Introducing PQCDump: A Real Look at PQC Adoption

By Nicholas O'Shea

Background

About a year ago, Anvil Secure introduced PQCScan - an active scanner that connects to live SSH and TLS servers and queries their advertised post-quantum cryptography (PQC) algorithm support. While there continues to be debate as to when quantum computing will be in a position to actually crack traditional encryption, there has been a continued regulatory push for faster adoption of PQC standards, such as a recent executive order. Even if the technology is never viable for most adversaries, compliance will demand that companies make the switch to the new PQC standards.

Active scanning with PQCScan tells you what a server claims to support. But in practice, it does not tell you what is actually being negotiated on your network. A server may advertise PQC key exchange groups, yet continue to negotiate a classical algorithm because the connecting client does not support them. For a complete picture of PQC adoption, you need to look at real traffic.

That gap is what motivated PQCDump.

From pqcscan to pqcutils

As the toolkit has grown, it made sense to bring the tools under one roof. Both PQCScan and the new PQCDump tool now live in the pqcutils repository - Post-Quantum Cryptography Utilities - a collection of focused tools for auditing PQC adoption in SSH and TLS, all written in Rust and licensed under the BSD 2-clause license.

The tools are complementary by design:

• PQCScan: active scanning. Connect to live hosts and record what PQC algorithms they advertise.
• PQCDump: passive analysis. Analyze existing PCAP captures and record both what was advertised and what was actually negotiated.

Introducing PQCDump

PQCDump takes a PCAP capture file and produces a self-contained HTML report. It parses SSH and TLS handshakes from the capture, reconstructing both the capability advertisements (what each side offered) and the negotiated outcome (what was ultimately agreed upon).

The report breaks results into four views:

• SSH host capabilities — the KEX algorithms each SSH server advertised during the handshake
• SSH negotiated sessions — the algorithm that was actually used in each session
• TLS host capabilities — the key share groups each TLS server advertised in its ServerHello
• TLS negotiated sessions — the group that was ultimately agreed upon

A Walk-Through

To demonstrate, a packet capture was taken on an internal network, the kind of capture a network engineer might already have sitting around from a troubleshooting session. As will be seen, the capture contained a mix of SSH traffic and HTTPS sessions.

Running PQCDump against it by providing a capture file and, optionally, an output path:

pqcdump internal-capture.pcapng -o internal-report.html

The report starts with an overview of the number of hosts detected in the capture as well as the number of both SSH and TLS sessions and how many used PQC-safe algorithms.

Diving deeper, the SSH tab shows the internal SSH servers and clients. Only one of the hosts advertises mlkem768nistp256-sha256, a hybrid PQC-safe key exchange algorithm. However, we can see from the Sessions section that the negotiated algorithm was curve25519-sha256@libssh.org leaving the connection vulnerable to a future post-quantum attack.

The TLS tab tells a different story in this network. As the sessions to cloud services and major CDN-hosted endpoints show X25519MLKEM768 negotiated successfully, the vast majority of the connections are PQC-safe using this hybrid algorithm.

Supported Algorithms

PQCDump identifies PQC support across both protocols:

SSH — KEX algorithms are matched against databases derived from OpenSSH and OQS-OpenSSH, covering both standardized and experimental hybrid algorithms.

TLS — All common standardized PQC-hybrid and pure PQC key share groups are identified, including X25519MLKEM768, SECP256R1MLKEM768, SECP384R1MLKEM1024, MLKEM512, MLKEM768, and MLKEM1024. TLS 1.2 sessions are noted separately since PQC key exchange requires TLS 1.3.

More Information

For more verbose output while the tool is running, standard Rust log levels can be set via the environment:

RUST_LOG=debug pqcdump capture.pcapng
[DEBUG pqcdump] link: Ethernet
[DEBUG pqcdump] This may be an SSH_MSG_KEXINIT message
...
[INFO  pqcdump] === Host Capabilities ===
[INFO  pqcdump] 192.168.1.10
[INFO  pqcdump]   sntrup761x25519-sha512@openssh.com true
[INFO  pqcdump]   curve25519-sha256 true
...

Binary releases for Linux, macOS, and Windows are available on the pqcutils releases page. Both PQCScan and PQCDump can be built from source with a standard Rust toolchain:

git clone https://github.com/anvilsecure/pqcutils.git
cd pqcutils/pqcdump && cargo build --release

Feedback is welcome. The project is licensed under the 2-clause BSD license, and feature requests, bug reports, and pull requests are all welcome via GitHub.