[{"data":1,"prerenderedAt":146},["ShallowReactive",2],{"blog-\u002Fblog\u002Fseven-places-quantum-crypto-hides":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":96,"date":97,"description":98,"draft":99,"extension":100,"faqs":101,"findingsSource":7,"geo":108,"howto":7,"howtoTitle":7,"image":110,"industries":111,"keyFindings":7,"meta":114,"modified":115,"navigation":116,"path":117,"pullquote":7,"recommendations":7,"references":118,"related":128,"seo":132,"seoTitle":7,"signposts":7,"slug":133,"stats":134,"stem":137,"tags":138,"tldr":144,"__hash__":145},"blog\u002Fblog\u002Fseven-places-quantum-crypto-hides.md","The Seven Places Quantum-Vulnerable Cryptography Hides","ArcQubit Team",null,{"type":9,"value":10,"toc":89},"minimark",[11,16,20,24,71,75,78],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19],"p",{},"Quantum-vulnerable cryptography does not live in one place. It spreads across seven distinct surfaces of a modern software stack, and the reason most organizations underestimate their exposure is simple: the tool they use inspects one surface and reports it clean, while the other six go unexamined.",[12,21,23],{"id":22},"the-seven-surfaces","The seven surfaces",[25,26,27,35,41,47,53,59,65],"ol",{},[28,29,30,34],"li",{},[31,32,33],"strong",{},"Source code."," Hardcoded algorithms, key sizes, and cipher suites written directly into your application.",[28,36,37,40],{},[31,38,39],{},"Dependencies."," Cryptography pulled in transitively through libraries you never audited.",[28,42,43,46],{},[31,44,45],{},"SBOMs and CBOMs."," The declared inventory, which is only as accurate as the process that generated it.",[28,48,49,52],{},[31,50,51],{},"Certificates."," TLS and code-signing certificates whose signature algorithms quietly age into risk.",[28,54,55,58],{},[31,56,57],{},"Infrastructure."," Load balancers, service meshes, and managed services terminating cryptography outside your code.",[28,60,61,64],{},[31,62,63],{},"Binaries."," Compiled artifacts that bake in the algorithm, invisible to a source scan.",[28,66,67,70],{},[31,68,69],{},"Runtime tokens."," JWTs, session tokens, and signed payloads generated and verified live in production.",[12,72,74],{"id":73},"why-single-surface-tools-mislead","Why single-surface tools mislead",[17,76,77],{},"A scanner that reads only source code will pass a repository whose real exposure lives in a five-year-old certificate or a vendored binary. The clean report is worse than no report, because it creates false confidence. Credible discovery has to span all seven surfaces at once.",[17,79,80,81,88],{},"Run ",[82,83,87],"a",{"href":84,"rel":85},"https:\u002F\u002Fwww.qucode.ai\u002F",[86],"nofollow","QuCode"," to see where quantum-vulnerable cryptography actually lives in your stack.",{"title":90,"searchDepth":91,"depth":91,"links":92},"",2,[93,94,95],{"id":14,"depth":91,"text":15},{"id":22,"depth":91,"text":23},{"id":73,"depth":91,"text":74},"Security","2026-07-08","Quantum-vulnerable cryptography hides across seven surfaces of your stack. Here is the field guide, and why single-surface scanners leave you exposed.",false,"md",[102,105],{"q":103,"a":104},"What does it mean for cryptography to be quantum-vulnerable?","It means the algorithm can be broken by a sufficiently large quantum computer. RSA and ECC are the primary examples, because Shor's algorithm defeats the math they rely on.",{"q":106,"a":107},"Why isn't one cryptographic scanner enough?","Because vulnerable cryptography appears on seven different surfaces, from source code to runtime tokens. A scanner that only reads source misses certificates, binaries, and dependencies entirely.",[109],"global","\u002Fassets\u002Fblog\u002Fseven-places-quantum-crypto-hides.png",[112,113],"Cross-Sector","Information Technology",{},"2026-09-30",true,"\u002Fblog\u002Fseven-places-quantum-crypto-hides",[119,122,125],{"label":120,"url":121},"NIST FIPS 203","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F203\u002Ffinal",{"label":123,"url":124},"Executive Order 14412 (2026)","https:\u002F\u002Fwww.whitehouse.gov\u002Fpresidential-actions\u002F2026\u002F06\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks\u002F",{"label":126,"url":127},"UK NCSC: Timelines for migration to post-quantum cryptography","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",[129],{"label":130,"url":131},"How to Build a Cryptographic Inventory and CBOM for Post-Quantum Migration","\u002Fblog\u002Fcryptographic-inventory-cbom",{"title":5,"description":98},"seven-places-quantum-crypto-hides",[135,136],"Most cryptographic scanning tools inspect a single surface, leaving the other six unexamined (ArcQubit, 2026).","Government mandates worldwide set post-quantum migration deadlines between 2030 and 2035 (U.S. EO 14412, EU roadmap, UK NCSC).","blog\u002Fseven-places-quantum-crypto-hides",[139,140,141,142,143],"post-quantum cryptography","cryptographic discovery","cryptographic inventory","SBOM","primer","Quantum-vulnerable cryptography hides across seven distinct surfaces, and most scanning tools inspect only one of them.","O3jlKh_SzQclRjKhl8RZaXOYcoPjx94ZFf_V7Qmh-rI",1792182882840]