{"id":51578761,"url":"https://github.com/systemslibrarian/crypto-lab-pq-rotation","last_synced_at":"2026-07-11T03:32:24.857Z","repository":{"id":367855477,"uuid":"1215348612","full_name":"systemslibrarian/crypto-lab-pq-rotation","owner":"systemslibrarian","description":"Browser-based post-quantum migration planner for operational teams. Hybrid X.509 certs (ECDSA-P256 + ML-DSA-65), multi-jurisdiction regulatory timelines (CNSA 2.0, NIS, NCSC, BSI...), and a rolling key-rotation simulator with canary and rollback.","archived":false,"fork":false,"pushed_at":"2026-06-28T02:13:11.000Z","size":106,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-28T03:07:57.185Z","etag":null,"topics":["certificate-management","cnsa-2","composite-signatures","crypto-agility","crypto-lab","cryptography","ecdsa","governance","hybrid-certificates","key-rotation","ml-dsa","nist-pqc","noble-curves","noble-post-quantum","pki","post-quantum-migration","pqc-migration","regulatory-compliance"],"latest_commit_sha":null,"homepage":"https://systemslibrarian.github.io/crypto-lab-pq-rotation/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/systemslibrarian.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-19T19:52:51.000Z","updated_at":"2026-06-28T02:13:14.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/systemslibrarian/crypto-lab-pq-rotation","commit_stats":null,"previous_names":["systemslibrarian/crypto-lab-pq-rotation"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/systemslibrarian/crypto-lab-pq-rotation","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-pq-rotation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-pq-rotation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-pq-rotation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-pq-rotation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/systemslibrarian","download_url":"https://codeload.github.com/systemslibrarian/crypto-lab-pq-rotation/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-pq-rotation/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35350133,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificate-management","cnsa-2","composite-signatures","crypto-agility","crypto-lab","cryptography","ecdsa","governance","hybrid-certificates","key-rotation","ml-dsa","nist-pqc","noble-curves","noble-post-quantum","pki","post-quantum-migration","pqc-migration","regulatory-compliance"],"created_at":"2026-07-11T03:32:24.797Z","updated_at":"2026-07-11T03:32:24.847Z","avatar_url":"https://github.com/systemslibrarian.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# crypto-lab-pq-rotation\n\n## What It Is\n\n`crypto-lab-pq-rotation` is a browser-based interactive planner for post-quantum cryptography migration, focused on real deployment operations rather than algorithm theory. It models the end-to-end transition from cryptographic inventory through hybrid deployment to pure PQC in a five-phase program.\n\nThe demo includes:\n\n- An interactive **Mosca's-inequality** model (X + Y \u003e Z) with adjustable CRQC year and migration time, so you can see exactly when \"harvest now, decrypt later\" already puts your data past the line.\n- Hybrid X.509-style certificates with classical + PQ signatures (ECDSA-P256 + ML-DSA-65) and **measured** byte-size analysis (not estimates).\n- A **tamper lab** on the real certificate: forge the classical signature, the PQ signature, or the body and watch verification react live — demonstrating why a hybrid verifier trusts a certificate only when *both* signatures hold.\n- A timeline engine that aligns migration actions with major regulatory frameworks (CNSA 2.0, EU NIS, UK NCSC, Australia ASD, Germany BSI, Canada CCCS).\n- A rolling key rotation simulator with canary deployment, monitoring windows, staged rollout, and automatic rollback.\n- An **in-browser verification suite** that runs the lab's own cryptographic self-tests so you can confirm none of the results are faked.\n- A dashboard interface that visualizes inventory risk, phase progress, and operational readiness.\n\nIt uses real cryptographic primitives:\n\n- ECDSA-P256 from `@noble/curves`\n- ML-DSA-65 from `@noble/post-quantum`\n\nEvery byte size shown is measured from keys and signatures generated live in the browser. A classical ECDSA-P256 leaf certificate is ~1.2 KB; the hybrid equivalent is ~6.5 KB (≈5.4× larger), and the cryptographic material alone — public key plus signature — grows roughly 55× once ML-DSA-65's 1,952-byte key and 3,309-byte signature are added. This makes the size and operational tradeoffs of hybrid deployment concrete rather than asserted.\n\n## When to Use It\n\nUse this project when you need to:\n\n- Plan an organization-wide PQC migration roadmap with concrete phases and dependencies.\n- Explain why hybrid deployment is the practical transition model before pure PQC.\n- Teach operational realities: root CA rotation, HSM/KMS readiness, rollback planning, and monitoring coverage.\n- Compare regulatory timelines across jurisdictions.\n- Prototype crypto-agile architecture decisions for new systems.\n- Do NOT use this as a production PKI or key-management platform — it is an educational planning tool, not a CA product.\n\n## Live Demo\n\n**[systemslibrarian.github.io/crypto-lab-pq-rotation](https://systemslibrarian.github.io/crypto-lab-pq-rotation/)**\n\nThe planner walks a five-phase PQC migration program end to end: an interactive Mosca's-inequality model, a live hybrid X.509 certificate (ECDSA-P256 + ML-DSA-65) with a tamper lab that forges the classical signature, the PQ signature, or the body, a regulatory-timeline engine spanning CNSA 2.0 and other jurisdictions, a rolling key-rotation simulator with canary rollout and automatic rollback, an in-browser cryptographic self-test suite, and an inventory/readiness dashboard. Every byte size shown is measured from keys and signatures generated live in the browser.\n\n## What Can Go Wrong\n\n- **Timeline optimism.** Most enterprise migrations require multi-year sequencing. Delayed starts compress risk into hard regulatory deadlines.\n- **Skipping crypto-agility.** Without abstraction layers and policy-driven crypto selection, migration costs explode and rollback is unsafe.\n- **Partial inventory.** Teams often miss firmware signing, CA hierarchy elements, or application signing paths and discover blockers late.\n- **Root CA drag.** Root trust anchors are long-lived and distributed across many trust stores; rotating them is a slow, high-coordination process.\n- **Vendor asymmetry.** Some suppliers have clear PQ roadmaps; others do not. Migration is only as fast as the slowest dependency.\n- **Capacity and size effects.** Hybrid and PQ artifacts are larger, affecting TLS handshake behavior, CT logging, and constrained network paths.\n- **Weak observability.** If you cannot measure algorithm usage by traffic and endpoint class, governance reporting is unreliable.\n\n## Real-World Usage\n\nThe migration framework represented here aligns with published guidance from:\n\n- NSA CNSA 2.0 (September 2022 release, December 2024 update)\n- NIST NCCoE Migration to PQC project materials\n- EU NIS Cooperation Group PQC roadmap (June 2025)\n- UK NCSC post-quantum migration guidance (2025)\n- Germany BSI transition guidance (October 2024)\n- Australia ASD Information Security Manual\n- Canada CCCS PQC roadmap (June 2025)\n- ETSI CYBER quantum-safe guidance\n\nHybrid certificate modeling follows the composite-signature transition direction described in IETF LAMPS work (including draft-ietf-lamps-pq-composite-sigs).\n\nThe implementation reflects real migration patterns used by large enterprises and public-sector organizations: inventory first, hybrid rollout, monitored phased rotation, rollback-safe operations, and eventual classical retirement under compliance timelines.\n\n## How to Run Locally\n\n```bash\ngit clone https://github.com/systemslibrarian/crypto-lab-pq-rotation\ncd crypto-lab-pq-rotation\nnpm install\nnpm run dev\n```\n\n## Related Demos\n- [crypto-lab-harvest-timeline](https://systemslibrarian.github.io/crypto-lab-harvest-timeline/) — the Mosca inequality and cost-of-delay scenarios that justify migrating now.\n- [crypto-lab-hybrid-sign](https://systemslibrarian.github.io/crypto-lab-hybrid-sign/) — Ed25519 + ML-DSA-65 composite signatures, the IETF LAMPS construction this planner deploys.\n- [crypto-lab-pki-chain](https://systemslibrarian.github.io/crypto-lab-pki-chain/) — X.509 certificate chains and the trust hierarchy being rotated.\n- [crypto-lab-pq-families](https://systemslibrarian.github.io/crypto-lab-pq-families/) — the five PQC families and the size tradeoffs that drive migration choices.\n- [crypto-lab-pq-tls-handshake](https://systemslibrarian.github.io/crypto-lab-pq-tls-handshake/) — hybrid X25519MLKEM768 key exchange, the TLS side of the same migration.\n\n---\n\n*One of 120+ browser demos in the [Crypto Lab](https://crypto-lab.systemslibrarian.dev/) suite.*\n\n*\"So whether you eat or drink or whatever you do, do it all for the glory of God.\" — 1 Corinthians 10:31*\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-pq-rotation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-pq-rotation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-pq-rotation/lists"}