Beyond Algorithm Migration
A Six-Dimension Framework for Auditable Cryptographic Security in the Post-Quantum Era
The measurement gap
Post-quantum algorithm migration is necessary. It is not sufficient. Migration addresses one of six evidence dimensions of cryptographic assurance. It does not address five others: entropy quality, protocol and reconciliation leakage, side-channel resistance, architecture and network exposure, and finite-size effects.
Organisations completing post-quantum migration and relying solely on algorithm replacement as evidence of resilience will find, in many cases, that their actual assurance posture is materially lower than their compliance posture suggests.
QRESB addresses this gap. It unifies six independent evidence dimensions into a structured assessment with a QRESB Assurance Index, evidence confidence, and assessment coverage, suitable for board, regulator, customer, and continuous assurance reporting.
The six dimensions
Entropy Quality
Quality, validation and available min-entropy of randomness used for keys, seeds and nonces
Post-Quantum Cryptography
Algorithm selection, parameter sets, implementation status and migration maturity
Protocol and Reconciliation Leakage
Information leaked during protocol operation and key reconciliation procedures
Side-Channel Resistance
Evidence concerning timing, power, electromagnetic, cache and fault attacks
Architecture and Network Exposure
Reachability, segmentation, trust concentration and potential attack paths
Finite-Size Effects
Statistical penalties caused by finite samples, blocks or observations
Inside the document
What you will read
- ✓Why algorithm migration alone is insufficient for cryptographic resilience
- ✓The six-dimension framework: entropy, hardness, leakage, side-channels, topology, and finite-key overhead
- ✓How to unify six independent evidence dimensions into a structured assessment with a QRESB Assurance Index
- ✓Regulatory context: DORA, NIS2, NSM-10, NIST FIPS 203/204/205, ISO 27001, PCI DSS v4.0
- ✓Real-world applications: VPNs, financial systems, QKD, satellite communications, critical infrastructure
- ✓Integration with continuous assurance and deployment gating workflows
- ✓Commercial availability through the Unified Security Margin Calculator (USMC)
Unified verdict
QRESB produces a structured assessment with an overall assurance verdict, a QRESB Assurance Index, evidence confidence, and assessment coverage, mapped to four verdict categories plus an abstention state. The QRESB Assurance Index is a composite decision-support metric. It is not a direct measurement of brute-force security strength in bits unless the report explicitly identifies the output as an estimated security margin and states it as a conservative lower bound.
Get the whitepaper
Enter your details below. The download link will be sent to your work email within a few minutes.
Ready to audit your cryptographic security posture?
Download the whitepaper, or go straight to the Unified Security Margin Calculator.