PQC readiness report
mp3tomidi.art · Scanned Aug 15, 2026
PQC readiness score
mp3tomidi.art
- Readiness indicator, not a security guarantee
- Higher score = more PQC-ready
- Based on TLS, certificate & key-exchange posture
Executive summary
PostQ scanned the public TLS endpoint for mp3tomidi.art and found 7 findings, including 3 high-priority items and 2 quantum-vulnerable algorithms in the externally visible cryptography. The overall readiness score is 36/100 (High risk).
This score is a readiness indicator based on externally observable TLS, certificate, and key-exchange posture — not a guarantee of security. A complete cryptographic inventory also covers internal services, cloud KMS/HSM keys, JWTs, and code-signing workflows.
Risk score breakdown
How is this scored? →Weighted categories that make up the readiness score.
Leaf certificate uses a classical (RSA/EC) public key vulnerable to Shor's algorithm.
Certificate is signed with a classical signature algorithm.
Key exchange includes a post-quantum or hybrid component.
Negotiated TLSv1.3.
Technical findings
Signing: ECDSA (256-bit)
Signing
Certificate public key: ECDSA is broken by Shor's algorithm (elliptic curve discrete log problem)
mp3tomidi.art
What this means
A cryptographically relevant quantum computer running Shor's algorithm could break this primitive — forging signatures or decrypting traffic that is being recorded today (harvest-now, decrypt-later).
How to fix
Track this in your cryptographic inventory and plan migration toward ML-DSA (FIPS 204) as your verifier/ecosystem adds support.
Signing: ecdsa-with-SHA256
Signing
Certificate signed with ECDSA, signature is quantum-vulnerable
mp3tomidi.art (certificate signature)
What this means
A cryptographically relevant quantum computer running Shor's algorithm could break this primitive — forging signatures or decrypting traffic that is being recorded today (harvest-now, decrypt-later).
How to fix
Track this in your cryptographic inventory and plan migration toward ML-DSA (FIPS 204) as your verifier/ecosystem adds support.
Symmetric encryption: AES-256-GCM
Symmetric encryption
TLS bulk encryption: AES-256 is quantum-resistant; Grover's reduces effective security to 128-bit, still sufficient
mp3tomidi.art
What this means
Symmetric ciphers are only weakened (not broken) by Grover's algorithm; a 256-bit key keeps a strong post-quantum security margin.
How to fix
Prefer 256-bit symmetric keys (e.g. AES-256-GCM, ChaCha20-Poly1305) to retain a strong post-quantum margin.
TLS configuration: TLSv1.3
TLS configuration
TLS 1.3 supports hybrid post-quantum key exchange — enable X25519MLKEM768 where supported
mp3tomidi.art
How to fix
TLS 1.3 supports hybrid post-quantum key exchange — enable X25519MLKEM768 where supported
TLS configuration: TLS_AES_256_GCM_SHA384
TLS configuration
Negotiated cipher suite: TLS_AES_256_GCM_SHA384 (TLSv1.3)
mp3tomidi.art
What this means
A cryptographically relevant quantum computer running Shor's algorithm could break this primitive — forging signatures or decrypting traffic that is being recorded today (harvest-now, decrypt-later).
How to fix
Track this algorithm in your cryptographic inventory and plan a hybrid or post-quantum replacement.
Key exchange: X25519MLKEM768
Key exchange
Server supports post-quantum key exchange: X25519MLKEM768. PQ-safe key agreement is available.
mp3tomidi.art
What this means
This is a NIST-standardised post-quantum algorithm and is not known to be broken by quantum attacks.
How to fix
No action required — this is already a post-quantum algorithm.
TLS configuration: HSTS
TLS configuration
No Strict-Transport-Security response header. Clients can be SSL-stripped on first connect; recommend `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.
mp3tomidi.art
What this means
A cryptographically relevant quantum computer running Shor's algorithm could break this primitive — forging signatures or decrypting traffic that is being recorded today (harvest-now, decrypt-later).
How to fix
Track this algorithm in your cryptographic inventory and plan a hybrid or post-quantum replacement.
TLS configuration
TLSv1.3
Enabled
Algorithm inventory
| Algorithm | Category | Usage | Posture | Migrate to |
|---|---|---|---|---|
| ECDSA-256 | public-key | Certificate public key | Quantum-vulnerable | ML-DSA (FIPS 204) |
| ecdsa-with-SHA256 | signature | Certificate signature | Quantum-vulnerable | ML-DSA (FIPS 204) |
| X25519MLKEM768 | key-exchange | TLS key establishment | Hybrid-ready | — |
| AES-256-GCM | symmetric | TLS record encryption | Symmetric (lower risk) | — |
Certificate chain
- Public key
- ECDSA
- Signature
- ecdsa-with-SHA256
- Issuer
- C=US, O=Google Trust Services, CN=WE1
- Valid to
- Nov 3, 2026 (80d)
- SHA-256
- 8C:F8:27:48:0E:85:81:E8:29:29:DF:21:22:58:75:88:DC:BB:1D:BF:95:D1:36:67:B8:51:C1:39:DF:60:75:79
Recommended migration steps
- 1Add every certificate, key-exchange group, and signing key above to a tracked cryptographic inventory so migration can be prioritised.
- 2Where your client and verifier ecosystems support it, deploy hybrid key exchange (X25519 + ML-KEM) to defend against harvest-now, decrypt-later.
- 3Plan a path to ML-DSA (FIPS 204) signatures for certificates and code signing as CAs and tooling add support.
- 4No action required for HNDL exposure.
- 5Extend the inventory beyond public TLS to internal services, cloud KMS/HSM keys, JWTs, and code-signing workflows for full coverage.
Compliance & audit notes
This report can be attached as evidence for cryptographic-inventory requirements that increasingly appear in security reviews (e.g. NIST’s migration guidance, US OMB M-23-02, and emerging FedRAMP / SOC 2 expectations around crypto-agility). PostQ does not assert any compliance certification on your behalf; use this as supporting evidence within your own program.
Send me the full PQC readiness report
Get the PDF for mp3tomidi.art plus a guided checklist for extending this scan into a full cryptographic inventory.