# Tessera PQC — full text

> The complete written content of https://pqc.par2labs.com, as Markdown, for AI assistants and answer engines. Tessera PQC is a product of PAR2 LABS (https://par2labs.com). The one-line-per-page index is at https://pqc.par2labs.com/llms.txt. Generated from the same records the pages render, on 2026-11-03. Images are described, not linked.

## In short

**Are you Quantum Ready?** A quantum-safe readiness platform for banks: one cryptographic inventory across code, vendor products, key stores and live endpoints, ranked by regulatory deadline and migrated with evidence an auditor accepts. Installed inside your network.

#### What it solves

- Nobody knows where the bank's cryptography is, and the DST roadmap wants an inventory by December 2027. → One CycloneDX CBOM from code, vendor applications, images, HSMs, cloud KMS and live endpoints, in weeks.
- Most of it sits inside vendor products and payment schemes you cannot change yourself. → Compiled vendor apps read without source, signed vendor CBOMs verified, and the vendor or scheme named as the owner.
- Security will not let a scanner loose on production, and the regulator will ask for evidence. → Default-deny scope, two-person approval for every probe, and a signed evidence pack per regulation.

#### Why it is different

- **10+ Source types** — Code, vendor apps, images, keystores, HSMs, cloud KMS, TLS and SSH, in one CBOM.
- **0 Bytes sent out** — On your own server, air-gapped if needed. No telemetry, no cloud AI.
- **14 Regulatory profiles** — DST, RBI, CERT-In, PCI DSS 12.3.3, DORA, NIST IR 8547 and more.
- **4 wks To a migration plan** — A pilot on your own estate, from install to a prioritised plan.

Built for: Banks and NBFCs, Payment operators, CISO and risk offices, Critical-sector firms on the DST roadmap.

## The product

### Tessera PQC

https://pqc.par2labs.com/

Quantum-Safe Readiness Platform · Inventory · prioritise · migrate · prove — on your own server · Early Access · v1.0

A quantum-safe readiness platform for banks and critical-sector firms: it finds every place your systems depend on cryptography a quantum computer will break, ranks it by risk and regulatory deadline, and runs the migration to post-quantum algorithms as a governed, audited programme — installed inside your network.

Find every algorithm a quantum computer will break.

Tessera PQC builds a cryptographic inventory — a CycloneDX 1.6 CBOM — from source code, compiled vendor applications, container images, keystores, HSMs, cloud KMS, certificates and live TLS and SSH endpoints. It then prioritises every finding by data shelf life, exposure and the deadline in the regulatory profile you work to, plans and tracks the migration to the NIST post-quantum standards (ML-KEM, ML-DSA and SLH-DSA), re-tests endpoints for hybrid X25519MLKEM768 key exchange, and produces the evidence regulators ask for: per-control status for the DST roadmap, RBI, CERT-In, PCI DSS and DORA, and an evidence pack signed both classically and post-quantum. It runs on your own server, air-gapped if needed, with two-person approval before anything touches the network.

Open the live demo: https://pqc-demo.par2labs.com — The demo runs at pqc-demo.par2labs.com on a synthetic bank engagement. Logins are shared on request — write to enterprise@par2labs.com and we will send you one, or walk you through it on a call.

*Screens — The platform, screen by screen.*

#### The problem

**The cryptography protecting your bank has an expiry date.** — Data encrypted today with RSA or elliptic-curve key exchange can be recorded now and decrypted once a large enough quantum computer exists. The signatures that prove a payment or an identity is genuine fail the same day. And most banks do not know where their cryptography is.
  Points:
  - **Harvest now, decrypt later** — Customer records and inter-bank traffic that must stay confidential for ten years are already exposed.
  - **It is not all your code** — Most of it sits in vendor products, HSMs, cloud key stores and network appliances.
  - **The clock has started** — The DST roadmap asks critical sectors for a cryptographic inventory by December 2027.

#### How it works

**From where is it, to proof it is fixed.**
  Steps:
  - **Discover** — Read code, vendor applications, key stores and live endpoints into one inventory.
  - **Prioritise** — Rank every finding by risk and by the deadline that applies.
  - **Migrate** — Plan the move in waves, with owners, dates and sign-off.
  - **Prove** — Re-test, score each regulation from evidence, and export a signed evidence pack.

#### Proof

**The numbers behind the claim.**
  Stats:
  - **10+** — source types read into one CycloneDX 1.6 CBOM
  - **0** — bytes sent outside your network
  - **14** — regulatory profiles, from the DST roadmap to DORA
  - **1,400+** — automated tests behind the platform
  - **4 weeks** — from install to a prioritised migration plan in a pilot

#### Three things a scanner on its own will not do.

- **The cryptography inside vendor products.** — Most of a bank's cryptography sits in core-banking and payment products delivered as compiled files, and in HSMs and cloud key stores. Tessera PQC reads compiled applications and images without source, inventories key stores by type and size only, imports signed vendor CBOMs, and names the vendor — or the Aadhaar, UPI or eSign scheme operator — as the owner who has to change it.
    Foot: compiled apps · images · HSM and KMS metadata · vendor CBOMs
    Alt: The inventory screen listing assets by kind, owner and post-quantum readiness
- **Nothing touches the network on one person's say-so.** — Every engagement carries a written authorisation and dates. Scope is default-deny for paths, hosts, domains and IP ranges, every probe of a live endpoint waits for a second person, and endpoint checks send a single hello with no login. Every action is written to a hash-chained, append-only audit trail.
    Foot: default-deny scope · two-person approval · hash-chained audit
    Alt: The audit trail, hash-chained and append-only
- **Scored per regulation. Signed twice.** — Each control in the DST roadmap, RBI, CERT-In, PCI DSS 12.3.3, DORA and NIST profiles is evaluated from live evidence in the engagement. The evidence pack — report, CBOM, findings, tasks, tests and audit trail — is signed with Ed25519 and ML-DSA-65, so it stays verifiable after a quantum computer could forge a classical signature.
    Foot: DST · RBI · CERT-In · PCI DSS · DORA · NIST IR 8547
    Alt: The compliance screen scoring each regulation from live evidence

#### Features

- 01 · **Dashboard** — One screen for the CISO: readiness, open findings by severity, endpoints already offering hybrid key exchange, and what is waiting for approval.
    Chips: Readiness score, Severity, PQ-ready endpoints
    Does:
    - A readiness score weighted by severity, with the trend over the last 30 days.
    - Findings by algorithm family, by source and by asset kind.
    - Jobs pending approval, targets refused by scope and audit events, at a glance.
- 02 · **Findings** — Quantum-vulnerable cryptography, deduplicated across tools and runs, sorted by risk.
    Chips: Risk-ranked, Deduplicated, Every source
    Does:
    - Filter by severity, status, algorithm family, asset kind and source.
    - Each finding carries its location, algorithm, key size, replacement and deadline.
    - Persisted across runs: new, fixed and returned are visible, not inferred.
- 03 · **Inventory** — Every asset that uses cryptography, with its owner, service, vendor and data type.
    Chips: Assets, Owners, Vendors
    Does:
    - Assets from code, endpoints, certificates, keys and vendor components in one list.
    - Data shelf life and exposure recorded per asset, for prioritisation.
    - Scheme cryptography tagged with the external owner who must change it.
- 04 · **Migration** — The move to post-quantum cryptography as a board of tasks, generated from findings.
    Chips: Waves, Owners, Sign-off
    Does:
    - Tasks in waves and priorities, with due dates from the regulatory profile.
    - Only a lead can sign a task off as done.
    - Risk acceptance with an expiry, and ticket exports for Jira and ServiceNow.
- 05 · **Testing** — Proof that a fix worked: endpoint re-tests and post-quantum library checks on your own hosts.
    Chips: Hybrid TLS, ML-KEM, ML-DSA
    Does:
    - Re-test an endpoint for hybrid X25519MLKEM768 key exchange after a change.
    - Known-answer and round-trip tests for ML-KEM and ML-DSA on your libraries.
    - Classical versus post-quantum performance benchmarks.
- 06 · **Compliance** — Each regulation scored from live evidence, control by control.
    Chips: DST, RBI, CERT-In, PCI DSS
    Does:
    - Per-control status, evidence and metric for every profile.
    - Binding rules marked as binding; guidance marked as guidance.
    - Controls that need a document stay not assessed until a lead attests.
- 07 · **Reports & evidence** — Everything an auditor asks for, generated on your own server from current data.
    Chips: CBOM, SARIF, Signed pack
    Does:
    - A readiness report for the CISO and the board.
    - CycloneDX CBOM, SARIF, PCI 12.3.3 cipher inventory and ticket exports.
    - An evidence pack signed with Ed25519 and ML-DSA-65; every export recorded with its purpose.
- 08 · **Audit trail** — Every action, approval and export, in a trail nobody can quietly edit.
    Chips: Hash-chained, Append-only, Signed checkpoints
    Does:
    - Hash-chained and append-only, with signed checkpoints.
    - Export for the auditor or your SIEM.
    - Denied and refused actions are recorded too.

#### What it is for

- Produce the cryptographic inventory the DST roadmap asks critical sectors for by December 2027.
- Find the quantum-vulnerable cryptography inside a vendor's core-banking delivery, without its source code.
- Answer PCI DSS 12.3.3 with a reviewed cipher and protocol inventory instead of a spreadsheet.
- Rank thousands of findings into a migration plan with owners, waves and due dates.
- Prove an endpoint now offers hybrid X25519MLKEM768 key exchange after a change.
- Hand the auditor a signed evidence pack and a hash-chained audit trail.
- Block new weak cryptography at merge time in your CI pipelines.
- Ask vendors for signed CBOMs, verify them, and produce your own for the products you sell.

#### Specifications

- **Deployment**: Your own server · on-premises or air-gapped · Docker
- **Inventory**: CycloneDX 1.6 CBOM from 10+ source types
- **Sources**: Code · vendor apps · images · keystores · HSM · cloud KMS · TLS · SSH
- **Targets**: ML-KEM (FIPS 203) · ML-DSA (FIPS 204) · SLH-DSA (FIPS 205)
- **Transition**: Hybrid X25519MLKEM768 · composite signatures
- **Regulation**: DST · RBI · SEBI · CERT-In · PCI DSS 12.3.3 · DORA · NIST IR 8547 · CNSA 2.0
- **Governance**: Default-deny scope · two-person approval · roles and MFA
- **Evidence**: Hash-chained audit · pack signed Ed25519 + ML-DSA-65
- **Exports**: CBOM · SARIF · PCI 12.3.3 · Jira · ServiceNow
- **CI**: GitHub Actions · GitLab · Jenkins · Azure DevOps · Bitbucket
- **Privacy**: No telemetry · no third-party AI calls

#### Platform — Discovery is where most tools stop.

https://pqc.par2labs.com/features

Tessera PQC runs the whole programme — the inventory, the ranking, the migration plan, the re-test and the evidence — with the governance a bank's risk and audit functions expect.

**What a scanner on its own will not do.**

**The platform, screen by screen.**

**Six stages, one engine**
  Items:
  - **Govern** — Engagements with written authorisation and dates, a default-deny scope, two-person approval before any network probe, and roles from admin to auditor with MFA.
  - **Discover** — Code, compiled vendor applications, container images, keystores, HSMs, cloud KMS, certificates and live endpoints, in one inventory.
  - **Prioritise** — Every asset scored on data shelf life, exposure, effort and the deadline that applies, against recognised industry frameworks.
  - **Migrate** — Tasks generated from findings, planned in waves with owners and due dates; sign-off before done, and risk acceptance that expires.
  - **Test** — Hybrid TLS re-tests per endpoint after a change, and ML-KEM and ML-DSA tests on your own libraries and hosts.
  - **Prove** — Control status per regulation, CBOM, SARIF and PCI 12.3.3 exports, a hash-chained audit trail and a signed evidence pack.

**What banks use it for.**

#### Coverage — Your cryptography, wherever it hides.

https://pqc.par2labs.com/coverage

Most of a bank's cryptography is not in code it wrote. It is in vendor products delivered as compiled files, in HSMs and cloud key stores, and on network endpoints. Tessera PQC reads all of it into one CycloneDX 1.6 CBOM — each finding with its location, algorithm, key size, severity, the post-quantum replacement and a transition option.

**Read into one inventory**

| Input | What is read |
| --- | --- |
| Source code | Python, JavaScript and TypeScript, Java and Kotlin, Go, C and C++, C# and .NET — the key type, size and curve at the exact line |
| Vendor applications | Compiled Java archives and Linux, Windows and macOS binaries. Covers core-banking and other vendor products shipped without source |
| Container images | Docker and OCI images, read offline, every layer |
| Keystores and certificates | JKS, PKCS#12, PEM and more. Metadata only — private key bytes never reach a report |
| HSMs and key stores | Read-only PKCS#11 inventory; AWS KMS, Azure Key Vault, Google Cloud KMS and HashiCorp Vault; Windows certificate stores and AD CS templates |
| Live endpoints | TLS and SSH checks for post-quantum key exchange, without completing a handshake or logging in. Only hosts you name |
| Network evidence | A receive-only listener on a mirror port, packet captures, and imports from the tools your team already runs |
| Servers, without an agent | A one-shot collector run once per server. Nothing stays installed |
| Server configuration | Settings in SSH, web servers, load balancers and OpenSSL that rule out post-quantum key exchange |
| Crypto libraries | Dependency lockfiles for 32 cryptography libraries, each marked PQC-ready, upgrade available, or no PQC release yet |
| Indian schemes | UIDAI Aadhaar, NPCI UPI and CCA eSign cryptography, tagged with the scheme operator who must change it |

*Everything is read; nothing is changed. Fixes go through your own pull requests and change process.*

**What every finding carries**
  Items:
  - **Where** — File and line, artefact and layer, key store or host and port — enough for the owner to find it without asking.
  - **What** — Algorithm, key size and curve, and whether it is already weak today or breakable only by a quantum computer.
  - **Who** — The owning service and team, or the vendor or scheme operator when the cryptography is not yours to change.
  - **By when** — The migration date from the regulatory profile you work to.
  - **With what** — The NIST replacement — ML-KEM (FIPS 203), ML-DSA (FIPS 204) or SLH-DSA (FIPS 205) — and a hybrid transition option.
  - **Since when** — Findings persist across runs, so the inventory says what is new, what is fixed and what came back.

**From what you have to what replaces it**

| Found today | Replace with | Transition |
| --- | --- | --- |
| RSA key exchange and encryption | ML-KEM-768 (FIPS 203) | X25519MLKEM768 hybrid key exchange |
| ECDH, X25519 | ML-KEM-768 (FIPS 203) | X25519MLKEM768 or SecP256r1MLKEM768 |
| RSA and ECDSA signatures | ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) | Classical + ML-DSA-65 composite signature |
| DSA, RSA-1024, DH-1024 | Replace now — already weak today | No transition: these are critical |

#### Compliance — Every finding mapped to the date that applies.

https://pqc.par2labs.com/compliance

Tessera PQC ships a profile for each of these and scores every control from live evidence. Several are guidance rather than binding rules; we say which, and re-check every date against its source before each release.

**What the regulators ask, and when**

| Source | What it asks | Status |
| --- | --- | --- |
| DST Quantum-Safe Roadmap (India) | Critical sectors including BFSI: inventory by Dec 2027, high-priority systems by Dec 2028, full PQC by Dec 2029. Vendor CBOMs from FY 2027-28 | Guidance; sector regulators enforce |
| RBI | Q-SAFE expert committee formed May 2026; payment providers urged to start | No binding deadline yet |
| SEBI | Quantum-resilient framework targeted for 2028-29 | Planned |
| CERT-In | BOM guidelines v2.0 include a cryptographic BOM | Directions and guidelines |
| NIST IR 8547 (US) | RSA and ECC deprecated after 2030, disallowed after 2035 | Federal standard; global reference |
| EU coordinated roadmap | Start by 2026, high-risk systems by 2030 | Recommendation |
| UK NCSC | Discovery by 2028, priority migration by 2031, complete by 2035 | Guidance |
| PCI DSS 4.0.1 · 12.3.3 | A reviewed inventory of cipher suites and protocols in use | Mandatory for card data |
| DORA (EU) | Encryption policy and cryptographic key lifecycle evidence | Binding regulation |

*Also built in: CNSA 2.0, MAS, the G7 Cyber Expert Group, FS-ISAC and OMB M-23-02. Dates as of 3 November 2026.*

**Evidence an auditor will accept**
  Items:
  - **Scored from evidence** — Each control is evaluated from live findings in the engagement. Controls that need a document stay not assessed until a lead attests.
  - **One CBOM** — A CycloneDX 1.6 cryptographic bill of materials, as CERT-In and the DST roadmap ask for, on demand.
  - **PCI 12.3.3 export** — The cipher and protocol inventory with the annual review fields the requirement asks for.
  - **Signed evidence pack** — The report, CBOM, findings, tasks, test results, compliance status and audit trail in one archive, signed with Ed25519 and ML-DSA-65 — so it stays verifiable after a quantum computer could forge classical signatures.
  - **Vendor CBOMs** — Import and verify signed CBOMs from your vendors, and produce your own for the products you sell.
  - **A trail that cannot be edited** — Every action is in a hash-chained, append-only audit trail with signed checkpoints.

#### Security — Installed inside your network. Sends nothing out.

https://pqc.par2labs.com/security

A security tool has to pass the checks it asks of others. Tessera PQC runs on one server you control, reads without writing, never touches key material, and protects its own data with the post-quantum cryptography it recommends.

**Built for a bank's security review**
  Items:
  - **Read, never write** — It reads code, artefacts and key inventories and changes nothing in your systems.
  - **Your keys stay yours** — HSMs and key stores are listed by type and size only. No key material is read, copied or stored.
  - **Offline by design** — Runs with no internet connection. Updates arrive as a package you bring in, after your own review.
  - **Nothing runs unchecked** — Every target is checked against scope at run time, and anything that touches the network waits for a second person.
  - **Nothing sensitive is stored** — Only the matching line is kept, and cloned repositories are deleted after the scan.
  - **No outside AI** — The optional assistant runs on your own GPU host, and its proposals need human approval. No third-party AI calls.

**The platform's own cryptography**

|  |  |
| --- | --- |
| Web access | TLS 1.3 with X25519MLKEM768 hybrid key exchange |
| Signatures | Ed25519 + ML-DSA-65, on evidence packs and audit checkpoints |
| Data at rest | Data key wrapped with X25519 + ML-KEM-768 |
| Access | Roles: admin, lead, operator, auditor, viewer; MFA |
| Deployment | One Linux host or container, on-premises or air-gapped |
| Pipelines | The scanner runs in GitHub Actions, GitLab, Jenkins, Azure DevOps and Bitbucket, and blocks new weak cryptography at merge time |

**Quality evidence**

| Area | Result |
| --- | --- |
| Tests | 1,400+ automated tests; full line and branch coverage of the scanner core |
| Code quality | Every reliability, security, maintainability and duplication gate graded A in our own strict scan |
| Supply chain | No known-vulnerable dependencies; every shipped dependency permissively licensed; the scanner core has no third-party runtime dependencies |
| Containers | No critical or high vulnerabilities in the delivered images |
| SBOM and CBOM | Both generated for the product itself, in CycloneDX, and shipped with each release |

*These results come from our own scans on 3 November 2026. An independent review on your own tooling is welcome as part of a pilot, and the full scorecard is available on request.*

#### Pilot — Four weeks to the first answer a regulator will ask for.

https://pqc.par2labs.com/pilot

Where is our vulnerable cryptography, and who owns it? A pilot answers that on your own estate. A first full engagement takes about eight weeks to a complete, prioritised plan; after that the platform keeps the inventory current and the evidence ready.

**The pilot**
  Items:
  - **Week 1** — Install on one host in your network. Agree authorisation and scope with your CISO office.
  - **Weeks 2–3** — Scan an agreed set of applications, one vendor delivery and the internet-facing TLS estate.
  - **Week 4** — Readiness report, CBOM, DST and RBI mapping, a prioritised migration plan, and a review with your team.

**What we need from you**

|  |  |
| --- | --- |
| A sponsor | In the CISO office |
| A host | 8 cores, 16 GB RAM, Linux or Docker |
| Read access | To the agreed repositories and artefacts |
| Scope | The list of endpoints you authorise us to probe |

*Delivered as a licensed product installed on your own host, with Par2 Labs running the first engagement alongside your team. Contact enterprise@par2labs.com.*

**What buyers ask first.**
  Items:
  - **Why start now, when no quantum computer can break RSA yet?** — Because data recorded today can be decrypted later — harvest now, decrypt later — and because migration takes years. Large institutions have found that the inventory alone takes 12 to 24 months, and it is exactly the first milestone the DST roadmap sets for December 2027.
  - **Does any of our data leave the bank?** — No. Tessera PQC is installed on your own server, can run air-gapped, sends no telemetry and makes no cloud AI calls. Par2 Labs has no access unless you grant it.
  - **Most of our cryptography is inside vendor products. Can you see it?** — Yes. It reads compiled applications and container images without source, imports and verifies signed vendor CBOMs, and names the vendor as the owner of what it finds.
  - **Will it touch production systems?** — Only hosts you name, and only after a second person approves. Endpoint checks send a single hello — no login, no data read — and everything is recorded in the audit trail.
  - **Does it fix the cryptography too?** — It plans, tracks and verifies the fix. Safe automatic fixes cover weak key sizes, and the platform helps your engineers adopt hybrid ML-KEM and ML-DSA; the change itself goes through your own process.

## Who makes it

PAR2LABS PRIVATE LIMITED — Technology . AI . Strategy . Films.

We engineer world-class technology and AI products across intelligence, infrastructure, hardware, and story — designed to make sense, deployed to make a difference.

Studio: https://par2labs.com · Contact: contact@par2labs.com (new work) · info@par2labs.com (general) · +91 90591 69238