Back to docs
PQC-002HIGHCNSA 2.0 · FIPS 203
Quantum-Vulnerable Elliptic Curves (ECC)
Severity: HIGH
Standard elliptic curves (secp256k1, prime256v1, nistp256, curve25519) are mathematically vulnerable to quantum computing decryption mechanisms. CNSA 2.0 requires migrating asymmetric key exchanges to ML-KEM.
Remediation checklist
- Transition to ML-KEM-768 or ML-KEM-1024 for secure key encapsulation.
- Deploy hybrid key exchanges combining ECDH (X25519) with ML-KEM to secure transport layer handshakes.
Remediation snippets
Vulnerable — classic ECDH curve preference
// FLAGGED: prime256v1 offers no post-quantum protection
config.CurvePreferences = []tls.CurveID{
tls.CurveP256,
}Remediated — hybrid X25519 + ML-KEM-768
// Hybrid handshake keeps classical + PQC security
config.CurvePreferences = []tls.CurveID{
tls.X25519MLKEM768,
}Automate this remediation
DevSecOps Enterprise licenses run ciphermap fix to apply these patches inline and open a pull request automatically.
View DevSecOps pricing