolete TLS

Most of the internet sits at a C right now. That is not a scandal. It is just where everyone is starting from.

This is an outside-in scan. It sees what the internet sees: your public endpoints and your public certificates. It can't see the cryptography inside your code, your internal services, your key stores, or your databases. A full inventory needs those too. But the outside is exactly where harvest-now-decrypt-later plays out, and it lets you start without handing anyone access to anything.