Back to docs
PQC-001HIGHCNSA 2.0 · FIPS 204
Quantum-Vulnerable Public Key (RSA)
Severity: HIGH
The use of RSA public key cryptography is highly vulnerable to decryption by sufficiently large quantum computers running Shor's algorithm. To ensure post-quantum security, these architectures must be migrated to ML-DSA.
Remediation checklist
- Deprecate RSA signature formats (RS256, RS384, RS512) and key encapsulation schemes.
- Transition to ML-DSA (FIPS 204) for digital signatures and authentication systems.
- Implement hybrid algorithms combining RSA and ML-DSA to maintain compatibility.
Remediation snippets
Vulnerable — RSA-2048 JWT signing
// FLAGGED: RSA is broken by Shor's algorithm token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims) signed, _ := token.SignedString(rsaPrivateKey)
Remediated — ML-DSA (FIPS 204)
// Migrate to ML-DSA-65 for quantum-safe signatures token := jwt.NewWithClaims(jwt.SigningMethodMLDSA65, claims) signed, _ := token.SignedString(mldsaPrivateKey)
Automate this remediation
DevSecOps Enterprise licenses run ciphermap fix to apply these patches inline and open a pull request automatically.
View DevSecOps pricing