The quantum attack surface, analysed honestly.
Harvest-now-decrypt-later is already underway. Shor's resource estimates fell by two orders of magnitude in under a year. Meanwhile most QKD claims describe a physics result, not a deployed system. IQCSF works through what is actually true, what can be simulated today, and what must not be claimed at all.
Three layers, three jobs, and none of them substitutes for another
Most confusion in this field comes from collapsing these together. A quantum operating system orchestrates computation. It does not implement cryptographic protection. Modelling an attack is not defending against it, and measuring a host is not migrating an organisation.
QryptOn
The only layer here that touches real cryptographic material. A readiness scanner, a browser
toolkit, and Qryptonite — a pure-Rust implementation of the finalised NIST standards
FIPS 203, 204 and 205. Runs entirely on classical hardware, which is the point.
Karsa Quantum OS
A twelve-module control-plane platform plus the security engines built on top: exposure modelling, migration optimisation, benchmark orchestration, and working HNDL and QKD simulation labs. Owns the adapter that joins everything below it.
Origin PilotOS
The quantum operating system. Multi-backend access, scheduling, hybrid task lifecycle, compilation, resource management and monitoring — driving real Origin Wukong hardware and a four-system simulator equally well.
Four attack families, and what we can honestly do about each
Harvest now, decrypt later
The only attack whose first stage needs no quantum technology at all — just storage and patience. For everything else you are safe until the capability exists. For this one you are exposed from the moment the traffic leaves the building.
Read the analysis →Shor: RSA, and elliptic curve first
ECC needs roughly 100× fewer Toffoli gates than RSA, and the attack can be primed in advance. Almost every briefing is written about RSA; the elliptic-curve case is the sharper edge.
Read the analysis →QKD implementation attacks
Nobody attacks the mathematics. They attack the optics — photon-number splitting, detector blinding, Trojan horse, time-shift. None of it needs a quantum computer, and all of it has been demonstrated on real hardware.
Read the analysis →The failures you create yourself
Downgrade and hybrid stripping, trust-anchor and code-signing exposure, crypto-agility failure, inventory drift. These are the attacks a migration programme creates for itself — which makes them more urgent than Shor, not less.
Read the analysis →What we actually built
Two of these closed gaps our own earlier analysis identified. Both are working code you can run offline, not roadmap items.
QKD Security Lab
A real per-pulse BB84-family Monte Carlo — BB84, decoy-state, E91 and B92 — with fibre loss, detector efficiency, dark counts and four Eve strategies. Photon-number splitting and detector blinding are modelled as genuine stealth attacks that never raise the error rate, and are caught only by the matching countermeasure.
HNDL Batch & Vault Lab
Portfolio-scale exposure scoring across a full cryptographic asset inventory, plus a synthetic harvest-vault generator showing what an adversary's stored set would actually contain. Synthetic by design — no real traffic is captured or analysed anywhere.
PQC readiness scanner
A read-only POSIX shell script you can read in full before running. Seventeen checks, nine scored, offline by default, deterministic, with declared-versus-negotiated evidence classes and a CI exit code. Nothing leaves the machine.
Three moves, and two of them are free
Understand what actually breaks
Shor breaks RSA and elliptic curve outright — no key size saves them. Grover only weakens symmetric cryptography, and 256-bit keys are a sufficient answer. Conflating the two produces an expensive project you never needed.
Measure a host you suspect is exposed
Read-only, no root, no network on a default run. It tells you whether the crypto libraries and CLI tools on that machine can negotiate post-quantum TLS and SSH today — with the confidence level stated, and the score capped when the evidence does not support it.
Rank by data lifetime, then migrate
Use Mosca's inequality as the decision rule rather than intuition. Long-lived secrets first, routine session traffic last. Deploy hybrid classical + PQC so unmigrated clients stay compatible, then re-run the inventory — new dependencies reintroduce classical-only crypto constantly.