⚛️ quantum physics

Quantum-Safe Code Auditing: LLM-Assisted Static Analysis and Quantum-Aware Risk Scoring for Post-Quantum Cryptography Migration

This paper introduces "Quantum-Safe Code Auditor," an open-source framework that combines regex-based detection, LLM-assisted contextual analysis, and a Qiskit-based Variational Quantum Eigensolver risk scoring model to automate the identification and prioritization of cryptographic vulnerabilities in software ahead of post-quantum migration, achieving high precision and recall across five major libraries.

Original authors: Animesh Shaw

Published 2026-04-02

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Animesh Shaw

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

🌌 The Big Picture: The "Quantum Apocalypse" is Coming

Imagine your digital life (bank accounts, private messages, medical records) is locked in a vault. Today, the locks are made of steel (RSA, ECDSA encryption). They are so strong that even the fastest supercomputers would take millions of years to break them.

But scientists have discovered a new kind of tool: a Quantum Computer. Think of this not as a faster supercomputer, but as a master key that can pick any of those steel locks in seconds.

The scary part? This master key doesn't exist yet, but it's coming soon (estimated around 2030). Worse, bad guys are already using a strategy called "Harvest Now, Decrypt Later." They are stealing your encrypted data today, storing it in a warehouse, and waiting for the master key to arrive so they can open it all at once.

🛠️ The Problem: We Don't Know Where the Locks Are

The paper argues that while we know the master key is coming, most companies have no idea where their "steel locks" are hiding in their code.

They don't know which files use the old, breakable encryption.
They don't know which ones are critical and need to be fixed yesterday.
Existing tools are like a flashlight that only finds "weak" locks (like rusty ones), but they miss the fact that all the steel locks will eventually be useless against the quantum master key.

🤖 The Solution: The "Quantum-Safe Code Auditor"

The author, Animesh Shaw, built a new tool called the Quantum-Safe Code Auditor. Think of it as a super-smart security inspector that scans your entire codebase to find every single lock that the quantum computer can break.

It works in three clever steps (a "Three-Tier Pipeline"):

1. The "Net" (Regex Scanner)

First, the tool casts a wide net. It uses simple pattern matching (like a search bar looking for specific words) to find anything that looks like an old encryption method (e.g., "RSA," "ECDSA," "MD5").

Analogy: Imagine a fishing net that catches every fish that looks like a shark. It catches a lot of things, including harmless sharks that are just swimming in a tank (test code), but it ensures nothing is missed.

2. The "Detective" (LLM Enrichment)

The net catches too many false alarms. So, the tool sends the findings to a Large Language Model (LLM)—basically a very smart AI detective.

The AI looks at the context: "Is this code actually running in the real world, or is it just a test script?"
It filters out the noise. If the code is just a test or a harmless example, the AI says, "Ignore this." If it's a real lock protecting user data, it says, "This is a problem!"
Result: This step cleans up the list so engineers only see the real threats.

3. The "Risk Meter" (VQE Scoring)

Now we have a list of problems. Which one do we fix first? The tool uses a Variational Quantum Eigensolver (VQE).

Analogy: Imagine a risk meter that doesn't just say "High" or "Low." It calculates a score from 0 to 10 based on how many "quantum qubits" (the fuel for the master key) it would take to break that specific lock.
If a lock requires very few qubits to break (like a cheap padlock), the score is 10 (Critical).
If it requires more, the score is lower.
This gives companies a clear "To-Do" list: Fix the 10s first, then the 7s, then the 3s.

📊 What Did They Find?

The team tested this tool on five popular open-source libraries (like python-rsa and node-jsonwebtoken).

The Results: The tool found 5,775 potential issues.
Accuracy: On a sample of 602 items, it was 100% good at finding real problems (it didn't miss any real locks) and about 72% accurate at ignoring false alarms.
The Verdict: The tool successfully identified that some libraries (like node-jsonwebtoken, used for logging into websites) are in Critical Danger (Score 7.0), while others are less urgent.

🚀 Why This Matters

We have a deadline. The US government (NIST) has already released new "Quantum-Proof" locks (FIPS 203, 204, 205), and companies must switch to them by 2030.

This tool is the map and compass for that journey. Without it, companies are trying to migrate to quantum safety in the dark, guessing where the old locks are. With this tool, they can see exactly what needs to be replaced, how urgent it is, and how to do it before the "Quantum Master Key" arrives.

💡 The Takeaway

The paper presents a smart, automated security guard that helps us prepare for a future where our current digital locks will crumble. It combines a wide search, a smart AI filter, and a quantum-powered risk calculator to tell us exactly where to start fixing our digital defenses before it's too late.

1. Problem Statement

The advent of Cryptographically Relevant Quantum Computers (CRQCs) poses an existential threat to modern software security. Shor's algorithm can break asymmetric cryptography (RSA, ECDSA, ECDH, Diffie-Hellman) in polynomial time, while Grover's algorithm effectively halves the security of symmetric ciphers and hash functions.

The "Harvest Now, Decrypt Later" (HNDL) Threat: Adversaries are already intercepting and archiving encrypted traffic, intending to decrypt it once CRQCs become operational (estimated 2030–2035).
The Tooling Gap: While NIST has standardized Post-Quantum Cryptography (PQC) algorithms (FIPS 203/204/205) and the NSA has set a 2030 migration deadline (CNSA 2.0), development teams lack automated tools to:
1. Inventory classical cryptographic usage across codebases.
2. Prioritize migration based on actual quantum risk (qubit cost) rather than just finding counts.
3. Distinguish between genuine production vulnerabilities and false positives (e.g., test fixtures, documentation).
  Existing tools (e.g., Bandit, SonarQube, CryptoGuard) detect classical misuse (weak keys, deprecated APIs) but do not model quantum attack costs or provide PQC-specific remediation guidance.

2. Methodology: The Quantum-Safe Code Auditor

The authors propose a four-stage, three-tier pipeline that combines static analysis, Large Language Model (LLM) enrichment, and quantum-inspired risk scoring.

Stage 1: Regex-Based Detection

A scanner traverses source files to identify 15 classes of quantum-vulnerable primitives using regular expressions.

Targets: RSA, ECDSA, ECDH, DSA, Diffie-Hellman, X25519, Ed25519, PKCS#1 v1.5, AES-128, 3DES, RC4, MD5, SHA-1, Hardcoded Keys, and RSA-1024.
Output: Initial findings with a baseline confidence of 0.5.

Stage 2: LLM-Assisted Contextual Enrichment

Findings are passed to the Claude API with structured prompts containing code context, file paths, and algorithm details. The LLM classifies each finding on three dimensions:

Context Label: Production (risk), Test (safe), or Safe (e.g., AES-256).
Severity: Critical, High, Medium, or Low.
Confidence Score: A value in [0, 1].

Goal: Drastically reduce false positives caused by test fixtures, documentation strings, or feature flags.

Stage 3: VQE-Based Threat Scoring

A novel Variational Quantum Eigensolver (VQE) model, implemented in Qiskit 2.x, calculates a continuous risk score (0–10) for each finding.

Mechanism: The VQE circuit encodes algorithm properties (key size, Shor-path qubit cost, Grover speedup factor) into rotation angles. It minimizes a Hamiltonian to find the "most exploitable" configuration.
Weighting: Shor-path vulnerabilities (full break) are weighted $\times 2.0$ higher than Grover-path vulnerabilities (partial break).
Output: A normalized score where $\ge 7.0$ indicates critical immediate migration, and $< 3.0$ indicates low priority.

Stage 4: Remediation Reporting

The system generates structured JSON and human-readable reports (via GitHub Issues and Notion dashboards). It maps findings to specific NIST standards:

RSA/ECDH $\to$ ML-KEM (FIPS 203)
ECDSA/DSA $\to$ ML-DSA (FIPS 204)
SHA-1/MD5 $\to$ SHA-3/SHA-256

3. Key Contributions

End-to-End Pipeline: A novel integration of regex scanning, LLM context analysis, and VQE-based threat modeling for quantum risk assessment.
Quantum-Aware Scoring: The first tool to use a VQE model to translate cryptographic properties into a prioritized, continuous risk score (0–10) calibrated against qubit-cost estimates.
Multi-Language Evaluation: Comprehensive evaluation across five diverse open-source libraries (Python, JavaScript, Java) covering 5,775 raw findings.
Open-Source Release: Full release of the tool code, evaluation data, and reproduction scripts to facilitate community adoption.

4. Evaluation Results

The system was evaluated on a stratified random sample of 602 findings from 5,775 total raw detections across five repositories (python-rsa, python-ecdsa, python-jose, node-jsonwebtoken, Bouncy Castle).

Performance Metrics:
- Precision: 71.98% (excluding test-code false positives).
- Recall: 100% (the scanner intentionally reports all matches to avoid missing vulnerabilities; the LLM handles pruning).
- F1 Score: 83.71%.
Per-Algorithm Precision:
- Algorithms like AES-128, DH, and DSA achieved 100% precision in the sample.
- Lower precision in algorithms like SHA-1 and 3DES was attributed to their frequent use in non-cryptographic contexts (e.g., Git hashing, test vectors).
Risk Prioritization:
- node-jsonwebtoken received the highest threat score (7.00, Critical) due to high-traffic JWT signing with RSA/ECDSA.
- python-ecdsa received a lower score (3.54, Medium) despite being ECDSA-only, due to narrower exposure.
False Positive Analysis: The primary source of false positives (31.2% of the sample) was test code (FP-Test), which is a configuration issue (lack of EXCLUDE_PATHS) rather than a classifier failure.

5. Significance and Impact

Bridging the Migration Gap: The tool addresses the critical lack of automation in the PQC migration lifecycle, specifically the "Discover" and "Prioritize" phases mandated by NIST and CNSA 2.0.
Actionable Intelligence: By providing a qubit-cost-calibrated risk score, the tool allows engineering teams to prioritize remediation based on actual quantum threat severity rather than arbitrary finding counts.
Scalability: The system supports 12 languages and integrates with standard developer workflows (GitHub, Notion), making it practical for enterprise adoption.
Future-Proofing: The inclusion of HNDL modeling ensures that organizations migrate now, rather than waiting for CRQCs to become operational, mitigating the risk of retroactive decryption of archived data.

In conclusion, the Quantum-Safe Code Auditor represents a significant step forward in software security tooling, moving beyond classical vulnerability detection to provide a mathematically grounded, quantum-aware framework for securing software against future threats.