A structured guide to Qontomcrypt's PQC methodology — covering the seven-stage engagement lifecycle, the five-factor risk model, Priority Score tiers, and the cryptographic protection layers underpinning the Qontomcrypt Data Protection Platform.
Section 1
Quantum computing poses a structural threat to the public-key cryptography that secures today's digital infrastructure. Adversaries are already collecting encrypted data today, intending to decrypt it once a cryptographically relevant quantum computer (CRQC) becomes available — the harvest-now, decrypt-later (HNDL) attack. Organisations that hold long-lived sensitive data — medical records, financial contracts, legal documents, regulated data — are already exposed.
Qontomcrypt is a post-quantum cryptography advisory and tooling service developed by DKUSH Innovatech. It provides organisations with a complete, evidence-led path from cryptographic discovery through to NIST-standardised PQC migration — and ongoing quantum readiness monitoring.
This document outlines Qontomcrypt's engagement methodology, the five-factor risk model used to score cryptographic assets, the Priority Score and migration tier system, and the cryptographic protection layers of the Qontomcrypt Data Protection Platform.
Section 2
Every Qontomcrypt engagement follows the same structured lifecycle — from initial scoping through to ongoing quantum readiness monitoring. The lifecycle is designed to be repeatable, auditable and defensible.
Section 3
The Qontomcrypt risk model scores every cryptographic asset on five factors — producing a weighted Priority Score from 0–100 that determines migration urgency. The model is transparent, auditable and defensible.
How long does the data protected by this asset need to remain confidential? Long-lived data — medical records, legal contracts, financial archives — scores highest. Data with a short retention period scores lower.
A 30-year financial archive scores 5. A session token with a 24-hour lifetime scores 1.
How vulnerable is the algorithm to a cryptographically relevant quantum computer? RSA and ECC — the foundations of today's PKI — are broken by Shor's algorithm and score highest. Symmetric algorithms with sufficient key length score lower.
RSA-2048 scores 5. AES-256 scores 1.
How accessible is the encrypted data to an adversary today? Publicly accessible TLS traffic on the open internet scores highest. Air-gapped archive storage with no external connectivity scores lowest.
A public-facing HTTPS endpoint scores 5. An offline encrypted backup tape scores 1.
What is the business impact of a breach of this asset? Payment systems, customer PII, regulated data and national security information score highest. Internal tooling and low-sensitivity data score lower.
A payment processing HSM scores 5. An internal development certificate scores 1.
How complex is the migration for this asset? Legacy systems with embedded cryptography, third-party dependencies and long vendor lead times score highest. Modern, well-documented systems with active vendor support score lower.
A legacy mainframe with embedded RSA scores 5. A cloud-managed TLS certificate scores 1.
Section 4
The five factor scores are combined into a single weighted Priority Score from 0–100. The score determines which migration tier each asset is assigned to — and therefore which wave of the migration programme it falls into.
Override policy: The model supports manual overrides for assets where business context requires a different priority — for example, long-lived high-value data subject to specific regulatory or contractual obligations that the model does not fully capture.
Section 5
The Qontomcrypt Data Protection Platform applies multiple cryptographic layers to protect data at rest. Each layer is independently standardised and together they provide defence-in-depth against both classical and quantum adversaries.
| Layer | Method | Quantum Status |
|---|---|---|
| Key Encapsulation | ML-KEM-768 + X25519 hybrid | Quantum-safe |
| Data Encryption | AES-256-GCM | Quantum-resistant |
| Key Wrapping | Data key wrapping [CONFIRM] | Under review |
ML-KEM-768 is standardised in NIST FIPS 203. The hybrid construction combines ML-KEM-768 with X25519 (classical ECDH) so that security is maintained even if one algorithm is later found to be weak. AES-256-GCM provides authenticated encryption for data at rest and is considered quantum-resistant at 256-bit key lengths (Grover's algorithm halves effective key length to 128 bits, which remains secure).
Section 6
The Qontomcrypt migration methodology translates the Priority Score output into a structured, wave-based programme. Each phase has defined activities, outputs and success criteria.
We begin with a comprehensive discovery of every cryptographic asset in your organisation — algorithms, keys, certificates, protocols, and the systems that depend on them. No assumptions. No sampling. Complete coverage.
Each cryptographic asset is assessed against quantum-vulnerability criteria, data sensitivity, and regulatory requirements. We produce a scored, classified inventory that forms the foundation for all subsequent decisions.
The Priority Score drives a clear P1–P4 migration sequence. We validate ownership, map dependencies and apply overrides where business context requires — producing a defensible migration plan.
Wave-based migration execution using only NIST-standardised post-quantum algorithms. Each migration is validated, documented and reflected in the updated CBOM.
Quantum risk is not static. Ongoing monitoring tracks CBOM changes, vendor readiness, remediation progress and the evolving quantum threat timeline.