Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Quantum-Safe Code Auditor, a static analysis framework for identifying and prioritizing migration of quantum-vulnerable cryptographic primitives in software. The framework uses regex-based detection, LLM-assisted contextual analysis for severity classification, and a Variational Quantum Eigensolver (VQE) model to provide quantum-aware risk scoring. Evaluated on five open-source libraries, the system achieves high precision (71.98%) and perfect recall (100%) in identifying vulnerable code, demonstrating its potential for automating PQC migration.
LLMs can help you find crypto vulnerabilities, but a quantum computer can tell you which ones to fix first.
The impending arrival of cryptographically relevant quantum computers (CRQCs) threatens the security foundations of modern software: Shor's algorithm breaks RSA, ECDSA, ECDH, and Diffie-Hellman, while Grover's algorithm reduces the effective security of symmetric and hash-based schemes. Despite NIST standardising post-quantum cryptography (PQC) in 2024 (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA), most codebases lack automated tooling to inventory classical cryptographic usage and prioritise migration based on quantum risk. We present Quantum-Safe Code Auditor, a quantum-aware static analysis framework that combines (i) regex-based detection of 15 classes of quantum-vulnerable primitives, (ii) LLM-assisted contextual enrichment to classify usage and severity, and (iii) risk scoring via a Variational Quantum Eigensolver (VQE) model implemented in Qiskit 2.x, incorporating qubit-cost estimates to prioritise findings. We evaluate the system across five open-source libraries -- python-rsa, python-ecdsa, python-jose, node-jsonwebtoken, and Bouncy Castle Java -- covering 5,775 findings. On a stratified sample of 602 labelled instances, we achieve 71.98% precision, 100% recall, and an F1 score of 83.71%. All code, data, and reproduction scripts are released as open-source.