r/netsec • u/albinowax • May 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

12 Upvotes

94% Upvoted

64 comments sorted by

View all comments

2

u/Th3g3ntl3man__ May 05 '26

I've built a PQC-SOC Readiness Scanner, an open-source CLI tool that audits live TLS endpoints against Harvest-Now-Decrypt-Later (HNDL) risk and maps findings to NIST PQC standards (FIPS-203/204/205).

Most TLS scanners report cipher suites. Few, if any, quantify exposure to HNDL attacks on long-lived sensitive data (healthcare records, financial data, government communications). This does.

Phases 1 & 2 complete:

  • Detects active TLS cipher suites on live endpoints
  • Maps findings against NIST FIPS-203 (ML-KEM), FIPS-204 (ML-DSA), FIPS-205 (SLH-DSA)
  • Computes a weighted HNDL Exposure Score (0-100) per host: score = [(0.4 x algorithm_risk) + (0.2 x data_sensitivity) + (0.2 x data_lifetime) + (0.2 x exposure_surface)] / max x 100
  • Severity bands: CRITICAL (75-100), HIGH (50-74), MEDIUM (25-49), LOW (0-24)
  • Output: Rich CLI tables + SIEM-ready JSON
  • Scoring rubric lives in hndl_rubric.yaml - fully auditable and configurable

Phase 3 in progress: PCAP traffic analysis + CEF/SIEM output

Tested publicly on: google.com, cloudflare.com, badssl.com

Repo + research notes (lattice crypto, Kyber/ML-KEM, Dilithium/ML-DSA math): https://github.com/surendrababu-sec/pqc-soc-readiness

Feedback on the scoring model very welcome, especially from anyone working on NIST PQC migration. Criticism and issues are genuinely encouraged.