# 🌐 Public — Start Here Plain-English notes on **post-quantum cryptography** — what's changing, why it's a *today* problem, and how to start. Written by TRELYAN to be honest and verifiable rather than salesy: every claim is checkable, and nothing here is a sales pitch. > [!note] Honest framing (house rule) > These notes never call anything "quantum-safe", "unbreakable", "future-proof", or > "certified". The honest terms are **post-quantum** / **quantum-resistant**: believed > secure against known quantum attacks, pending ongoing analysis. Scan output is a > **lead to verify, not a certification**. ## Primers **Start here:** - [[Post-Quantum Migration — a practical primer]] — why now, which standards, the 5 steps - [[Harvest Now, Decrypt Later]] — why data captured *today* is already at risk - [[CBOM — what CNSA 2.0 actually asks for]] — inventory your crypto before you migrate **Go deeper:** - [[Hybrid cryptography — classical + post-quantum together]] — the safe default for the transition - [[Post-quantum TLS — the handshake is changing]] — the change that reaches your servers first - [[The compliance timeline — CNSA 2.0, DORA, NIS2]] — what the regulators actually expect **By domain — where PQC hits your stack:** - [[Post-quantum VPNs — protecting the tunnel]] — IKEv2/IPsec and WireGuard, the harvest-now way in - [[Post-quantum data at rest — databases, backups, and key wrapping]] — the cipher's fine; the key wrapping isn't - [[Post-quantum IoT and firmware — signing for a 15-year device]] — long lifetimes make signatures urgent **Do something:** - [[Post-quantum readiness — a 10-minute self-assessment]] — score yourself, find your gaps - [[Add a post-quantum readiness gate to your CI]] — the free, open-source scanner in 5 lines ## The tools, and the evidence behind them TRELYAN's scanner and signed Evidence Pack, and — more importantly — exactly what we do and don't claim. Written to be checked, not believed. - [[Assurance — what we prove and what we don't]] — the credibility document for a skeptical auditor - [[Claims and evidence — run every one yourself]] — every claim mapped to a command you can run - [[We scanned four popular open-source repos]] — validated on real OSS code; findings true + reproducible (anonymized) - [[A sample Evidence Pack — what you actually get]] — the full deliverable, on a synthetic demo - [[The hard questions about our Evidence Pack, answered]] — the objections, answered straight ## Who this is for Engineers, security leads, and anyone whose organisation is being asked about CNSA 2.0, DORA, or NIS2 readiness and needs a plain-English starting point.