Post-quantum cryptography (PQC)
Quantum computing poses a significant threat to widely used public-key cryptographic algorithms, such as RSA and ECC. Even before large-scale quantum computers are realized, organizations must address potential risks by using post-quantum cryptography techniques in projects.
The Qodana for JVM linter provides inspections to identify vulnerable code and guide developers toward post-quantum cryptography (PQC) alternatives and available under the Ultimate and Ultimate Plus licenses and their trial versions. To learn more about the available licensing model, visit the Subscription Options and Pricing page. You can also request a demo.
Inspection levels
Post-quantum cryptography inspections are grouped into five levels with each level mapping to a respective NIST PQC security level where higher levels are stricter and report more problems.
Inspection level | Description |
|---|---|
| Most critical pre-quantum and legacy cryptography vulnerabilities |
| Baseline post-quantum algorithms and the |
| Standard-strength post-quantum algorithms and the |
| High-strength post-quantum algorithms and the |
| All algorithms except those providing maximum security, includes the |
In this table, each level above PqcMinLevel1 incorporates the inspections of the lower levels. For instance, PqcMinLevel2 includes all the inspections of the PqcMinLevel1 level and so on.
Run post-quantum cryptography
You can enable one PQC level from 1 to 5 at a time using the inspections.group key in your YAML configuration, for example:
Once configured, run the Qodana for JVM linter as explained in the Run Qodana chapter of the Qodana for JVM documentation.