Post-quantum cryptography (PQC)
Quantum computing poses a significant threat to widely used public-key cryptographic algorithms, such as RSA and ECC. Even before large-scale quantum computers are realized, organizations must address potential risks by using post-quantum cryptography techniques in projects.
The Qodana for JVM linter provides inspections to identify vulnerable code and guide developers toward post-quantum cryptography (PQC) alternatives and available under the Ultimate and Ultimate Plus licenses and their trial versions. To learn more about the available licensing model, visit the Subscription Options and Pricing page. You can also request a demo.
Inspection groups
Post-quantum cryptography inspections are categorized into several groups, with some groups corresponding to specific NIST PQC security categories. Each higher category imposes stricter requirements and identifies a broader range of vulnerabilities.
Inspection group / NIST PQC security category | Description | Reference benchmark (defines the category) |
|---|---|---|
| Pre-quantum and legacy cryptography vulnerabilities | Key search on a block cipher with a 128-bit key (AES-128) |
|
| Collision search on a 256-bit hash function (SHA-256) |
|
| Key search on a block cipher with a 192-bit key (AES-192) |
|
| Collision search on a 384-bit hash function (SHA3-384) |
|
| Key search on a block cipher with a 256-bit key (AES-256) |
| Every PQC inspection at any level | Every case at every level |
In this table, each group above PqcMinLevel1 incorporates the inspections of the lower groups. For instance, PqcMinLevel2 includes all the inspections of the PqcMinLevel1 level and so on.
Run post-quantum cryptography
You can enable any inspection group using the inspections.group key in your YAML configuration, for example:
Once configured, run the Qodana for JVM linter as explained in the Run Qodana chapter of the Qodana for JVM documentation.